Active Directory Security Checklist: 32 Quarterly Checks Every AD Operator Should Run

Running a quarterly active directory security checklist is the closest thing AD operators have to a structured safety net. Audits that skip this become reactive, catching misconfigurations only after a breach surfaces them. The 32 checks below are grouped by risk domain, each with a one-line rationale and a description of what a bad finding looks like. Retrievy ISPM automates all 32 as continuous checks so you are not relying on a manual spreadsheet every 90 days.

Domain Policy

1. Minimum password length is 14+ characters (or Fine-Grained Password Policy enforces it for privileged groups). Finding: Default Domain Policy still set to 7 characters, no PSO applied to Tier-0 accounts.

2. Password complexity is enabled and reversible encryption is disabled. Finding: Store passwords using reversible encryption set to Enabled in any GPO linked to users.

3. Account lockout threshold is 5-10 attempts with a 15-minute observation window. Finding: Threshold set to 0 (never locks out), enabling unlimited password spraying.

4. Kerberos ticket lifetime is 10 hours or less; renewal window is 7 days or less. Finding: Max ticket life set to 99999 minutes, extending the usable window of a stolen TGT.

5. AdminSDHolder ACL matches your approved baseline. Finding: Non-admin principals appear in the AdminSDHolder ACL, which SDProp propagates to all protected groups every 60 minutes.

6. Default Domain Controllers Policy GPO is not modified directly; a separate baseline GPO is linked at the OU level. Finding: Audit and security settings live only in the default policy, creating a single point of failure for any GPO wipe or rollback.

Domain Controller Hardening

1. All DCs run Windows Server 2019 or Windows Server 2022; no 2008/2012 R2 DCs remain. Finding: End-of-support DCs receiving no security patches, exposed to known privilege-escalation paths.

2. SMB signing is required on all DCs. Finding: RequireSecuritySignature is 0, enabling NTLM relay attacks against DC shares.

3. LDAP signing is required and LDAP channel binding is enforced. Finding: LDAPServerIntegrity is 1 (negotiate) rather than 2 (require), allowing unsigned LDAP binds.

4. NTLMv1 is disabled via LmCompatibilityLevel set to 5. Finding: LM and NTLMv1 responses accepted, exposing credential material to offline cracking.

5. The Print Spooler service is disabled on all DCs. Finding: Spooler running on a DC enables coerced NTLM authentication via the MS-RPRN RpcRemoteFindFirstPrinterChangeNotification call.

6. WDigest authentication is explicitly disabled (UseLogonCredential = 0). Finding: Registry key absent or set to 1 on any DC or member server, causing plaintext credentials to cache in LSASS.

7. Credential Guard is enabled on all DCs and Tier-0 servers. Finding: LsaCfgFlags not set, or Hyper-V dependencies missing, leaving LSASS memory accessible to tools like Mimikatz.

8. RDP access to DCs is restricted to a jump-host IP range via Windows Firewall GPO. Finding: RDP (TCP 3389) reachable from workstation subnets directly.

9. DC local administrator accounts use unique, rotated passwords (LAPS or equivalent). Finding: All DCs share the same local admin password, enabling lateral movement after a single compromise.

Delegation

1. No accounts in Domain Admins, Enterprise Admins, or Schema Admins have Account is sensitive and cannot be delegated unchecked AND are trusted for unconstrained delegation. Finding: A Tier-0 account flagged for unconstrained delegation means any service running as that account can impersonate any user.

2. No computer accounts (other than DCs) are trusted for unconstrained delegation. Finding: TrustedForDelegation set on a member server; attacker who compromises that server can extract TGTs from LSASS.

3. Constrained delegation entries use protocol transition only where explicitly approved. Finding: msDS-AllowedToDelegateTo populated with sensitive SPNs and TRUSTED_TO_AUTH_FOR_DELEGATION set without a documented exception.

4. Resource-Based Constrained Delegation (RBCD) entries are reviewed; msDS-AllowedToActOnBehalfOfOtherIdentity is empty on DCs and Tier-0 servers. Finding: An unprivileged user has write access to a computer object and has pre-staged an RBCD entry.

5. No service accounts have UserAccountControl flag DONT_REQUIRE_PREAUTH set (AS-REP Roasting exposure). Finding: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} returns accounts outside a known exception list.

Credential Exposure

1. No user accounts have SPNs set and weak or non-expiring passwords (Kerberoasting exposure). Finding: Service accounts with ServicePrincipalName populated and passwords older than 180 days.

2. The KRBTGT account password has been reset within the last 180 days (twice, back-to-back). Finding: PasswordLastSet on the KRBTGT object older than 180 days; a leaked hash remains valid for forging Golden Tickets.

3. No plaintext passwords exist in SYSVOL (GPP cPassword). Finding: XML files under \\<domain>\SYSVOL\ contain cPassword attributes; decryptable with the public AES key published by Microsoft.

4. Privileged accounts (DA, EA, Schema Admin) are not used for interactive logon on non-DC systems. Finding: Event ID 4624 with logon type 2 or 10 for Domain Admin accounts on workstations or member servers.

5. Built-in Administrator (RID 500) account is renamed and its last logon is reviewed. Finding: RID 500 account name is still Administrator and shows recent interactive logons outside a change window.

6. Stale user accounts inactive for 90+ days are disabled or removed. Finding: Enabled accounts with LastLogonDate older than 90 days, especially in privileged groups.

ADCS (Active Directory Certificate Services)

1. No certificate templates allow ENROLLEE_SUPPLIES_SUBJECT with low-privilege enrollment (ESC1 pattern). Finding: A template with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled and Authenticated Users in the enrollment ACL.

2. No certificate templates grant enrollment rights to Domain Users or Authenticated Users with EKUs that include Smart Card Logon or Client Authentication combined with manager approval disabled (ESC2/ESC3 patterns). Finding: Template enrollable by any domain user with an Any Purpose or Certificate Request Agent EKU.

3. CA servers are not members of Domain Admins or Enterprise Admins groups. Finding: The CA computer account or CA service account in a Tier-0 group, making CA compromise equivalent to full domain compromise.

4. Web enrollment interfaces (certsrv) require HTTPS and are not exposed to workstation subnets without additional authentication controls. Finding: HTTP-only web enrollment reachable from workstations, enabling NTLM relay to obtain a certificate for a DC account.

GPO Drift

1. All production GPOs have a documented owner and a version-controlled baseline; unlinked GPOs are removed or archived. Finding: Retrievy ISPM GPO X-Ray surfaces GPOs with no links and no modification in 12+ months, which are attack-surface clutter and create confusion during incident response.

2. GPO permissions are audited: no non-admin users have CreateChild, WriteProperty, or GenericWrite on GPO objects in the domain. Finding: A standard user account with write access to a GPO linked to a DC OU can push arbitrary computer startup scripts domain-wide.

Running These Checks at Scale

Manual spot-checks against these 32 items take a skilled engineer 2-3 days per quarter. Retrievy ISPM maps each item to a continuous finding, surfaces evidence (the exact attribute value or ACL entry), and tracks remediation state across audit cycles. The ad audit report it generates is formatted for both technical remediation and compliance evidence, covering domain controller hardening, delegation hygiene, ADCS template risk, and GPO drift in a single pane.

For the ADCS checks specifically, cross-reference the ESC technique catalog published by SpecterOps (the original Certified Pre-Owned research) and MITRE ATT&CK technique T1649 (Steal or Forge Authentication Certificates). For delegation abuse, T1134.001 covers token impersonation paths that unconstrained delegation enables.

Run this checklist before your quarterly ad security review meeting, not during it.