Check catalog¶
99 checks and 5 invariants. Every finding in a report links to its page here, and ad-doctor explain <ID> prints the same text offline.
| ID | Finding | Category | Severity |
|---|---|---|---|
AD-KRB-001 | krbtgt password not rotated recently The krbtgt password is older than 180 days, so a stolen krbtgt key keeps forging valid Kerberos tickets (golden tickets) for that long. | Kerberos | high |
AD-KRB-002 | Accounts without Kerberos pre-authentication (AS-REP roasting) Enabled user accounts that do not require Kerberos pre-authentication, so anyone can get material encrypted with their password and crack it offline. | Kerberos | high |
AD-KRB-003 | User accounts with SPNs (Kerberoasting) Enabled user accounts with a service principal name, whose service tickets any domain user can request and crack offline. | Kerberos | medium / high |
AD-KRB-004 | Accounts limited to DES encryption Enabled accounts flagged to use only DES Kerberos encryption, a broken cipher that current Windows disables by default. | Kerberos | medium |
AD-DEL-001 | Unconstrained delegation outside domain controllers Enabled accounts other than domain controllers are trusted for unconstrained delegation, so they keep the TGT of everyone who authenticates to them. | Delegation | high |
AD-DEL-002 | Constrained delegation with protocol transition Enabled accounts use constrained delegation with protocol transition, so they can impersonate any user to their delegation targets without that user's credentials. | Delegation | medium |
AD-DEL-003 | Resource-based constrained delegation configured Accounts with msDS-AllowedToActOnBehalfOfOtherIdentity set, whose listed principals can impersonate any user to them; each entry needs to be intended. | Delegation | low |
AD-ACC-001 | Enabled accounts allowed an empty password Enabled accounts carry PASSWD_NOTREQD, so their password may be empty no matter what the domain password policy says. | Accounts | medium |
AD-ACC-002 | Reversible password encryption Enabled accounts are set to store their password with reversible encryption, so a DCSync or a DC backup yields the clear-text password. | Accounts | high |
AD-ACC-003 | Privileged accounts whose password never expires Enabled members of tier-0 groups have 'password never expires' set, so a leaked admin password stays valid indefinitely. | Accounts | medium |
AD-ACC-004 | Guest account enabled The domain's built-in Guest account is enabled, giving a logon that needs no known password to anyone who can reach a domain member. | Accounts | high |
AD-ACC-005 | Stale enabled user accounts Enabled user accounts that have not logged on for 90 days or more: unwatched credentials that still work. | Accounts | low |
AD-PRIV-001 | Large tier-0 groups Tier-0 groups with more than five transitive members: every extra member is another account whose compromise means domain compromise. | Privileged access | low |
AD-PRIV-002 | Privileged accounts that can be delegated Privileged user accounts that are neither marked sensitive nor in Protected Users, so any service trusted for delegation can impersonate them. | Privileged access | medium |
AD-POL-001 | Weak default password policy The default domain password policy allows passwords shorter than 12 characters, has complexity off or has no account lockout, which makes password guessing cheap. | Policy | medium |
AD-POL-002 | Any user can join computers to the domain ms-DS-MachineAccountQuota is above 0, so any domain user can create computer accounts, a building block of RBCD, relay and noPac attacks. | Policy | medium |
AD-SEC-001 | Computers without LAPS Enabled Windows computers have no LAPS-managed local administrator password, so one shared local admin password can open many machines. | Hardening | medium |
AD-ADCS-001 | ESC1: enrollee-supplied subject on an authentication template A published certificate template lets broad groups supply the subject of an authentication certificate, so any user can enroll as a domain admin. | Certificate services | high |
AD-ADCS-002 | ESC2: any-purpose or no-EKU template A published certificate template that broad groups can enroll in has the Any Purpose EKU or no EKU at all, so its certificates are valid for any use. | Certificate services | high |
AD-ADCS-003 | ESC3: enrollment agent template open to broad groups A published template that broad groups can enroll in issues Certificate Request Agent certificates, letting any user request certificates on behalf of others. | Certificate services | high |
AD-ADCS-004 | ESC4: broad groups can modify a certificate template Broad groups hold write, WriteDacl or WriteOwner rights on a certificate template, so any user can reconfigure it into an ESC1 template. | Certificate services | high |
AD-ACL-001 | Non-default principals with DCSync rights A principal outside tier 0 holds both replication rights on the domain object, so it can pull every password hash, krbtgt's included, from a domain controller (DCSync). | Permissions | high |
AD-ACL-002 | Non-default control over AdminSDHolder A principal outside tier 0 can rewrite the AdminSDHolder object, whose DACL SDProp copies onto every protected admin account and group every hour. | Permissions | high |
AD-ACL-003 | Non-default control over the domain object A principal outside tier 0 holds write, WriteDacl or WriteOwner on the domain object, so it can grant itself DCSync or change domain-wide settings. | Permissions | high |
AD-GPP-001 | Passwords in Group Policy Preferences Group Policy Preferences files in SYSVOL hold cpassword values, encrypted with a key Microsoft published, so every domain user can read and decrypt the passwords. | Group Policy | high |
AD-ADCS-005 | ESC5: non-tier-0 control over PKI objects Principals outside tier 0 control a PKI object in the configuration partition (NTAuthCertificates, a template or CA container, or a CA object). | Certificate services | high |
AD-ADCS-006 | ESC9: authentication template without the security extension A published authentication template that broad groups can enroll in sets CT_FLAG_NO_SECURITY_EXTENSION, so its certificates carry no SID for strong mapping. | Certificate services | medium |
AD-ADCS-007 | ESC13: issuance policy linked to a group A published authentication template that broad groups can enroll in carries an issuance policy linked to a group, so every enrollee gets that group's rights. | Certificate services | high |
AD-ADCS-008 | ESC15: schema v1 template with enrollee-supplied subject A published schema v1 template that broad groups can enroll in lets the enrollee supply the subject; unpatched CAs (CVE-2024-49019) let them add any application policy. | Certificate services | high |
AD-GPO-001 | GPOs reaching domain controllers editable outside tier 0 A GPO linked to the domain or the Domain Controllers OU can be edited by a principal outside tier 0, who can then run code as SYSTEM on every domain controller. | Group Policy | high |
AD-ACC-006 | adminCount set on accounts that are no longer privileged Enabled users still have adminCount = 1 after leaving the protected groups: forgotten former admins whose frozen, non-inheriting permissions nobody reviews. | Accounts | low |
AD-ACC-007 | Accounts with SID history Enabled accounts carry sIDHistory, which adds the old SIDs to every logon token; privileged or same-domain SIDs there are a persistence backdoor. | Accounts | medium / high |
AD-PRIV-003 | Schema Admins or Enterprise Admins not empty Schema Admins or Enterprise Admins have standing members, although both groups should stay empty except while a forest-level change is being made. | Privileged access | low |
AD-PRIV-004 | Members of DnsAdmins DnsAdmins has members, and any of them can make the DNS service on a domain controller load an arbitrary DLL as SYSTEM. | Privileged access | medium |
AD-PRIV-005 | Anonymous or Everyone in Pre-Windows 2000 Compatible Access Anonymous Logon or Everyone is a member of Pre-Windows 2000 Compatible Access, which lets unauthenticated sessions read users and groups. | Privileged access | medium |
AD-INF-001 | Computers running unsupported Windows versions Enabled computer accounts report a Windows version past Microsoft's end of extended support, which no longer receives security updates. | Infrastructure | medium / high |
AD-INF-002 | AD Recycle Bin disabled The AD Recycle Bin is not enabled, so deleted objects cannot be restored with their attributes and group memberships. | Infrastructure | low |
AD-INF-003 | Domain functional level below Windows Server 2016 The domain functional level is below Windows Server 2016, which leaves out security features that need it and usually means old domain controllers remain. | Infrastructure | low |
AD-INF-004 | Unsafe dsHeuristics settings The forest-wide dSHeuristics value weakens the directory: anonymous LDAP or NSPI, operators outside AdminSDHolder, uniqueness or encryption checks off, or CVE-2021-42291 checks disabled. | Infrastructure | low / medium / high |
AD-INF-005 | LDAP signing not required A domain controller accepts an unsigned NTLM bind on plain LDAP, so authentication relayed from a coerced host can be used to modify the directory. | Infrastructure | medium |
AD-INF-006 | Trusts that let SIDs or TGTs through A trust to another domain or forest lets SID history through or allows TGT delegation, so a compromise of the other side can be carried into this domain. | Infrastructure | high |
AD-INF-015 | Trusts limited to old protocols A trust is a downlevel, NT4-style trust, or does not declare AES, so its referral tickets can be encrypted with RC4. | Infrastructure | low / medium |
AD-INF-016 | Trusts unchanged for over 40 days A trust object has not changed for over 40 days although trust passwords change every 30, so the partner is probably gone. | Infrastructure | low / medium |
AD-INF-017 | Forest trusts without Selective Authentication An outgoing forest trust uses forest-wide authentication, so every account of the other forest can authenticate to every computer here. | Infrastructure | medium |
AD-ADCS-009 | ESC14: weak explicit certificate mappings Enabled accounts have weak explicit certificate mappings in altSecurityIdentities (by subject or e-mail), which any certificate with a matching name satisfies. | Certificate services | medium / high |
AD-ADCS-010 | ESC8: web enrollment accepts NTLM over HTTP AD CS web enrollment (/certsrv/) accepts NTLM or Negotiate over plain HTTP, so relayed NTLM authentication from a DC yields a certificate for that DC. | Certificate services | high |
AD-ADCS-019 | HTTPS enrollment endpoints where EPA is not verified AD CS web enrollment or CES offers Windows authentication over HTTPS, and the scan cannot tell whether Extended Protection is enforced. | Certificate services | low |
AD-ADCS-011 | Published templates allowing keys shorter than 2048 bits Published certificate templates allow RSA keys shorter than 2048 bits (msPKI-Minimal-Key-Size), below current guidance. | Certificate services | medium |
AD-KRB-005 | RC4 readiness: Kerberos encryption settings of service accounts Enabled accounts with an SPN that are set to RC4 only, rely on the domain default, or look like they have no AES keys, read from configuration, not from the keys themselves. | Kerberos | low / medium |
AD-KRB-006 | Seamless SSO key not rolled over The Kerberos key of the Entra ID Seamless SSO account AZUREADSSOACC$ is older than 30 days; whoever holds it can forge tickets to Entra ID. | Kerberos | medium |
AD-DEL-004 | Delegation that reaches domain controllers or krbtgt Enabled accounts may delegate to a domain controller service or to krbtgt, or a DC carries RBCD, so their owners can impersonate any admin to a DC. | Delegation | high |
AD-DEL-005 | Constrained delegation to SPNs no account holds msDS-AllowedToDelegateTo names an SPN no account holds, so someone who controls the delegating account and can write SPNs can register it and impersonate users to an account they control. | Delegation | low / medium / high |
AD-ACL-004 | Non-tier-0 control over tier-0 accounts, groups or DCs A principal outside tier 0 owns or can take over a tier-0 account, group or domain controller (password reset, shadow credentials, RBCD, group membership, full control). | Permissions | high |
AD-ACL-005 | AdminSDHolder inherits permissions Inheritance is enabled on AdminSDHolder, so permissions granted on the System container or the domain flow onto every protected admin account and group. | Permissions | high |
AD-ACL-006 | gMSA passwords readable outside tier 0 A group managed service account's password can be retrieved by a broad group, or a privileged gMSA's by someone outside tier 0, so they can act as that service account. | Permissions | high |
AD-ACC-008 | Passwords in description or info attributes The description or info attribute of enabled accounts appears to contain a password, readable by the scanning user and anyone with the same rights. | Accounts | medium |
AD-ACC-009 | Readable password attributes Password attributes (userPassword, unixUserPassword, msSFU30Password, orclCommonAttribute) are set on accounts and readable by an ordinary user. | Accounts | high |
AD-ACC-010 | Pre-created computer accounts with predictable passwords Pre-created computer accounts that were never used still have the lower-cased computer name as their password, so anyone can take them over. | Accounts | high |
AD-ACC-011 | Privileged accounts with passwords older than a year Enabled tier-0 accounts, or the built-in Administrator, have not changed their password in over a year. | Accounts | medium |
AD-ACC-012 | pwdLastSet newer than the real password change on tier-0 accounts On krbtgt or a tier-0 account, pwdLastSet is later than the time replication metadata gives for the last write of unicodePwd, so the password is older than it looks. | Accounts | medium / high |
AD-ACC-013 | Key credentials or certificate mappings on tier-0 accounts A tier-0 account holds a key credential or a strong certificate mapping: a way to log on without its password. Normal for Windows Hello and smart cards, and also what a backdoor looks like. | Accounts | low / medium / high |
AD-PRIV-012 | Tier-0 group members this account cannot read A DN in the member attribute of a tier-0 group did not come back from the searches, so the object is hidden from, or unreadable by, the scanning account. | Privileged access | high |
AD-PRIV-006 | Disabled, computer or foreign accounts in tier-0 groups Tier-0 groups contain disabled accounts, non-DC computer accounts or foreign security principals, members that nobody watches as tier 0. | Privileged access | medium |
AD-PRIV-007 | Membership hidden through primaryGroupID Enabled accounts are made members of a privileged or domain controller group through primaryGroupID, which does not appear in the group's member list. | Privileged access | high |
AD-PRIV-008 | Operator groups not empty Account, Server, Print or Backup Operators have members, and each of these groups has rights on domain controllers that lead to domain admin. | Privileged access | medium |
AD-PRIV-009 | Unexpected members of Cert Publishers Cert Publishers has members other than enterprise CA servers, giving them write access to every user's certificates and to the AIA container. | Privileged access | medium |
AD-PRIV-010 | Protected Users not used for administrators Protected Users is empty while Domain Admins has enabled user members, so admin credentials can still be cached, delegated and used with NTLM, DES or RC4. | Privileged access | info |
AD-SEC-002 | LAPS passwords readable by the scanning account The ordinary account used for the scan could read LAPS passwords, so the local administrator password of those computers is open to too many people. | Hardening | high |
AD-INF-007 | BadSuccessor: dMSA creation rights outside tier 0 On a Windows Server 2025 domain, principals outside tier 0 can create a delegated managed service account (dMSA) and use it to inherit any account's rights (BadSuccessor). | Infrastructure | high |
AD-GPO-002 | Non-tier-0 principals can link GPOs to the domain or DCs A principal outside tier 0 can write gPLink on the domain or the Domain Controllers OU, so it can link a GPO it controls to every domain controller. | Group Policy | high |
AD-GPO-003 | Weak security settings in GPOs applied to DCs or the domain A GPO applied to the domain or the domain controllers allows LM or NTLMv1, stores LM hashes or reversibly encrypted passwords, or hands SYSTEM-level privileges to non-admins. | Group Policy | medium / high |
AD-GPO-008 | GPOs set the Netlogon vulnerable channel allow list on DCs (Onelogon) A GPO that reaches domain controllers sets VulnerableChannelAllowList, which lets the listed accounts use Netlogon without secure RPC. No finding means no GPO sets it, not that no DC has it. | Group Policy | medium / high |
AD-GPO-004 | GPOs editable outside tier 0 A GPO not linked to the domain or the domain controllers can be edited by a principal outside tier 0, who can run code on every computer or user it reaches. | Group Policy | medium |
AD-GPP-002 | Credentials in SYSVOL or NETLOGON scripts A script in SYSVOL or NETLOGON appears to contain a literal password, and every domain user can read those shares. | Group Policy | high |
AD-INF-008 | SMB signing not required on domain controllers A domain controller does not require SMB signing, so NTLM authentication relayed from another host can be used against it over SMB. | Infrastructure | high |
AD-INF-009 | Print Spooler running on domain controllers The Print Spooler service runs on a domain controller, so any domain user can force the DC to authenticate to a host of their choice (PrinterBug). | Infrastructure | medium / high |
AD-INF-010 | LDAPS channel binding not enforced A domain controller accepts an LDAPS bind without a channel binding token, so NTLM authentication relayed from another connection can log on to LDAPS. | Infrastructure | medium |
AD-INF-011 | No recent backup of the domain The domain partition has not been backed up in the last seven days, or never, so recovering from ransomware or a forest compromise would mean rebuilding. | Infrastructure | medium |
AD-INF-012 | RODCs that may cache privileged credentials A read-only domain controller's password replication policy lets it cache the credentials of privileged or broad groups, or omits the Denied RODC Password Replication Group. | Infrastructure | medium |
AD-CHAIN-001 | Relay to resource-based delegation DCs accept relayed NTLM on LDAP or LDAPS and any user can create computer accounts, so coerced server authentication becomes admin on that server through RBCD. | Attack paths | high |
AD-CHAIN-002 | Coercion plus unconstrained delegation A non-DC host has unconstrained delegation and DC coercion is confirmed through the Print Spooler or assumed, so whoever controls that host can capture a DC's TGT and DCSync. | Attack paths | medium / high |
AD-CHAIN-003 | Coercion plus web enrollment relay (ESC8) A CA's web enrollment accepts NTLM over HTTP and DC coercion is confirmed through the Print Spooler or assumed, so a user can relay a DC's authentication into a DC certificate (ESC8). | Attack paths | medium / high |
AD-INF-013 | Domain controllers that could not be probed Some domain controllers could not be reached over SMB, so the per-DC probe checks say nothing about them. | Infrastructure | low |
AD-INF-014 | Rogue DC candidates: DC flag without an NTDS Settings object A computer carries a domain controller flag in userAccountControl but has no nTDSDSA object in the Configuration partition, so it is a rogue DC candidate. | Infrastructure | medium / high |
AD-ACL-007 | Exchange groups with rights over the domain (PrivExchange) Exchange security groups hold WriteDacl over the domain, so control of any Exchange server (or a relayed Exchange authentication) becomes DCSync. | Permissions | medium / high |
AD-PRIV-011 | Entra Connect servers hold DCSync but are not tier 0 An Entra Connect sync account holds DCSync rights, but the server that stores its password is not protected like a domain controller. | Privileged access | medium |
AD-ACL-008 | Entra Connect sync account or server controllable outside tier 0 A principal outside tier 0 owns or can take over the Entra Connect sync account or its server, and that account can DCSync the domain. | Permissions | high |
AD-ADCS-012 | ESC6: CA accepts a subject alternative name from request attributes A CA accepts a subject alternative name from request attributes (EDITF_ATTRIBUTESUBJECTALTNAME2), so any enrollee can name another user in a certificate. | Certificate services | low / medium |
AD-ADCS-013 | ESC7: non-tier-0 principals manage the CA Principals outside tier 0 hold ManageCA or ManageCertificates on an enterprise CA, which can be turned into a certificate for any user. | Certificate services | medium / high |
AD-ADCS-014 | ESC11: CA does not require encryption for ICPR requests A CA does not require packet privacy on its RPC enrollment interface (IF_ENFORCEENCRYPTICERTREQUEST off), so coerced authentication can be relayed to it for a certificate. | Certificate services | medium / high |
AD-ADCS-015 | ESC16: CA leaves the SID security extension out of certificates A CA leaves the SID security extension out of every certificate (OID in DisableExtensionList), so weak certificate mappings are not caught by strong-mapping enforcement. | Certificate services | low / medium |
AD-ADCS-016 | CA configuration could not be read An enterprise CA's own configuration could not be read, so the CA-side checks (ESC6, ESC7, ESC11, ESC16, audit filter) say nothing about it. | Certificate services | low |
AD-ADCS-018 | CA audit filter not fully on An enterprise CA's AuditFilter is not 127 or was never set, so at least one audit category is off. | Certificate services | low / medium |
AD-ADCS-017 | ESC17: enrollee-supplied subject on a server authentication template A published template with the Server Authentication EKU lets broad groups supply the subject, so any enrollee can get a trusted TLS certificate for any internal host name. | Certificate services | medium |
AD-CHAIN-004 | ESC6 plus ESC16 on the same CA The same CA has ESC6 and ESC16, so a requester can put any user's SID in a SAN URL and authenticate as that user even under strong-mapping enforcement. | Attack paths | medium / high |
AD-GPO-005 | GPOs make broad groups local administrators Group Policy makes a broad group (Domain Users, Authenticated Users, and the like) a local administrator of the computers a GPO reaches. | Group Policy | high |
AD-GPO-006 | GPOs grant admin rights on tier-0 servers outside tier 0 Group Policy makes non-tier-0 principals local administrators of servers that control the domain (DCs, CA, Entra Connect or Exchange hosts). | Group Policy | high |
AD-GPO-007 | GPOs grant remote logon to broad groups or on tier-0 servers Group Policy grants remote logon (RDP, WinRM or DCOM) to broad groups, or to non-tier-0 principals on servers that control the domain. | Group Policy | medium / high |
AD-PATH-001 | Control paths from non-tier-0 principals to tier 0 Principals outside tier 0 have a chain of memberships, ACLs, GPO, certificate or delegation rights that ends in control of tier 0. | Attack paths | high |
AD-INV-001 | Group membership differs from the declared state The membership of a group declared in the invariants file differs from the declared list: someone was added to it, or a declared member is gone. | Invariants | high |
AD-INV-002 | Tier 0 is larger than declared More distinct accounts sit in tier-0 groups than the limit declared in the invariants file allows. | Invariants | medium |
AD-INV-003 | Domain settings differ from the declared state A domain setting declared in the invariants file does not hold, such as the machine account quota, password length, lockout, Recycle Bin or LDAP signing. | Invariants | medium |
AD-INV-004 | DCSync rights outside the declared list A principal outside tier 0 and outside the declared list holds both replication rights on the domain, so it can DCSync every password hash. | Invariants | high |
AD-INV-005 | Templates published outside the declared list A certificate template is published on an enterprise CA but is not in the declared list, so the CA issues certificates nobody approved. | Invariants | medium |