Active Directory security assessment: 10 checks to prioritize

Why start with Active Directory?

Active Directory remains the control plane for many identities, applications and privileged operations. A weakness in the directory can therefore provide a fast path to critical servers, backups or synchronized cloud environments.

A useful assessment should not produce hundreds of undifferentiated alerts. It should identify exploitable attack paths, configuration gaps and improvements that quickly reduce risk.

1. Privileged accounts and separation of duties

Inventory highly privileged group membership and confirm that administrative accounts are not used for everyday email or web browsing.

• Remove standing privileges that are no longer required.
• Use separate accounts for administration and daily work.
• Protect administrative workstations and restrict privileged logons.

2. Legacy protocols and configurations

NTLM, SMBv1, unsigned LDAP and older encryption can increase the risk of relay, interception and downgrade attacks. Before disabling a protocol, measure its use and identify dependent applications.

3. Local passwords and service accounts

• Deploy Windows LAPS to rotate local administrator passwords.
• Prefer gMSAs when applications support them.
• Find non-expiring passwords, unusual SPNs and secrets stored in scripts or Group Policy.

4. Delegation, Group Policy and attack paths

The ability to modify a GPO, organizational unit or group can be as sensitive as direct Domain Admin membership. Review ACLs, Kerberos delegation and indirect relationships that may enable privilege escalation.

5. Detection and logging

Microsoft Defender for Identity, centralized security events and platforms such as Wazuh can reveal abnormal behaviour. Their value depends on relevant rules, sufficient retention and a clear alert-handling process.

6. Backup and recovery capability

Confirm that domain controller system state is backed up, copies are isolated and authoritative restore procedures are documented. A successful recovery test is more valuable than a green backup report.

Four complementary checks

• Reduce stale user and computer accounts.
• Review trust relationships and Entra ID synchronization.
• Protect sensitive accounts from delegation and strengthen authentication.
• Regularly compare the environment with PingCastle, Purple Knight and Microsoft recommendations.

Turn findings into an action plan

Rank each finding by impact, likelihood, application dependencies and remediation effort. The best roadmap combines a few quick wins, controlled medium-term changes and post-remediation validation.