Library / Windows Server and AD

SERVER-013 · Script

Audit Directory Security Settings

Checks the domain for common risky settings and accounts, and writes a findings report.

Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing

What it does

Read-only checks, each reported as a row with a severity and the accounts involved:

  • krbtgt password age: older than -KrbtgtMaxDays (default 180)
  • Password not required: enabled accounts allowed to have a blank password
  • Reversible encryption: enabled accounts storing passwords in a recoverable form
  • DES-only Kerberos: enabled accounts limited to old encryption
  • No Kerberos pre-authentication: enabled accounts open to offline password guessing
  • Service names on user accounts: enabled users with SPNs (higher severity for admin accounts)
  • Protected admin accounts: accounts marked adminCount=1 (listed for review)
  • Domain password policy: minimum length below -MinPasswordLength, complexity off, or no lockout
  • Guest account: enabled
  • Recycle Bin: not turned on
  • Pre-Windows 2000 group: contains Everyone or Anonymous
  • Functional level: reported for information

Changes nothing.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Any domain account can usually read these settings.

How to run it

  • Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
  • Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
  • Script type: PowerShell 5.1, 64-bit
  • User interaction: none; the script never prompts
  • Timeout: 30 minutes for large directories or many servers

Settings

NameWhat it doesOptionsDefault
KrbtgtMaxDaysFlag the krbtgt password when it is older than this many days. Default: 180.180
MinPasswordLengthFlag the domain password policy when its minimum length is below this. Default: 12.12
AlertOnFindings (default) exits 1 when any High or Medium finding is present. Never always exits 0.Findings, NeverFindings
ServerOptional domain controller to read from.

Exit codes

  • 0 = No High or Medium findings (or AlertOn is Never)
  • 1 = High or Medium findings present
  • 2 = Script error (see log)

Testing steps

  1. Run it on one test OU, test account or test server and check the output and log.
  2. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
  3. Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log

VersionDateChanges
1.0.0November 2026First release.