Active Directory Security Assessment

Auditing Active Directory security often requires invasive tools or administrative privileges that trigger alerts. This skill provides a non-disruptive way to identify critical vulnerabilities like Kerberoasting, delegation risks, and privileged account sprawl using read-only LDAP queries.

What it does

• Identity exposure mapping identifies Kerberoastable privileged accounts and accounts susceptible to AS-REP roasting.
• Delegation risk analysis flags unconstrained and constrained delegation paths that could lead to lateral movement or domain escalation.
• Privilege sprawl auditing detects excessive Domain, Enterprise, and Schema Admin memberships along with AdminCount=1 status.
• Credential hygiene checks surfaces passwords that never expire, stale accounts, and outdated krbtgt password rotations.
• Infrastructure hardening reports on legacy operating systems, missing LAPS coverage, and lack of Protected Users group membership.

How it works

1. Export data using a provided PowerShell script that performs read-only LDAP queries via the RSAT AD module.
2. Process results by feeding the generated CSV and JSON exports into the Python analysis engine.
3. Generate reports in Markdown and JSON formats, scored by severity and risk category.

Frameworks & tools

The skill utilizes PowerShell with the RSAT ActiveDirectory module for data collection and Python 3 for the analysis engine.

Why this beats prompting it yourself

Generic LLMs lack the logic to parse raw LDAP exports or calculate password ages and delegation bitmask values accurately. This skill applies specific security heuristics to identify complex attack paths that simple keyword searches miss.

Use cases

• Pre-pentest hardening to find and fix low-hanging fruit before an engagement begins.
• Compliance auditing for internal reviews of password policies and administrative group membership.
• Acquisition due diligence to quickly assess the security posture of a new organizational unit.
• Remediation tracking to verify the removal of legacy DES encryption or unconstrained delegation.

Known limitations

Requires the RSAT ActiveDirectory module to be installed on the machine running the export script. The analysis is point-in-time and does not monitor real-time changes.