Active Directory security audit.

For the identity estate behind your business

Active Directory often connects long-lived servers, user accounts and business applications. A cloud identity review may leave that estate only partly understood. Directory administrators, IT leaders and service partners need an account of the configuration and privileges that remain on premises.

Use an audit to establish a baseline, review an inherited domain or prepare a hardening programme. Agree the domains, approved collection hosts and important services first, so the findings can be considered in their operational context.

What the audit can examine

The on-premises collector supports domain and trust information, user and computer settings, privileged-group membership, password-policy configuration and directory access controls. Supported sections also examine Group Policy, SYSVOL exposure and certificate-services configuration where the required components are available.

Host context can include domain-controller hardening, supported protocol settings, patching, endpoint protection and firewall profiles. These sources help distinguish an identity issue from a related host configuration problem and give administrators a more useful starting point for remediation.

Findings with their supporting context

ThreatShield analyses submitted audit sections and retains the evidence behind the findings. The resulting review can identify affected accounts, policies or hosts, explain the observed condition and propose the next investigation or hardening step.

An exposed permission or certificate-template configuration is a posture finding. It does not by itself prove that an attacker used it. Activity evidence and further investigation are needed to assess suspected compromise. Collection failures and skipped sections should remain part of the report rather than disappear from the conclusion.

How collection and follow-up work

Confirm the collection host, permissions and available Windows modules before the audit. Active Directory and Group Policy sections depend on their respective modules and access to the relevant environment. The collector can run on supported Windows systems, but the evidence available from a member host and a domain controller can differ.

Review the completed sections, prioritise findings with the responsible administrator and plan authorised changes around service dependencies. A later collection provides evidence for follow-up. Sensitive password-quality auditing is a separate, explicit opt-in activity with additional prerequisites; it is not part of every routine scan.

How it works, step by step

1. Confirm the collection host and permissions. Agree the domains, the approved Windows collection host and the modules and access the audit needs.
2. Collect directory, policy and host evidence. Gather the available directory, privileged-group, Group Policy, certificate-services and host-configuration sections.
3. Analyse identity and configuration exposure. Review privileged access, delegation, password policy, certificate templates and domain-controller hardening together.
4. Prioritise with the administrator. Turn findings into hardening work, naming the affected accounts, policies or hosts and their service dependencies.
5. Re-collect for follow-up. After authorised changes, run a later collection to provide evidence for the next review.

Conditions an Active Directory audit can surface

Coverage depends on the components present, the collection modules available and the agreed scope. Where the evidence is available, an Active Directory audit can highlight conditions such as:

• Over-privileged, stale or duplicate accounts, and unexpected membership of privileged groups.
• Risky delegation and directory access-control settings.
• Weak or inconsistent password-policy configuration.
• Group Policy and SYSVOL exposure that needs review.
• Active Directory Certificate Services templates configured in a way that widens exposure.
• Domain-controller hardening, supported-protocol and patching gaps.

An exposed permission or certificate-template configuration is a posture finding, not proof that an attacker used it. Confirming a suspected compromise needs activity evidence and further investigation.

Framework alignment

Active Directory findings can be discussed against CIS-aligned hardening references and NIST Cyber Security Framework perspectives, and they help evidence the access-control and secure-configuration themes behind a UK Cyber Essentials review of your on-premises estate.

These references organise the conversation and prioritisation. They are not a certification or a guarantee that a control is effective; the audit keeps the collected evidence behind each finding so the team can judge it.

Questions about Active Directory security audit

Does this include Group Policy and AD CS?
Supported checks include Group Policy and Active Directory Certificate Services. Actual coverage depends on the components present, collection modules, permissions and agreed scope.

Is an Active Directory audit a penetration test?
This capability assesses collected configuration and available activity evidence. It does not establish that exploitation has been attempted or that every possible attack path has been tested.

Can it support a hybrid Microsoft environment?
On-premises audit findings can be considered alongside Microsoft 365 and Entra ID assessment evidence. Each collection path has its own scope and access requirements.

How much does an Active Directory security audit cost?
It depends on the number of domains, the collection hosts in scope and whether sensitive password-quality auditing is included as a separate opt-in. We agree the scope and prerequisites with your administrator before the audit, so the effort is clear in advance.

Do you need Domain Admin access to run the audit?
The collector runs on a supported Windows host with access to the relevant Active Directory, Group Policy and certificate-services modules. The evidence available from a member host and a domain controller can differ, so we confirm the required permissions and modules during scoping rather than assuming full administrative rights.