Sample Report
A real Active Directory security assessment report
This is the full report from an Insight Recon security assessment of Paddy's Pub, a test Active Directory domain. It turned up 93 findings. Each one explains how an attacker would use it and how to fix it. Run the same scan on your own domain for free.
It's read-only and doesn't need Domain Admin. We're SOC 2 Type 1 audited.
Click around, we know you want to.
Open any finding to read the whole write-up and use the sidebar to jump between sections.
The report is long and built for a bigger screen. Open it now or send it to yourself for later.
What's in the report
The risk posture score and where to focus first. It's the page you hand to leadership.
Jump to it → PrioritiesQuick wins and the 10 riskiest findings. Start here when you're short on time.
Jump to it → Detailed findingsAll 93 findings, filterable by severity and status. Click one to open the full write-up.
Jump to it → Trends and changes StandardWhat changed since the last scan and how severity has moved across runs.
Jump to it → ConfigurationWhat's in the domain: accounts and groups, infrastructure, PKI and Group Policy.
Jump to it → The riskiest findingESC1 tops this report's riskiest list: a certificate template that lets the requester choose the subject. It's how a regular user ends up holding a certificate for a Domain Admin.
Open the finding →What's inside a finding
Below is an example of the Kerberoasting finding from the report, cut down to fit.
Why it matters, from the attacker's side.
After obtaining access to a domain, kerberoasting is a popular first attack to perform privilege escalation. Attackers choose this path when they don't have a privileged position in the environment and are looking to elevate privileges.
The fix and how risky it is. Prerequisites list what to line up first, like owner sign-off and a rollback plan.
Strengthen or rotate Kerberoastable service account passwords, migrate eligible accounts to gMSA, and validate updated password age and SPN ownership.
Click-by-click steps in ADUC, including updating every service that runs as the account. PowerShell for one account or a reviewed list is in the full finding.
- Locate the affected service account in Active Directory Users and Computers.
- Reset the password. Enter a strong, complex password of at least 25 characters.
- Update the dependent service with the new password in Services.msc or the application's configuration.
- Restart the service and confirm it starts successfully.
Checks to run after the change. The full finding also lists the evidence an auditor will want.
Get-ADUser -Identity <account> -Properties PasswordLastSet- Verify the dependent service is running and authenticating successfully.
- Run Insight Recon AD against the same scope to confirm the finding is resolved.
The frameworks you report against. You also get the affected accounts, with a CSV export.
Most of this report comes with the free plan
Find what's wrong in one domain and fix it.
- Every on-prem finding, with no cap or preview
- Hacker insight and remediation steps on each one
- MITRE and compliance mappings
- Risk posture score and quick wins
- Executive summary export and the HTML report
- One domain, with your latest scan kept
Everything in Free, plus:
- Scan history with trends and a diff between scans
- 24 hybrid identity checks
- Account risk scores
- Scheduled scans with the Windows agent
- Your logo on the report
On the free plan, this domain's report would show 77 findings instead of 93. The other 16 come from the 24 hybrid identity checks on Standard.
Run it on your own domain
- Create a free account
It takes a minute. No sales call needed.
- Download the scanner
It's a portable Windows scanner. Nothing gets installed on your domain controllers or endpoints.
- Run it as a standard user
Use any domain-joined Windows machine and a standard domain account. It needs LDAP or LDAPS to a domain controller.
- Read your report
Most scans finish in a few minutes. Large domains take up to about half an hour.
AD metadata: the objects and settings the checks look at. That's what the report is built from.
Password hashes and Kerberos tickets never leave your network. Neither does your NTDS.dit file.
It's stored in Microsoft Azure, encrypted in transit and at rest. You can export or delete it any time. Close your account and it's gone within 30 days.
We've completed our SOC 2 Type 1 audit. Type 2 is next, with the same auditor.
Before you run it
Got another question? Email our support team.
Is this real data?
It's a real scan of a test domain called Paddy's Pub. The company and account names are made up, but the findings and write-ups are what Insight Recon actually produced. Your report will look the same with your own findings.
Do I need Domain Admin to run it?
No. A standard domain user on a domain-joined Windows machine is all it needs.
Will the scan change anything or set off alerts?
It won't change anything. The scan is read-only and nothing gets installed on your domain controllers or endpoints.
It can set off alerts, though. It reads a lot of AD over LDAP in a short time, which some security tools flag as reconnaissance. Give whoever watches your alerts a heads-up first.
What does the free plan include?
A full on-prem assessment of one domain: every on-prem finding with no cap, the hacker insight and remediation steps, compliance mappings, the risk posture score, quick wins and the executive summary export. Free keeps your latest scan. Standard adds scan history with trends and the hybrid identity checks.
Can I share the report with my team or my boss?
Yes. The executive summary export is made for leadership. The HTML report is the one to hand to whoever's doing the fixes.
Can I run it on a client's domain?
Not on Free or Standard. Client work needs the Auditor plan (up to 50 domains) and written authorization from each client. See the plans.
See what your domain looks like
Your numbers will be different. The average first scan we see turns up about 40 findings.
No sales call needed.