InvokeADCheck - Powershell Based Tool To Detect Active Directory Misconfigurations

Read more: https://lnkd.in/dPraUV8X

InvokeADCheck is a PowerShell-based tool designed to identify misconfigurations in Active Directory (AD). It performs over 20 targeted checks across critical security areas, including:
– Account Vulnerabilities: Detects inactive users, default administrator settings, and guest account status.
– Group Policy Risks: Identifies misconfigured Group Policy Objects (GPOs) and exposed credentials in Group Policy Preferences (GPP).
– Delegation Flaws: Checks Kerberos delegation settings and unprotected service accounts.
– Domain Health: Evaluates functional levels, tombstone lifetime, and backup status.

You Should Know:

Here are some practical PowerShell commands and scripts to enhance your AD security:

1. Check for Inactive Users:

Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Select-Object Name, SamAccountName, LastLogonDate

This command lists users who haven’t logged in for 90 days.

2. Verify Default Administrator Account Status:

Get-ADUser -Filter {SamAccountName -eq "Administrator"} -Properties Enabled | Select-Object Name, Enabled

Ensures the default administrator account is disabled or renamed.

3. Audit GPOs for Misconfigurations:

Get-GPO -All | ForEach-Object { Get-GPOReport -Guid $<em>.Id -ReportType HTML -Path "C:\GPOReports\$($</em>.DisplayName).html" }

Generates HTML reports for all GPOs to review configurations.

4. Check Kerberos Delegation Settings:

Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation | Select-Object Name, TrustedForDelegation

Identifies systems with Kerberos delegation enabled.

5. Backup AD Domain Controller:

wbadmin start backup -backupTarget:\BackupServer\ADBackup -include:C: -allCritical -quiet

Initiates a backup of the AD domain controller.

6. Check Tombstone Lifetime:

Get-ADObject -SearchBase (Get-ADRootDSE).ConfigurationNamingContext -Filter {ObjectClass -eq "DirectoryService"} -Properties tombstoneLifetime | Select-Object tombstoneLifetime

Verifies the tombstone lifetime setting for deleted objects.

What Undercode Say:

Active Directory is a critical component of enterprise environments, and misconfigurations can lead to severe security breaches. Tools like InvokeADCheck simplify the process of identifying vulnerabilities, but administrators should also regularly audit their AD environment using PowerShell commands. Proactively addressing account vulnerabilities, GPO risks, and delegation flaws ensures a robust security posture.

For further reading on AD security best practices, visit:
– Microsoft Active Directory Security Guidelines
– PowerShell Documentation

By combining automated tools with manual checks, you can maintain a secure and resilient AD infrastructure.