Active Directory Security Checklist for 2026 (Printable)

AD hardening checklist

Active Directory security checklist

We're the pentesters behind Insight Recon. This is the Active Directory security checklist we'd work through on any domain, in the order we'd fix things. Every item says why it matters and links the guidance behind it.

70 items 12 groups Updated November 2026

Progress: 0 of 70 done

The free scan at insightrecon.com checks 51 of these 70 items for you.

Run a free scan

Start with the 32 items marked Do first. You can close the tab and pick up where you left off.

What the free scan covers

51 of 70 items checked for you in a few minutes, 12 of them in part.

Free scan checks it39
Free scan checks part of it12
Checked on paid plans4
Check by hand15

Behind those items are 140+ of the 155+ checks the scan runs. The 15 by hand are things our scan doesn't read, like backups, recovery drills and how admins sign in. See every check

Your progress

0 of 70 done

Do first: 0 of 32

Show

After you run the scan, pick By hand to see the 15 items it doesn't check.

Your ticks save in this browser.

Jump to

01Before you start0/5
02Easy wins0/10
03Tier 00/6
04Delegation and ACLs0/7
05AD CS0/6
06Legacy auth and relay0/7
07Domain controllers0/7
08Trusts0/4
09Admin tiering0/5
10Hybrid identity0/5
11Logging0/4
12Recovery0/4

Nothing left in this view. If you've ticked everything, run the scan again to make sure the fixes stuck.

Before you change anything

0 of 5 done

Get a baseline and a way back before you touch anything. Cleanup goes a lot faster when a mistake is easy to undo.

Run a read-only assessment of every domain and keep the reportA dated report gives you a baseline to measure progress against later.
Do firstThe free scan does this for one domain. See every check it runs
Sources: ASD/CISA/NSA Microsoft
Write down your Tier 0Your DCs, AD CS, AD FS and Entra Connect are Tier 0. So is anything that can control them. In most shops that means your backup, patching, hypervisor and EDR tools need DC-level protection too.
Do firstCheck this by hand
Source: Microsoft
Look for signs you're already compromisedHardening won't evict an attacker who already holds DCSync rights or a backdoor on AdminSDHolder. Find those before you start fixing anything.
Do firstFree scan checks part of this: DCShadow Activity Risky DCSync Permissions Risky AdminSDHolder Permissions Privileged SIDs in sIDHistory Stale Domain Controller PasswordsThe scan looks for what an intruder leaves in AD, like a DCShadow registration or extra DCSync rights. Your DC logs and EDR alerts are where the rest shows up.
Sources: ASD/CISA/NSA Microsoft
Confirm you have recent backups of at least two writable DCs per domainIf a change goes wrong or you find an intruder, you'll want a clean restore point. You can't restore a backup older than the tombstone lifetime, which is 180 days by default. Check yours if the forest is old.
Do firstFree scan checks part of this: Stale AD Backup No Domain Controller RedundancyThe scan checks how old your last AD backup is and that you have more than one DC. Only a test restore tells you a backup works.
Sources: Microsoft DISA STIG V-243493
Turn on the AD Recycle Bin before you start cleaning upDeleted objects come back with their group memberships intact, so a cleanup mistake is a quick undo. Once it's on, it stays on. Protect OUs from accidental deletion while you're there.
Do firstFree scan checks this: Recycle Bin is Disabled Accidental Deletion Protection Not On OUs
Deep dive: AD Recycle BinSource: Microsoft

Take away the easy wins

0 of 10 done

Attackers check these in their first hour on a network, usually with free tools anyone can download.

Require Kerberos pre-authentication on every accountWithout it, anyone can ask a DC for data encrypted with the account's password and crack it offline. That's AS-REP roasting. If an app truly needs it off, give that account a long random password and keep it out of admin groups.
Do firstFree scan checks this: Accounts with Kerberos Pre-Authentication Disabled
Deep dive: AS-REP roastingSource: ASD/CISA/NSA
Get passwords out of Group Policy and AD attributes like descriptionsAny domain user can read both. Old Group Policy Preferences passwords sit in SYSVOL behind a key Microsoft published years ago.
Do firstFree scan checks this: Password in GPO Possible Passwords in Account Descriptions Possible Password in AD Attributes
Sources: ASD/CISA/NSA NSA/CISA top 10
Clear the "password not required" and reversible encryption flagsThe first lets an account have a blank password. The second keeps a copy of the password in AD that can be turned back into plain text. That copy stays until the password changes, so reset those passwords after you clear the flag.
Do firstFree scan checks this: Accounts with No Password Requirement Accounts with reversible passwords GPO Enables reversible password use Pre-Created Computer Accounts Detected
Deep dive: Password not requiredSource: CIS Benchmark
Keep SPNs off privileged accounts and remove SPNs nobody usesAny domain user can request a ticket for an account with an SPN and crack it offline. If that account is a Domain Admin, that's the whole domain.
Do firstFree scan checks this: Accounts Vulnerable to Kerberoasting
Deep dive: KerberoastingSources: ASD/CISA/NSA Microsoft
Turn off LLMNR and NetBIOS name resolutionLLMNR and NBT-NS let anyone on the same subnet answer a name lookup and collect a hash to crack or relay.
Do firstFree scan checks part of this: LLMNR EnabledThe scan checks the LLMNR policy. NetBIOS is set per network adapter or through DHCP, so check that one on your machines.
Deep dive: LLMNR and NBT-NSSource: NSA/CISA top 10
Move service accounts to gMSAs or give them random passwords of 30+ charactersKerberoasting only pays off when the password can be cracked. A gMSA gets a long random password that Windows rotates for you.
Do soonFree scan checks part of this: Accounts Vulnerable to Kerberoasting gMSA Not In Use gMSA with Stale Password gMSA Password Readable by Unprivileged PrincipalsThe scan flags roastable accounts and gMSA problems. It can't see how long a regular service account's password is.
Deep dive: Readable gMSA passwordsSources: ASD/CISA/NSA Microsoft
Deploy LAPS everywhere and limit who can read the passwordsA shared local admin password lets an attacker hop from one machine to all of them. Use the built-in Windows LAPS, since the old MSI version is deprecated.
Do soonFree scan checks this: LAPS Not In Use Risky LAPS read permissions
Deep dive: LAPSSources: Microsoft DISA STIG V-243471
Set a minimum password length of 14 or more, with longer minimums for admins and service accountsShort passwords fall to password spraying. Once a hash leaks, they crack fast offline as well.
Do soonFree scan checks part of this: Password Policy Set for Less than 8 Characters Fine-Grained Password Policy Not AppliedThe scan flags a domain policy that allows fewer than 8 characters. Getting it to 14 or more is on you.
Sources: CIS Benchmark ASD/CISA/NSA
Set the account lockout threshold to 5 or fewer, never 0Lockout caps how many guesses a password spray gets against each account. Use a fine-grained password policy to keep break-glass accounts from locking out. Before you lower it, look for accounts that already rack up bad password attempts. Otherwise the help desk will be clearing lockouts all week.
Do soonCheck this by hand
Sources: CIS Benchmark ASD/CISA/NSA
Find accounts whose passwords never expire or haven't changed in yearsAn old password has had years to end up in a breach dump or a cracked hash list.
OngoingFree scan checks this: Accounts with Non-Expiring Passwords Accounts With Stale Passwords
Deep dive: Non-expiring passwordsSource: CIS Benchmark

Shrink Tier 0

0 of 6 done

Admin groups collect people over the years and nobody remembers adding half of them. Every account in them is a way to own the forest.

Cut Domain Admins and Enterprise Admins down to a few named people and keep Schema Admins emptyMicrosoft's tier model says a common target is fewer than five people with Domain Admin-level access. Give any service account in there the rights it actually needs before you pull it out.
Do firstFree scan checks this: High Number of Privileged Users Schema Admins Group Not Empty Computer Account Detected in Privileged Group Privileged Group Contains Foreign Security Principal
Deep dive: Schema AdminsSources: Microsoft DISA STIG V-243467
Empty the operator groups and DnsAdminsMicrosoft counts Backup Operators and Server Operators as Tier 0. Account Operators, Print Operators and DnsAdmins have known routes to Domain Admin. Find out what each member is for first, since backup software often runs as a member of Backup Operators.
Do firstFree scan checks this: Operator Groups In Use DNS Admins Group Not Empty
Deep dives: Operator groups DnsAdminsSource: Microsoft
Remove stale admin accounts and rotate passwords on the ones you keepIf nobody uses an admin account, nobody notices when an attacker starts using it. An admin password that never changes keeps any old leak working.
Do soonFree scan checks this: Inactive Privileged Users Disabled Privileged Accounts Privileged Users with Stale Passwords Non-Expiring Passwords in Domain Admins Group Possible Duplicated Accounts
Sources: CIS Controls 5.3 NSA/CISA top 10
Put admins in Protected Users and mark them as sensitive so they can't be delegatedTheir sign-ins can't use NTLM or weak Kerberos encryption and their credentials don't get cached or delegated. Test with one admin first.
Do soonFree scan checks this: Protected Users Group Not Utilized Privileged Users Allowed to Be Delegated
Deep dive: Protected UsersSources: Microsoft DISA STIG V-243477
Lock down the built-in Administrator and Guest accountsTheir SIDs are well known, so they're the first accounts attackers try. Keep Guest disabled and save Administrator for recovery.
Do soonFree scan checks this: Built-in Administrator account used recently Guest Account Enabled
Sources: Microsoft CIS Controls 4.7
Reset the krbtgt password twice every 180 days or sooner, at least 10 hours apartWhoever steals the krbtgt key can forge a Golden Ticket for any account. That key keeps working until the password has been reset twice. Check that the first reset has replicated, then wait out the max ticket lifetime before the second so live tickets don't break. It's 10 hours by default.
Do soonFree scan checks this: Stale krbtgt Account Password
Deep dive: krbtgt resetsSources: Microsoft CISA

Fix delegation and dangerous permissions

0 of 7 done

Most of these don't show up in ADUC unless you go looking. They're behind a lot of the paths to Domain Admin we find on pentests.

Remove unconstrained delegation from everything that isn't a DCAnyone who signs in to that machine leaves a reusable ticket behind. Coercion tricks can even force a DC to do it. Move anything that still needs delegation to constrained delegation or RBCD first.
Do firstFree scan checks this: Unconstrained Delegations Detected
Deep dive: Unconstrained delegationSources: DISA STIG V-243478 Microsoft
Limit DCSync rights to DCs and the few accounts that truly need themAnyone with replication rights can pull every password hash in the domain. The krbtgt hash comes with them. Old Exchange installs are a common culprit.
Do firstFree scan checks this: Risky DCSync Permissions Exchange Not Hardened
Sources: ASD/CISA/NSA Microsoft
Audit AdminSDHolder and the permissions and owners on privileged objectsAttackers love AdminSDHolder as a backdoor because an extra permission on it gets copied onto every protected admin account and group within the hour.
Do firstFree scan checks this: Risky AdminSDHolder Permissions Dangerous Control Over Privileged Objects Privileged Objects With Unprivileged Owners Non-Standard Domain Controller Owner Unknown Account within Delegation
Deep dives: AdminSDHolder Who owns your DCsSource: Microsoft
Check who can write msDS-KeyCredentialLink on admins and DCsWrite access there lets someone add their own key and sign in as that account without its password. The trick is called shadow credentials.
Do firstFree scan checks this: Shadow Credential Write Access on Privileged Objects
Source: ASD/CISA/NSA
Set ms-DS-MachineAccountQuota to 0By default any user can add up to 10 computers to the domain. That's a common first step in relay and RBCD attacks. Give the people and tools that join machines the right to create computer objects in their OUs first. Otherwise their joins start failing.
Do firstFree scan checks this: Non-administrative users can add computer accounts
Deep dive: MachineAccountQuotaSources: ASD/CISA/NSA DISA STIG WN25-DC-000350
Review constrained delegation and RBCD, then turn off protocol transition where you don't need itProtocol transition lets a compromised service account impersonate any user to the services it can delegate to. That includes your admins.
Do soonFree scan checks this: Constrained Delegation through protocol transition enabled Constrained Delegation Detected Resource-Based Constrained Delegation Configured SPN-less Constrained Delegation
Deep dives: Constrained delegation RBCDSource: Microsoft
Lock down who can edit GPOs and the scripts and files they deployWhoever can edit a GPO that applies to DCs or admin workstations can run code on them.
Do soonFree scan checks this: Risky GPO Control Permissions Risky GPO Login Script Permissions Overly permissive GPO deployed file Risky GPO Assignment to Local Groups Dangerous User Rights Assigned by GPO
Source: DISA STIG WN25-DC-000090

Lock down AD CS

0 of 6 done

Skip this group if you don't run Active Directory Certificate Services. If you do, one bad template can take a regular user to Domain Admin. The free scan checks ESC1 through ESC17, apart from ESC12.

Fix risky certificate templatesA template that lets the requester name the subject or use the certificate for any purpose can hand a regular user a certificate for an admin or a server.
Do firstFree scan checks this: ESC1 ESC2 ESC3 ESC13 ESC15 ESC17
Sources: ASD/CISA/NSA NSA/CISA top 10
Restrict who can modify templates, PKI objects and the CAWrite access to a template or the CA lets an attacker build their own ESC1.
Do firstFree scan checks this: ESC4 ESC5 ESC7
Sources: ASD/CISA/NSA NSA/CISA top 10
Remove EDITF_ATTRIBUTESUBJECTALTNAME2 from your CAs and keep the SID extension onThat flag lets any request name another user. Turning off the SID extension strips the SID that ties a certificate to its owner.
Do firstFree scan checks this: ESC6 ESC16
Deep dive: Weak certificate mappingsSources: ASD/CISA/NSA Microsoft
Protect web and RPC enrollment from NTLM relayA coerced DC sign-in relayed to web enrollment gets the attacker a certificate for that DC. From there they can take the domain.
Do firstFree scan checks this: ESC8 ESC11
Source: NSA/CISA top 10
Fix weak certificate mappingsPatched DCs have enforced strong mapping since February 2025. The opt-out went away in September 2025, so weak mappings now fail the logon instead of letting someone in. What's left is DCs missing those updates, Schannel still allowing UPN mapping and anyone who can write altSecurityIdentities on an admin. The last two are ESC10 and ESC14.
Do soonFree scan checks this: ESC9 ESC10 ESC14 Accounts with Weak Certificate Mappings
Deep dive: Weak certificate mappingsSource: Microsoft
Give your CAs DC-level protection, with the CA key in an HSM and backups locked downWhoever steals a CA's private key can mint a certificate for anyone. That's a Golden Certificate and resetting passwords won't undo it.
Do soonCheck this by hand
Sources: ASD/CISA/NSA Microsoft

Let the scan do the first pass

Going through this list by hand means a lot of PowerShell and a lot of reading permissions. The free scan checks 51 of these items in a few minutes. Most of its 155+ checks map to something on this list. The rest cover things that didn't make the cut, like WSUS over HTTP and open DNS zone transfers.

When we ran AD tools on pentests, we spent a lot of time working out which findings mattered most. So ours looks at what each finding touches in your domain. Take Kerberos pre-auth. If it's off on a disabled account, that's a cleanup job. On an enabled Domain Admin the report calls it critical.

Run a free scan See a sample report

What to fix first. Quick Wins and your Top 10 riskiest findings sit at the top of the report.
The fix for every finding. Each one names the accounts or objects involved and walks you through the fix in PowerShell or the GUI. Run the scan again and you'll see it's gone.
Account Risk Scores. On paid plans, every account gets a score from the findings it's tied to, along with its privilege chain into groups like Domain Admins. You'll know whose account to lock down first.
Read-only. It reads AD as a standard domain user and installs nothing on your DCs. Only HTTPS leaves your network.

Retire legacy auth and stop relays

0 of 7 done

Most of Microsoft's 2025 and 2026 hardening changes land here, so some of this may already be on by default. Check before you assume either way.

Set LAN Manager authentication to "Send NTLMv2 response only. Refuse LM & NTLM"LM and NTLMv1 responses can be cracked back to a password or hash. DCs on the default setting still accept them. Check your DCs' 4624 events for NTLM V1 sign-ins first, because anything still using it fails once you refuse it.
Do firstFree scan checks this: NTLMv1 or LM is Permitted LM Hash in Use
Deep dive: NTLMv1Sources: DISA STIG WN25-SO-000310 ASD/CISA/NSA
Require SMB signing on DCs, then on every other Windows machineUnsigned SMB lets an attacker relay a captured sign-in to another server. Windows 11 24H2 Pro, Enterprise and Education require it by default. Most member servers still don't require it on incoming connections. Test NAS boxes and other third-party SMB devices first, since the ones that can't sign will stop working.
Do firstFree scan checks this: Domain Controller with SMB Signing Not Required Computer with SMB Signing Not Required Hardened UNC Paths Not Enforced
Deep dives: SMB signing SMB signing bypassSources: Microsoft NSA/CISA top 10
Require LDAP signing on DCs and clientsUnsigned LDAP binds can be relayed to change AD objects, like setting up RBCD on a computer. Before you enforce it, check the Directory Service log for events 2887 and 2889. They show what's still doing unsigned or simple binds, which stop working the moment signing is required. Windows Server 2025 only requires it by default on new deployments, not upgrades.
Do firstFree scan checks this: LDAP Signing Not Enforced on Domain Controllers LDAP Client Signing Disabled by GPO
Deep dives: LDAP signing LDAP signing bypassSource: Microsoft
Remove RC4 and DES from Kerberos on every account and trustRC4 tickets are keyed with the account's unsalted NT hash, so they crack fast. Since the April 2026 updates, patched DCs assume AES for accounts with no setting. The July 2026 updates took the rollback away. Find any account with no setting that still depends on RC4 and fix it, because a patched DC won't hand it RC4 anymore.
Do firstFree scan checks this: DES/RC4 Support Enabled Accounts with SPNs Not Supporting AES User Accounts with DES Enabled AES Not Enabled on Trust
Deep dives: RC4 in Kerberos DES and RC4 support DES-enabled accountsSources: Microsoft DISA STIG WN25-SO-000290
Set LDAP channel binding to "Always" on DCsChannel binding protects LDAPS, which LDAP signing doesn't. Watch for event 3039 first so you know which clients would break.
Do soonFree scan checks this: LDAPS Channel Binding Not Enforced
Deep dive: LDAP channel bindingSources: Microsoft CIS Benchmark
Remove SMBv1 from DCs, then from everything elseSMBv1 is how WannaCry spread and it has none of the later versions' protections. Turn on SMBv1 auditing first and watch for event 3000 to find the old devices that still need it before they break.
Do soonFree scan checks part of this: Domain Controllers with SMBv1 EnabledThe scan checks your DCs. Member servers and old devices on the network are on you.
Deep dive: SMBv1 on DCsSources: ASD/CISA/NSA Microsoft
Audit where NTLM is still used and start moving those apps to KerberosNTLM is what most relay attacks ride on. Microsoft plans to turn network NTLM off by default in the next major Windows Server release.
OngoingCheck this by hand
Source: Microsoft

Harden the domain controllers

0 of 7 done

Whoever controls a DC controls the domain. These items cut down what can reach your DCs and what an attacker could take from them.

Patch DCs on a tight schedule and reboot themDC bugs get exploited fast. Several of the 2025 and 2026 hardening changes on this list only arrive through updates.
Do firstFree scan checks this: Domain Controller with Stale Update
Sources: Microsoft NSA/CISA top 10
Turn off the Print Spooler and WebClient services on DCsThe spooler lets any domain user make a DC authenticate to a machine they pick. WebClient makes those forced sign-ins easier to relay.
Do firstFree scan checks this: Print spooler service is enabled on a Domain Controller WebClient Service Running on Domain Controllers
Deep dive: Print Spooler on DCsSources: ASD/CISA/NSA CIS Benchmark
Retire unsupported Windows and raise the functional level to 2016 or laterUnsupported systems don't get fixes. Old DCs also hold the whole domain back from newer protections, so start with those. Windows Server 2016 leaves extended support in January 2027, so don't plan new DCs on it.
Do soonFree scan checks this: Legacy Operating System on Domain Controller Legacy Operating Systems Detected Legacy Domain Functional Level Detected NTFRS SYSVOL Replication Active
Sources: Microsoft DISA STIG V-243480
Keep DCs dedicated to AD DS, with no browsing and no outbound internetEvery extra app or web session on a DC is another way into Tier 0.
Do soonCheck this by hand
Sources: Microsoft DISA STIG V-243475
Turn on LSA protection on DCs and limit who can sign in to themLSA protection makes dumping credentials from memory harder. Fewer sign-ins also leave fewer credentials to dump. Run it in audit mode first and check CodeIntegrity events 3065 and 3066. That way a password filter or smart card driver doesn't stop loading on your DCs.
Do soonCheck this by hand
Sources: Microsoft CIS Benchmark
Make sure DC machine passwords rotate and clean out DCs that no longer existA DC's computer account can replicate the whole domain, so a stolen DC password stays dangerous until it changes.
Do soonFree scan checks this: Stale Domain Controller Passwords Inactive Domain Controllers Stale Computer account passwords
Sources: ASD/CISA/NSA DISA STIG WN25-DC-000330
Keep Tier 0 accounts off every RODC's allowed listAn RODC caches passwords for the accounts it's allowed to. A stolen branch-office DC shouldn't hold admin credentials. Skip this one if you don't run RODCs.
Do soonFree scan checks this: Privileged Groups Missing From RODC Denied List RODC Privileged Users Exposed RODC Privileged Groups Can Be Exposed
Source: DISA STIG V-243489

Trusts, SID History and anonymous access

0 of 4 done

Old trusts and migration leftovers tend to outlive everyone who knew why they were there.

Keep SID filtering on for every external and forest trust and strip risky trust attributesWithout it, whoever controls the other domain can claim membership in your admin groups through SID History.
Do firstFree scan checks this: Trust without SID Filtering Dangerous Trust Attributes Detected NT4 Compatible Trust
Deep dive: SID HistorySource: DISA STIG V-243484
Clear out SID History left over from migrationsA privileged SID in an ordinary account's SID History makes it an admin that no group membership shows.
Do firstFree scan checks this: Privileged SIDs in sIDHistory Accounts with SID History Account Migrated from Non-Existent Domain
Deep dive: SID HistorySource: ASD/CISA/NSA
Turn off anonymous access to ADAnonymous binds let anyone who can reach a DC list your users and groups without a password. Check dSHeuristics, then take Anonymous Logon and Everyone out of Pre-Windows 2000 Compatible Access.
Do firstFree scan checks this: Anonymous Access to AD Enabled Anonymous NSPI Access Permitted Insecure dSHeuristics Configuration Over permissioned "Pre-Windows 2000 Compatible Access" Group Custom "Pre-Windows 2000 Compatible Access" Group Membership
Sources: DISA STIG V-243503 V-243486
Use selective authentication on outgoing forest trusts and delete trusts nobody usesEvery trust is a way in and selective authentication limits it to the servers you allow. Before you switch it on, grant Allowed to Authenticate on the servers people from the other forest use. Otherwise they lose access right away.
Do soonFree scan checks part of this: Inactive Trust Detected Trust Accounts with Stale PasswordsThe scan finds trusts that look unused and trust passwords that stopped rotating. Whether a trust uses selective authentication is yours to check.
Sources: DISA STIG V-243485 Microsoft

Keep admin work off everyday machines

0 of 5 done

This is the slow one. Tiering takes months in most shops, so start early and roll it out in pieces.

Give every admin a separate admin account with no mailbox and no web browsingIf an admin's everyday account gets phished, the attacker shouldn't get the domain with it.
Do firstFree scan checks part of this: Administrator Accounts With Email AddressesThe scan flags admin accounts that have an email address. Whether anyone browses the web with them is yours to check.
Sources: CIS Controls 5.4 DISA STIG V-243468
Block Tier 0 accounts from signing in to workstations and member serversEvery sign-in to a lower-tier machine leaves credentials there for an attacker to lift. Move any services and scheduled tasks that run as Tier 0 accounts first, because the deny rights stop those from running.
Do soonCheck this by hand
Source: Microsoft
Do Tier 0 admin work only from privileged access workstationsIf the machine you're typing on is compromised, so is every server you connect to from it.
Do soonCheck this by hand
Source: Microsoft
Require phishing-resistant MFA for admin accessA stolen password alone shouldn't be enough to act as Tier 0. Smart card accounts still have an NT hash behind them, so rotate it on a schedule.
Do soonFree scan checks part of this: Smart Card Required Accounts with Stale PasswordsThe scan checks that smart card accounts still get their password rotated. MFA is enforced outside AD, so check it wherever you set it up.
Sources: CIS Controls 6.5 DISA STIG V-243476
Grant admin rights just in time instead of permanentlyAn account that's always in Domain Admins is worth stealing any day of the week. If the rights only show up when someone asks for them, a stolen password gets an attacker a lot less.
Do soonCheck this by hand
Source: Microsoft

Where AD meets Entra ID

0 of 5 done

If you sync to Entra ID, your AD and your tenant can each be used to attack the other.

The scan's hybrid checks are on paid plans. They read what Entra Connect leaves in on-prem AD and never touch your tenant.

Protect Entra Connect servers and the sync account like DCsWith password hash sync, the sync account can pull password hashes the way a DC does. Whoever owns the Entra Connect server can own AD.
Do firstChecked on paid plans: Synchronization Account Is Privileged Synchronization Account Can Reset Privileged Passwords Synchronization Account Can Modify Privileged Groups Synchronization Principal Can Control Tier 0 Objects Synchronization Account Has Excessive AD Permissions Synchronization Permissions Reach AdminSDHolder-Protected Objects Non-Tier 0 Principal Controls Synchronization Account Synchronization Account Is Delegatable Multiple Synchronization Accounts Hold DCSync Rights
Deep dives: Tenant to AD Hybrid attack surfaceSource: Microsoft
Remove old sync accounts and rotate the active one's passwordLeftover sync accounts keep their rights long after anyone remembers they exist. When you rotate the password, put the new one into Entra Connect's Synchronization Service Manager right away. If you don't, sync stops.
Do soonChecked on paid plans: Inactive or Orphaned Synchronization Account Multiple Enabled Synchronization Accounts Detected Disabled Synchronization Account Retains Sensitive Permissions Synchronization Account Password Is Stale
Sources: CIS Controls 5.3 Microsoft
Roll over the Seamless SSO key at least every 30 days and lock down AZUREADSSOACC$Anyone holding that key can forge Kerberos tickets that Entra ID accepts for your synced users. Run the rollover only once per forest each time. Running it twice breaks Seamless SSO until users' tickets expire.
Do soonChecked on paid plans: Stale Entra Seamless SSO Account Password Unauthorized Control Over the Entra Seamless SSO Account Unexpected Owner of the Entra Seamless SSO Account Dangerous Kerberos Delegation on the Entra Seamless SSO Account Resource-Based Constrained Delegation on Entra Seamless SSO Account Entra Seamless SSO Account Is Not Protected from Delegation Entra Seamless SSO Account Supports Weak Kerberos Encryption Unexpected SPNs on Entra Seamless SSO Account Multiple Entra Seamless SSO Account Objects Detected
Deep dive: Hybrid attack surfaceSource: Microsoft
Keep admins out of the AzureADKerberos password replication policyWith cloud Kerberos trust, that policy decides which accounts can sign in to AD with tickets Entra ID issues. Microsoft blocks admins by default and says not to relax it.
Do soonChecked on paid plans: AzureADKerberos Password Replication Policy Exposes Privileged Accounts Unauthorized Control Over AzureADKerberos Object Dangerous Delegation on AzureADKerberos Object
Deep dive: Tenant to ADSource: Microsoft
If you still run AD FS, protect it like a DC and rotate its token-signing certificatesA stolen token-signing key lets an attacker forge sign-ins to every app that trusts AD FS. That's Golden SAML. Before a new certificate goes primary, give it to Entra ID if you federate with it. Do the same for partners that don't read your federation metadata. Miss one and those sign-ins fail.
Do soonCheck this by hand
Sources: ASD/CISA/NSA Microsoft

Log what matters

0 of 4 done

The scan checks that the audit settings exist. Collecting the events and alerting on them is a job for your SIEM or detection tools.

Apply the advanced audit policy to DCs and audit changes to AdminSDHolder and other key objectsWithout these events, DCSync and changes to admin groups leave nothing behind to investigate.
Do soonFree scan checks part of this: Insufficient Domain Controller LoggingThe scan checks the advanced audit policy your DCs get. Auditing on AdminSDHolder and other key objects is set separately, so check those yourself.
Sources: Microsoft DISA STIG WN25-DC-000210
Turn on PowerShell script block and module loggingA lot of AD attack tooling runs through PowerShell. These logs show what actually ran.
Do soonFree scan checks this: Weak PowerShell Logging
Sources: ASD/CISA/NSA CIS Controls 8.8
Send DC, CA, AD FS and Entra Connect logs to a central SIEM and review themLogs that only live on a DC can be wiped by whoever takes the DC.
OngoingCheck this by hand
Sources: ASD/CISA/NSA CIS Controls 8.9
Plant canary accounts that nobody should ever touchA decoy that alerts the moment someone requests its ticket or tries its password turns Kerberoasting and spraying into loud, easy-to-spot events.
OngoingCheck this by hand
Source: ASD/CISA/NSA

Plan for the bad day

0 of 4 done

If someone does get Domain Admin, these decide how long you're down.

Encrypt DC backups and keep an offline copy that only a few people can touchAnyone who gets a copy of a DC backup can pull the password hashes out of it, so protect it like a DC.
Do soonCheck this by hand
Sources: ASD/CISA/NSA CIS Controls 11.4
Write a forest recovery plan and test itForest recovery is a long process with a strict order. You don't want to be learning it in the middle of an incident.
Do soonCheck this by hand
Sources: Microsoft CIS Controls 11.5
Change the DSRM password at least once a year or let Windows LAPS manage itDSRM is a local admin account on every DC. Its password is often whatever someone typed during promotion.
Do soonCheck this by hand
Sources: DISA STIG V-243479 Microsoft
Re-run your assessment after every fix and on a scheduleAD drifts as people add accounts and hand out rights. Re-running the assessment is how you know a fix stuck.
OngoingRun the free scan again after each fix. Free keeps your latest scan only. Scheduled scans, scan history and remediation tracking start on Standard.
Source: Microsoft

Where this Active Directory security checklist comes from

Microsoft's AD security guidance, including its December 2025 threat guidance and the 2026 Kerberos and NTLM changes
The ASD, CISA and NSA guide Detecting and mitigating Active Directory compromises
The NSA and CISA top ten misconfigurations advisory
CIS Controls v8.1 and the CIS Benchmarks
The DISA Active Directory and Windows Server 2025 STIGs

Check names link to our checks library. Last reviewed October 30, 2026.

Insight Recon insightrecon.com/active-directory-security-checklist Updated November 2026

Active Directory security checklist questions

What should an Active Directory security checklist include?

Start with who holds admin rights and the Kerberos and password settings attackers go after first. Then cover delegation, permissions on privileged objects and AD CS if you run it. After that come the legacy protocols that make relay attacks possible, DC hardening, logging and recovery. If you sync to Entra ID, add the accounts and permissions Entra Connect leaves behind in AD. Every item on this Active Directory security checklist links the Microsoft, government, CIS or DISA guidance behind it.

How often should I review Active Directory security?

We'd go through a checklist like this one at least once a quarter. Do it again after big changes like a migration, a new trust or an Entra Connect rebuild. A few items run on their own schedule, like the krbtgt reset every 180 days and the DSRM password every year. Check each fix right after you make it, since AD drifts. Standard and Enterprise add a Windows agent that runs our scan on a schedule and marks every finding as new, modified or remediated. You can also get an email after each scan listing the findings that weren't there last time.

What's the most important Active Directory security setting?

There isn't one setting that fixes AD. If we had to pick one place to start, it'd be shrinking Tier 0. That means fewer Domain Admins and none of them signing in to everyday machines. Right behind it are the easy wins attackers try first, like accounts without Kerberos pre-authentication and passwords left in Group Policy.

Is there a free Active Directory security assessment?

Yes. Insight Recon's Free plan covers one domain per company. You'll see every core AD finding in it, with no cap and no credit card. Only the hybrid identity checks need a paid plan. The free scan checks 51 of the 70 items on this list for you, some of them only in part. Your Quick Wins and Top 10 come first and every finding comes with its fix. The sample report is a full report from a test domain. Consultants scanning client domains for paid work need the Auditor plan instead.

Other free options include PingCastle's free edition and Semperis's Purple Knight. PingCastle's free edition is licensed for internal use. Our PingCastle and Purple Knight comparisons cover how they differ.

How often should you reset the krbtgt password?

Microsoft's December 2025 guidance and the Windows Server 2025 STIG say at least every 180 days. ASD's guide says at least every 12 months. Whichever you follow, reset it twice. Let the first reset replicate and wait for existing tickets to expire before the second. CISA says that's at least 10 hours. After a suspected compromise, don't wait for the schedule.

Which checklist items can a scanner check and which are manual?

A scanner can read anything stored in AD, Group Policy or DC settings. That covers group membership, account flags and delegation. It also covers permissions, AD CS templates and protocol settings, which is most of this Active Directory security checklist. Our free scan checks 51 of the 70 items, 12 of them in part. Paid plans add the 4 hybrid identity items.

The 15 marked Check by hand live outside what our scan reads, like whether admins use phishing-resistant MFA or whether anyone has tested a forest recovery. On the items the scan checks in part, a line under the check names says what's left for you.

Do I need Domain Admin rights to check these settings?

Not for Insight Recon. A standard domain user account is all the scan needs and nothing gets installed on your DCs. We'd rather you didn't run it as Domain Admin anyway. The uncomfortable part is that any domain user can read most of what's on this list. An attacker with one phished account sees the same gaps you do.

What changed in Active Directory security in 2026?

Microsoft's Kerberos updates for CVE-2026-20833 make DCs assume AES for accounts with no encryption types set. That's been on by default since the April 2026 updates. The July 2026 updates removed the rollback. Since the October 2026 update, Windows 11 24H2 and later and Windows Server 2025 also block NTLMv1-based single sign-on by default. That breaks automatic Wi-Fi and VPN sign-ins that still use MS-CHAPv2.

Microsoft has said it plans to turn network NTLM off by default in the next major Windows Server release. The ASD, CISA and NSA guide got a September 2026 update that expands its sections on detecting DCSync and on shadow credentials. Strong certificate mapping has been enforced on patched DCs since 2025. If you haven't looked since last year, start with the RC4 and NTLM items.

Your turn

Find out which of these your domain fails

The free scan checks 51 items on this Active Directory security checklist in a few minutes. Your Quick Wins and Top 10 come up first, with the fix for every finding. The Free plan gets you one domain and every core AD finding, with no credit card.

Run a free scan Book a demo

Account Risk Scores and scheduled scans start on Standard, along with remediation tracking and new-finding alerts. If you want help with the fixes, our team does remediation.