Hardening and securing Active Directory is free, minus your time.
The problem is most people don’t know what to look for and where to look, to find issues.
I’m on a mission to change that.
Here are 11 free tools (and how to use them) to find misconfigurations and make your environment harder to attack.
(No particular order)
1. PingCastle
The OG AD assessment tool. I use this on every pentest and it’s been more useful than almost any other tool.
Pay attention to the control paths section. Many times you can find hidden attack paths there. Focus on critical resources like Domain Admins and Administrative OUs.
Pro-tip, PingCastle has a “scan” feature with a bunch of different modules for checking things like SMB versions, spooler service, and more. Check it out.
Similar to PingCastle. Equally a great tool.
Has an excellent grading system which makes it perfect for tracking progress over time. But also has detailed results.
Pick PingCastle or PurpleKnight and stick with it.
3. Locksmith
The best AD CS auditing tool there is. Finds dangerous Active Directory Certificate Services configurations and suggests fixes.
Run Invoke-Locksmith -Mode 2. Look closely at certificate templates and enrollment settings that could let someone request a certificate they shouldn’t be able to use. Mode 2 exports findings to a csv file so you can save the results.
4. ScriptSentry
Finds dangerous and misconfigured logon scripts. I wrote this one. These risks are rarely considered but can be very dangerous.
Run Invoke-ScriptSentry and check for plaintext credentials, scripts or shares that regular users can modify, and privileged accounts with logon scripts. Those are all things an attacker would be happy to find.
5. ADeleg
Shows who has delegated permissions in AD and what they can control.
Open ADeleg and switch the view to index by trustees. Start with broad groups like Domain Users and Authenticated Users, then see what they can control. Pay attention to rights like Full Control, Write Property, Reset Password, and replication permissions. Document why each delegation exists before changing it.
6. ADeleginator
Uses ADeleg to flag insecure delegations that deserve a closer look.
This is a tool I wrote that’s a companion for ADeleg. Put ADeleg.exe beside the script, load Invoke-ADeleginator.ps1, and run Invoke-ADeleginator. It helps surface insecure trustee and resource delegations so you have a shorter list to investigate.
Easy day.
7. NetTools
Literally the most goated tool ever. Helps you inspect AD permissions, GPOs, replication, and other settings when you need to understand an issue.
Use its access control tools to inspect and compare AD permissions, or its GPO Explorer to see which policies and settings apply in the domain. It’s especially useful when you’ve found something suspicious and need to answer: Who has access, and where did that access come from?
There’s so many features to this tool I could teach a 2 day class on how to use it.
Finds weak AppLocker rules, including rules that can result in regular users being able to bypass Applocker policies.
Run Invoke-AppLockerInspector against the local effective policy or an exported policy XML. Review broad allow rules, collections in audit mode, and the permissions on paths those rules trust.
Pay attention to writable local folders and shares. Overly broad access makes it way too easy for attackers.
9. GPOZaurr
Reports broken GPOs, exposed passwords, and risky Group Policy permissions.
Install the PowerShell module and run Invoke-GPOZaurr. Review the reports for broken links, inconsistent GPOs, exposed passwords, and permissions that let the wrong people edit a policy. A GPO is only as trustworthy as the accounts that can change it.
GPO can quickly get cluttered. Use this to make sure that doesn’t happen.
10. Snaffler
Searches accessible file shares for credentials and other sensitive files.
Run Snaffler.exe -s -o snaffler.log from a domain joined machine. Start with the results that point to credentials, keys, or configuration files. Treat the output as sensitive too: it may contain the very secrets you’re trying to remove.
This is an issue I see in 99% of internal pentests. Every organization has credentials sitting out in file shares. And the ones who don’t just haven't found them yet.
11. HardenAD
Helps you check and strengthen AD configurations with hardening tasks and remediation scripts.
Once you know what needs fixing, read HardenAD’s documentation and task sequence, choose the changes that fit your environment, and test them before rollout. Some of its tasks change AD and Group Policy, so this one deserves more than a quick “run it and see.”
Have a documented roll back plan, just in case.
You might be saying, “that sounds like a lot of work.”
Since when is anything worthwhile easy?
You don’t need to run all 11 today.
Pick one area: permissions, certificates, logon scripts, GPOs, or file shares.
Find one issue, understand how an attacker could use it, fix it, and check again.
That’s how you make your environment harder to attack.
Little by little. Day by day.
The longer you wait, the more the issues build up. The longer it takes when you finally decide to get to work.
Get to work.
All the best
Spencer
PS - The tools are free. Figuring out which findings put your environment at risk is where most teams get stuck.
Reply “AD” to this email and I’ll send you a link to book a call. We’ll talk through what you’re seeing and where to start.