Fork Explination

Copy the ADAudit folder to the DC Server or a server with the RSAT tools installed and can manage active directory. The account running the script need to be Domain Admin to run the full audit.

Download NuGet and DSInternals modules from PowerShell Gallery before using this script and place in the same folder as the script.
https://www.powershellgallery.com/packages/NuGet/
https://www.powershellgallery.com/packages/DSInternals/
Chose Manual Download. You will get two .nuplkg files. Plase them in the ADAudit folder.

To install the required modules, run the powershell script AdAudit-Run.ps1 and chose option 2 for offline installation.

Changes to this fork:
Offline installation for dependencies
Added explainations to some of the report files
Deligated AD permissions report
Tier overlapping accounts check
Lookup DNS servers and then run the DNS report. (DNS report do not need to run on the DNS server)
Full DNS-ZoneReport report
Can run on an other server then AD DC as long as:

• -RSAT tools is installed
  
• -Server can manage AD
  
• -Powershell can run using domain admin account
  

Added runtime arg

• -delegatedpermissions
  
• -dnszone
  
• -inactivecomputers

Overall report for management added as a separate script. Will run directly after Audit script. (Run -all argument for best result)

Run the script
Create the folder C:\ADAudit

Coppy all script files to the folder and if installing dependencies offline the .nuplkg files.
Open PowerShell as admin using a Domain Admin account
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; & "C:\ADAudit\AdAudit-Run.ps1"
Run the install dependencies
Run full check

Active Directory Assessment Overview

This script performs an assessment of Active Directory configuration, security posture, and operational health.
The output is intended to provide visibility into potential risks, misconfigurations, and improvement areas.

Mangament Report

The management report is an HTML file that provides a more presentable summary of the audit, including an overall security score.
The further a finding deviates from the defined baseline, the higher the risk score becomes. For example, Critical risks start at 12 points, but both criticality and score increase the further the risk is from the baseline.
If the KRBTGT password has not been changed in 180 days, it is considered a Critical risk (12 points). However, if it has not been changed in 2000 days, the score increases to 31 points.
Similarly, if there are many accounts that have not been used for a long time, the risk score increases as the number of inactive accounts grows.
This scoring model helps pinpoint and prioritize security issues and highlights how neglected certain areas are. A finding with low initial criticality can become high or Critical if it deviates far enough from the baseline value.

IMPORTANT

All findings must be evaluated in the context of:

• Organizational and regulatory requirements
  
• Internal security policies and approved exceptions
  
• Established operational practices and business constraints
  
• Business requirements
  

The presence of a finding does not automatically indicate a security issue.
Results should be reviewed, validated, and prioritized according to the organization’s risk management process.

Purpose

This script is designed to support informed decision-making and continuous improvement of Active Directory security and operational hygiene.

adaudit

This PowerShell script is designed to conduct a comprehensive audit of Microsoft Active Directory, focusing on identifying common security vulnerabilities and weaknesses. Its execution facilitates the pinpointing of critical areas that require reinforcement, thereby fortifying your infrastructure against prevalent tactics used in lateral movement or privilege escalation attacks targeting Active Directory.

_____ ____     _____       _ _ _
|  _  |    \   |  _  |_ _ _| |_| |_
|     |  |  |  |     | | | . | |  _|
|__|__|____/   |__|__|___|___|_|_|
                 by phillips321

If you have any decent powershell one liners that could be used in the script please let me know. I'm trying to keep this script as a single file with no requirements on external tools (other than ntdsutil and cmd.exe)

Run directly on a DC using a DA. If you don't trust the code I suggest reading it first and you'll see it's all harmless! (But shouldn't you be doing that anyway with code you download off the net and then run as DA??)

What this does

• Device Information
  • Get-HostDetails
• Domain Audit
  • Get-LastWUDate
  • Get-DCEval
  • Get-TimeSource
  • Get-PrivilegedGroupMembership
  • Get-MachineAccountQuota
  • Get-DefaultDomainControllersPolicy
  • Get-SMB1Support
  • Get-FunctionalLevel
  • Get-DCsNotOwnedByDA
  • Get-ReplicationType
  • Get-RecycleBinState
  • Get-CriticalServicesStatus
  • Get-RODC
• Domain Trust Audit
  • Get-DomainTrusts
• User Accounts Audit
  • Get-InactiveAccounts
  • Get-DisabledAccounts
  • Get-LockedAccounts
  • Get-AdminAccountChecks
  • Get-NULLSessions
  • Get-PrivilegedGroupAccounts
  • Get-ProtectedUsers
• Password Information Audit
  • Get-AccountPassDontExpire
  • Get-UserPasswordNotChangedRecently
  • Get-PasswordPolicy
  • Get-PasswordQuality
• Dumps NTDS.dit
  • Get-NTDSdit
• Computer Objects Audit
  • Get-OldBoxes
• GPO audit (and checking SYSVOL for passwords)
  • Get-GPOtoFile
  • Get-GPOsPerOU
  • Get-SYSVOLXMLS
  • Get-GPOEnum
• Check Generic Group AD Permissions
  • Get-OUPerms
• Check For Existence of LAPS in domain
  • Get-LAPSStatus
• Check For Existence of Authentication Polices and Silos
  • Get-AuthenticationPoliciesAndSilos
• Check for insecure DNS zones
  • Get-DNSZoneInsecure
• Check for newly created users and groups
  • Get-RecentChanges
• Check for ADCS vulnerabilties, ESC1,2,3,4 and 8.
• Check for high value kerberoastable accounts
• Check for ASREPRoastable accounts
• Check for dangerous ACL permissions on Users, Groups and Computers.
• Check LDAP and LDAPs settings (Signing, null sessions etc )

Runtime Args

The following switches can be used in combination

• -installdeps installs optional features (DSInternals)
• -hostdetails retrieves hostname and other useful audit info
• -domainaudit retrieves information about the AD such as functional level
• -trusts retrieves information about any domain trusts
• -accounts identifies account issues such as expired, disabled, etc...
• -passwordpolicy retrieves password policy information
• -ntds dumps the NTDS.dit file using ntdsutil
• -oldboxes identified outdated OSs like XP/2003 joined to the domain
• -gpo dumps the GPOs in XML and HTML for later analysis
• -ouperms checks generic OU permission issues
• -laps checks if LAPS is installed
• -authpolsilos checks for existence of authentication policies and silos
• -insecurednszone checks for insecure DNS zones
• -recentchanges checks for newly created users and groups (last 30 days)
• -adcs checks for ADCS vulnerabilties, ESC1,2,3,4 and 8.
• -acl checks for dangerous ACL permissions on Users, Groups and Computers.
• -spn checks for high value kerberoastable accounts
• -asrep checks for ASREPRoastable accounts
• -ldapsecurity checks for multiple LDAP issues
• -exclude allows you to exclude specific checks when using adaudit.ps1 -all -exclude ouperms,ntds,adcs"
• -select allows you to exclude specific checks when using adaudit.ps1 -all "gpo,ntds,acl"
• -all runs all checks, e.g. AdAudit.ps1 -all