Home

Active Directory Security Assessment

See your Active Directory
the way attackers do.

Run 155+ checks against Active Directory and the on-prem footprint of Entra ID. For each finding, Insight Recon shows what's affected, how the issue can be abused, what to fix first, and how to validate the fix. Scanning is read-only, with nothing deployed to your domain controllers or endpoints.

Run a Free Scan View Sample Report
Read-only Portable Windows · Linux on Auditor+ Scheduled Windows Scans 155+ checks
app.insightrecon.com / report / paddyspub-2026-07
Insight Recon
SECURITY ASSESSMENT
DOMAIN paddyspub.local
GENERATED Jul 13, 2026
Active Directory Security Assessment
Active Directory risk
at a glance.
The highest-priority findings, affected objects, and what changed since the last scan.
42OF 100
F · Critical Risk
Higher score means a stronger AD posture.
Critical
10Immediate
High
38Priority
Moderate
24Hardening
Low
21Hygiene
Top PrioritiesOrdered by impact
CritUser-controlled certificate template subject (ESC1)ADCS
CritDangerous control over privileged objectsTier 0
CritSynchronization principal can control Tier 0 objectsHybrid
CritUnrestricted certificate template modification (ESC4)ADCS
Built by The offensive security team at Breach Point 155+ AD & hybrid identity checks Mapped to MITRE ATT&CK, NIST, CIS, and STIG

Deployment

Portable scans or scheduled scanning.

For an on-demand assessment, use the portable Windows scanner with no agent install. Auditor and Enterprise also include a portable Linux scanner. For recurring scans, Standard and above can install the Windows agent and schedule scans automatically. Every scanning mode is read-only, with nothing deployed to your domain controllers or endpoints.

STEP 01

Choose how to run it

  • Portable Windows scanner on every plan
  • Portable Linux scanner on Auditor and Enterprise
  • Windows agent for scheduled scans on Standard+
  • Read users, groups, computers, ACLs, GPOs, ADCS, and trusts
  • Nothing deployed to your DCs or endpoints
STEP 02

Review

  • See every affected object
  • Understand why the finding matters
  • See the attack technique and common tooling
  • Get severity, effort, and first-seen details
STEP 03

Prioritize

  • Top riskiest findings called out
  • Quick Wins pair severity with effort
  • New, modified, and remediated findings tracked
  • Remediation grouped by control area
STEP 04

Remediate

  • PowerShell and GUI remediation paths
  • Validation and follow-up scan steps
  • Exceptions and evidence requirements
  • MITRE and compliance mappings
Insight Recon · Active Directory Scanner
Scanning company.local…
Analyzing access control and delegation rights
55%
✓Connecting to domain controllerdone
✓Enumerating users, groups, computers74 users
●Analyzing ACLs and delegationworking
Reviewing certificate templates (ADCS)pending
Evaluating Group Policy objectspending
Compiling findings and risk scorepending
✓Read-only. We only look. Nothing on your network is changed.
Windows agent · scheduled scanning
Command line
> insightrecon adcheck --domain company.local ================================================ Insight Recon · Active Directory Assessment v2.4.1 · Breach Point, Inc. ================================================ [preflight] DNS resolution ......... ok [preflight] LDAP connectivity ...... ok [preflight] SYSVOL read ............ ok Ready to scan. All checks passed. Running 155+ checks against company.local … ✓ Identity & accounts 74 users, 18 computers ✓ Certificate services ESC1–16 ✓ Group Policy 47 GPOs ✓ Hybrid identity Entra Connect, SSO Scan complete in 3m 12s. CRITICAL 6 HIGH 17 MOD 15 LOW 9 Report uploaded → view it in your Insight Recon portal.
Portable scanner · Windows (Linux on Auditor+)

Hybrid Identity · New

We check the on-prem side
of Entra ID, too.

Entra Connect and related features leave privileged accounts and objects in Active Directory. Insight Recon runs 24 checks against that footprint, including directory sync accounts, AZUREADSSOACC$, and Cloud Kerberos Trust.

On-Premises
Active Directory
Your domain
Syncs to
Cloud
Microsoft Entra ID
Your tenant
Critical

Directory sync accounts

DirSync / MSOL_

These accounts can reset privileged passwords, modify privileged groups, and hold directory replication rights.

Critical

Seamless SSO account

AZUREADSSOACC$

This account holds the Kerberos secret used by Seamless SSO. If the key is compromised, an attacker can forge tickets for synced users.

High

Cloud Kerberos Trust

AzureADKerberos

This object becomes part of the Tier 0 attack surface. Mis-scoped delegation or control over it can create a privilege path.

Coverage

155+ checks across Active Directory
and hybrid identity.

The checks cover the parts of AD we routinely see matter during offensive assessments: privileged access, ACLs, Kerberos, ADCS, Group Policy, trusts, legacy configuration, and the on-prem objects created by Entra integration.

Identity & Accounts

Empty passwords, stale admins, password-not-required, Kerberoastable and AS-REP-roastable accounts.

Privileged Access

Over-permissioned groups, DCSync rights, and dangerous ACLs over privileged objects.

Hybrid IdentityNEW

The on-prem footprint of your Entra sync: directory sync accounts, the Seamless SSO account, and Cloud Kerberos Trust.

Certificate Services

The full ESC1–16 family of certificate template and CA misconfigurations.

Kerberos & Delegation

Unconstrained and constrained delegation, krbtgt password age, ticket abuse.

Group Policy

Risky GPO settings, SYSVOL scripts, and weak domain password policy.

Domain & Trusts

Trust configuration, SID filtering, and domain controller redundancy.

Public Key Infrastructure

Enrollment rights, trusted roots, and weak certificate mappings.

Configuration & Hygiene

SMBv1, Print Spooler on DCs, LAPS coverage, and legacy protocols.

Inside the report

Here's what one
finding looks like.

A finding should get an engineer from “we have a problem” to “we fixed it and proved it.” The report includes the affected objects, attacker context, remediation paths, validation steps, and the evidence to retain after the change.

Attack context and affected objects

See why the issue matters, how it gets abused, and the specific users, groups, computers, templates, or other objects involved.

PowerShell and GUI remediation paths

Prerequisites, remediation objectives, copyable commands, bulk options where appropriate, and ADUC steps for administrators who prefer the GUI.

Validation, exceptions, and evidence

What to verify after the change, how to document a justified exception, what evidence to retain, and when to rescan to confirm closure.

View Sample Report
Accounts with No Password Requirement
Critical

Password requirement settings are not enforced on the reported accounts. Affected accounts may accept an empty password depending on how the account and domain policy were configured.

Severity
Critical
Effort
Easy
Affected
2 accounts
First Seen
Jul 11, 2026
Hacker Insight
An attacker can test these accounts for an empty password over SMB. A successful login gives them authenticated access that can become a foothold for lateral movement, privilege escalation, or persistence.
Remediation Guide
Remove the PASSWD_NOTREQD flag, set a compliant password where needed, then confirm the account is covered by domain password policy.
PowerShell · single objectCopy
$Account = Get-ADUser -Identity "<SamAccountName>" -Properties UserAccountControl
$NewUAC = $Account.UserAccountControl -band -bnot 0x20
Set-ADUser -Identity "<SamAccountName>" -Replace @{UserAccountControl = $NewUAC}
Validate & Close
Verify the flag is cleared, confirm PasswordLastSet, and run Insight Recon again against the same scope. Retain the before-and-after attribute export and change record as evidence.
Compliance Mapping
MITRE T1078MITRE T1110.001NIST PR.AC-1CIS 5 & 6

Between scans

See exactly what changed.

Insight Recon keeps scan history. See your posture score delta, how finding counts changed by severity, what was introduced or fixed, and which issues are persisting across scans.

Risk Posture Score
42↑ 2
New
1
Remediated
8
Modified
3
Unchanged
89

Risk Posture Score over time

1007550250 Jul 11Jul 12Jul 13

Since the previous scan

8 findings remediated
Total findings dropped from 96 to 93
1 new · 3 modified
Changes are separated from unchanged findings

Critical findings still open

User-controlled certificate template subject (ESC1)
Dangerous control over privileged objects
Synchronization principal can control Tier 0 objects

Try it on your domain

Run an Active Directory
assessment for free.

Run an on-demand assessment with the portable Windows scanner. Auditor and Enterprise also support portable Linux. Standard and above can use the Windows agent for automated scheduled scans. Every mode is read-only, with nothing deployed to your domain controllers or endpoints.

Run a Free ScanView Sample Report