ADAudit : Powershell Script To Do Domain Auditing Automation

ADAudit is a PowerShell Script to perform a quick AD audit. If you have any decent powershell one liners that could be used in the script please let me know. I’m trying to keep this script as a single file with no requirements on external tools (other than ntdsutil and cmd.exe)

Run directly on a DC using a DA. If you don’t trust the code I suggest reading it first and you’ll see it’s all harmless! (But shouldn’t you be doing that anyway with code you download off the net and then run as DA??)

What this does?

  • Device Information
    • Get-HostDetails
  • Domain Audit
    • Get-MachineAccountQuota
    • Get-SMB1Support
    • Get-FunctionalLevel
    • Get-DCsNotOwnedByDA
  • Domain Trust Audit
    • Get-DomainTrusts
  • User Accounts Audit
    • Get-InactiveAccounts
    • Get-DisabledAccounts
    • Get-AdminAccountChecks
    • Get-NULLSessions
    • Get-AdminSDHolders
    • Get-ProtectedUsers
  • Password Information Audit
    • Get-AccountPassDontExpire
    • Get-UserPasswordNotChangedRecently
    • Get-PasswordPolicy
  • Dumps NTDS.dit
    • Get-NTDSdit
  • Computer Objects Audit
    • Get-OldBoxes
  • GPO audit (and checking SYSVOL for passwords)
    • Get-GPOtoFile
    • Get-GPOsPerOU
    • Get-SYSVOLXMLS
  • Check Generic Group AD Permissions
    • Get-OUPerms
  • Check For Existence of LAPS in domain
    • Get-LAPSStatus
  • Check For Existence of Authentication Polices and Silos
    • Get-AuthenticationPoliciesAndSilos

Also Read – Donut : Generates x86, x64, or AMD64+x86 Position-Independent Shellcode

Runtime Args

The following switches can be used in combination

  • hostdetails retrieves hostname and other useful audit info
  • -domainaudit retrieves information about the AD such as functional level
  • -trusts retrieves information about any doman trusts
  • -accounts identifies account issues such as expired, disabled, etc…
  • -passwordpolicy retrieves password policy information
  • -ntds dumps the NTDS.dit file using ntdsutil
  • -oldboxes identified outdated OSs like XP/2003 joined to the domain
  • -gpo dumps the GPOs in XML and HTML for later analysis
  • -ouperms checks generic OU permission issues
  • -laps checks if LAPS is installed
  • -authpolsilos checks for existenece of authentication policies and silos
  • -all runs all checks, e.g. AdAudit.ps1 -all
R K

Recent Posts

Kali Linux 2024.4 Released, What’s New?

Kali Linux 2024.4, the final release of 2024, brings a wide range of updates and…

2 days ago

Lifetime-Amsi-EtwPatch : Disabling PowerShell’s AMSI And ETW Protections

This Go program applies a lifetime patch to PowerShell to disable ETW (Event Tracing for…

2 days ago

GPOHunter – Active Directory Group Policy Security Analyzer

GPOHunter is a comprehensive tool designed to analyze and identify security misconfigurations in Active Directory…

4 days ago

2024 MITRE ATT&CK Evaluation Results – Cynet Became a Leader With 100% Detection & Protection

Across small-to-medium enterprises (SMEs) and managed service providers (MSPs), the top priority for cybersecurity leaders…

7 days ago

SecHub : Streamlining Security Across Software Development Lifecycles

The free and open-source security platform SecHub, provides a central API to test software with…

1 week ago

Hawker : The Comprehensive OSINT Toolkit For Cybersecurity Professionals

Don't worry if there are any bugs in the tool, we will try to fix…

1 week ago