How Our Active Directory Scan Works
How it works
From download to report in a few minutes
Insight Recon reads your Active Directory from one Windows machine with a standard user account. Nothing gets installed on your domain controllers and nothing in AD changes.
What you need
Machine
Any Windows machine that can reach your DCs
Account
A standard domain user. No Domain Admin.
Network
LDAP, SMB, RPC and DNS inside your network. Only HTTPS to our portal goes out. See every port
Time
A few minutes for most domains
Free for one domain. No credit card.
Your first scan
Create a free account
It takes about a minute. No credit card and no sales call.
Download the scanner
The portable scanner runs without an install. Nothing goes on your domain controllers.
Run it as a standard user
Use any Windows machine and a standard domain account. It needs to reach your domain controllers but doesn't have to be domain-joined.
Read your report
It lands in the portal a few minutes after the scan uploads. Big domains take about half an hour to scan.
The setup guide has every step with screenshots.
During the scan
What the scanner actually does
It reads your directory, Group Policy and server hardening settings. It pulls all of that over LDAP, SMB, Remote Registry and DNS. Then it sends the metadata to the portal over HTTPS, where your report gets built.
What leaves your network- It reads how AD is set up. That covers accounts, groups and permissions, plus Group Policy and certificate services. Trusts and delegation settings are in there too.
- It's read only. It won't create, modify or delete a single object, policy or setting.
- It doesn't attack anything. No exploits, credential attacks or lateral movement.
- Secrets stay put. Password hashes, Kerberos tickets and NTDS.dit never leave your network.
- It can trip alerts. A burst of LDAP, SMB and Remote Registry reads plus DNS zone transfer attempts looks like reconnaissance to some security tools. Tell whoever watches your alerts before you run it.
A report built around the fix
Free gets you every core AD finding in full. Paid plans add the hybrid identity checks, account risk scores and history, along with remediation tracking and new-finding alerts.
Executive summary
Your score and where to start
A risk posture score out of 100 and where to focus first. It's the page you hand to leadership.
Severity
How we decide severity
Every finding is weighed against your domain. A service account with no encryption types set only gets flagged when a DC would still hand it an RC4 ticket.
Priorities
Quick wins and the top 10
If you're short on time, start with the easy fixes and the 10 riskiest findings.
Paid plans
Accounts ranked by risk
Every account gets a score from the findings it's tied to and its privilege chain, like PrivUserWithEmail → Domain Admins. Sort by risk and lock down the worst first.
Each finding
How it gets abused
Hacker Insight tells you how an attacker would use it and what to line up before you change anything.
The fix
PowerShell and click-by-click steps
Scripts for one object or a reviewed list, plus the same fix in ADUC. Bulk scripts run with -WhatIf until you take it off.
Proof
Checks that show it worked
What to run after the change and the evidence your auditor will ask for. You can export the affected objects to CSV.
Compliance
Mapped to your frameworks
Every finding maps to NIST CSF 2.0 and CIS. Most map to MITRE ATT&CK and about half to STIG and ANSSI. Where they apply, findings also map to MITRE Mitigations and NIST SP 800-53 Rev 5. See the mappings.
Scanners
Run it the way your network allows
Portable Windows scanner
Every planRun a scan whenever you want one. There's nothing to install.
Windows agent
Standard, Enterprise and MSSPInstalls as a Windows service on a machine you choose and runs your scans on a schedule.
Portable Linux scanner
Enterprise and partnersIt's the portable scanner built for Linux. You get it along with the Windows one.
Inside your network
Enterprise and partnersRun Insight Recon on a server inside your network with nothing going out. We quote it per project. How air-gapped works.
After the first scan
Check your work
Rescan
Run it again once the work's done
A rescan confirms the finding is gone and gives you a before and after to show whoever asked for the fix. Paid plans let you put an owner and a due date on each finding. It stays on your list until a scan verifies the fix and reopens if a later scan finds it again.
Standard, Enterprise and MSSP
Catch it when things drift
Scheduled scans keep your history. The portal shows what changed since the last scan and how severity has moved.
If you'd like a hand with the fixes, our team does remediation too.
Before you run it
Do I need to install anything?
Not for a one-off scan. The portable scanner runs without an install. On Standard, Enterprise and MSSP, you can install the Windows agent if you want scans on a schedule. The docs cover both.
How long does a scan take?
Most finish in a few minutes. Large domains can take about half an hour. Your report shows up in the portal a few minutes after the scan uploads.
Does it need Domain Admin?
No. A standard domain user is all it needs. We'd rather you didn't use Domain Admin for it.
Can I scan more than one domain?
Free covers one domain. Standard covers every domain and forest you own, priced on your enabled accounts. Consultants and MSSPs scanning client domains use the Auditor or MSSP plan.
Is there a Linux version?
Yes. Enterprise and our partner plans include a portable Linux scanner alongside the Windows one. The Linux scanner docs have the details.
Run it on your own domain
One domain costs nothing. You'll see every core AD finding and won't need a credit card.