Active Directory Tests
These tests collect and validate on-premises Active Directory configuration, including users, groups, GPOs, DNS, trusts, sites, and domain controllers.
Tests
| Test ID | Title | Severity | Category |
|---|---|---|---|
| AD-CFG-01 | Tombstone lifetime configuration should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-02 | dSHeuristics count should be retrievable | High | Active Directory - Configuration |
| AD-CFG-03 | SPN mappings should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-04 | Optional features count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-05 | Recycle bin enabled paths should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-06 | LDAP query policy count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-07 | Default query policy should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-08 | AuthN policy container count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-09 | AD activation objects count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-10 | Well-known security principals count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-11 | Registered DHCP servers count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-12 | Enterprise CA count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-13 | Certificate templates count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-14 | Enrollment templates count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-15 | Enrollment CA certificate details should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-16 | Trusted root CA count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-17 | Trusted root CA details should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-18 | Intermediate CA count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-19 | Intermediate CA details should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-20 | CRL distribution points count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-21 | NTAuth certificates count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-22 | KDS root keys count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-23 | SMTP site links count should be retrievable | Info | Active Directory - Configuration |
| AD-CFG-24 | IP site links count should be retrievable | Info | Active Directory - Configuration |
| AD-COMP-01 | Computer disabled count should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-02 | Computer dormant count should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-03 | Computer CreatorSid count should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-04 | Computer non-standard primary group count should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-05 | Computer SID History count should be retrievable | Medium | Active Directory - Computer Objects |
| AD-COMP-06 | Computer default container count should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-07 | Computer OU count should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-08 | Computer per OU average should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-09 | Computer delegation count should be retrievable | Info | Active Directory - Computer Objects |
| AD-COMP-10 | Computer delegation details should be retrievable | Info | Active Directory - Computer Objects |
| AD-DACL-01 | Distinct DACL object count should be investigated | Info | Active Directory - DACL |
| AD-DACL-02 | OU DACL entry count should be investigated | Info | Active Directory - DACL |
| AD-DACL-03 | Conflict object count should be investigated | Info | Active Directory - DACL |
| AD-DACL-04 | Conflict object details should be investigated | Info | Active Directory - DACL |
| AD-DACL-05 | Deny ACE count should be investigated | Info | Active Directory - DACL |
| AD-DACL-06 | Deny ACE details should be investigated | Info | Active Directory - DACL |
| AD-DACL-07 | Distinct DACL identity count should be investigated | Info | Active Directory - DACL |
| AD-DACL-08 | DACL ACE distribution per identity should be investigated | Info | Active Directory - DACL |
| AD-DACL-09 | Privileged allow ACE count should be investigated | Info | Active Directory - DACL |
| AD-DACL-10 | Privileged allow ACE details should be investigated | Info | Active Directory - DACL |
| AD-DACL-11 | Privileged extended right count should be investigated | Info | Active Directory - DACL |
| AD-DACL-12 | Privileged extended right details should be investigated | Info | Active Directory - DACL |
| AD-DACL-13 | Privileged extended right identities should be investigated | Info | Active Directory - DACL |
| AD-DACL-14 | Non-inherited ACE count should be investigated | Info | Active Directory - DACL |
| AD-DACL-15 | Unresolved SID count should be investigated | Info | Active Directory - DACL |
| AD-DACL-16 | Unresolved SID details should be investigated | Info | Active Directory - DACL |
| AD-DACL-17 | Inherited object type count should be investigated | Info | Active Directory - DACL |
| AD-DACL-18 | Inherited object type details should be investigated | Info | Active Directory - DACL |
| AD-DC-01 | DC site coverage count should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DC-02 | SMBv1 should be disabled on all domain controllers | Critical | Active Directory - Domain Controllers |
| AD-DC-03 | SMBv3.1.1 enabled count should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DC-04 | SMB signing should be enabled on all domain controllers | High | Active Directory - Domain Controllers |
| AD-DC-05 | DCs with all FSMO roles count should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DC-06 | FSMO role holder details should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DC-07 | DC operating system count should be retrievable | High | Active Directory - Domain Controllers |
| AD-DC-08 | DC operating system details should be retrievable | High | Active Directory - Domain Controllers |
| AD-DCD-01 | DC non-standard LDAP port count should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DCD-02 | DC non-standard LDAPS port count should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DCD-03 | Read-only domain controller count should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DCD-04 | Non-Global Catalog DC count should be retrievable | Info | Active Directory - Domain Controllers |
| AD-DCOMP-01 | Computers with unconstrained delegation count should be investigated | Info | Active Directory - Security Accounts |
| AD-DCOMP-02 | Non-DC computers should not have unconstrained delegation | Critical | Active Directory - Security Accounts |
| AD-DCOMP-03 | Non-DC computers with constrained delegation count should be investigated | Info | Active Directory - Security Accounts |
| AD-DCOMP-04 | Computer operating system count should be investigated | Info | Active Directory - Security Accounts |
| AD-DCOMP-05 | Computer operating system details should be investigated | Info | Active Directory - Security Accounts |
| AD-DCOMP-06 | No enabled computers should be stale for 180 days or more | Medium | Active Directory - Security Accounts |
| AD-DCOMP-07 | Computer DNS host name count should be investigated | Info | Active Directory - Security Accounts |
| AD-DCOMP-08 | Computer DNS zone count should be investigated | Info | Active Directory - Security Accounts |
| AD-DCOMP-09 | Computer DNS zone details should be investigated | Info | Active Directory - Security Accounts |
| AD-DFSR-01 | All domain controllers should have DFS-R subscriptions | High | Active Directory - Replication |
| AD-DNS-01 | DNS zone count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-02 | Zones with only SOA/NS records should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-03 | Root servers with incorrect IPs should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-04 | Root server incorrect IP details should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-05 | Dynamic DNS record count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-06 | Zones with non-default records should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-07 | Zone record count details should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-08 | Zone delegation count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-09 | Zone delegation details should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-10 | SOA record details should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-11 | AD DS SRV record count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-12 | AD DS SRV record details should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-13 | DNSSEC record count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-14 | Empty zone count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-15 | Duplicate zone count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-16 | Reverse lookup zone count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-17 | Non-standard zone count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-18 | Reverse zone network count should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DNS-19 | Reverse zone network details should be retrievable | Info | Active Directory - DNS Infrastructure |
| AD-DOM-01 | Domain functional level should be retrievable | Medium | Active Directory - Domain |
| AD-DOM-02 | Machine account quota should be retrievable | Low | Active Directory - Domain |
| AD-DOM-03 | Domain controller count should be retrievable | Info | Active Directory - Domain |
| AD-DOM-04 | RIDs remaining should be retrievable | Info | Active Directory - Domain |
| AD-DOM-05 | Domain name standard compliance should be retrievable | Info | Active Directory - Domain |
| AD-DOM-06 | Domain name non-standard details should be retrievable | Info | Active Directory - Domain |
| AD-DOM-07 | NetBIOS name standard compliance should be retrievable | Info | Active Directory - Domain |
| AD-DOM-08 | NetBIOS name non-standard details should be retrievable | Info | Active Directory - Domain |
| AD-DOMS-01 | Allowed DNS suffixes count should be retrievable | Info | Active Directory - Domain |
| AD-FEAT-01 | Optional feature count should be investigated | Info | Active Directory - Replication |
| AD-FEAT-02 | Optional feature enabled details should be investigated | Info | Active Directory - Replication |
| AD-FGPP-01 | Fine-grained password policy count should be retrievable | Info | Active Directory - Password Policy |
| AD-FGPP-02 | Fine-grained password policy value count should be retrievable | Info | Active Directory - Password Policy |
| AD-FGPP-03 | Fine-grained password policy setting counts should be retrievable | Info | Active Directory - Password Policy |
| AD-FGPP-04 | Fine-grained password policy application targets should be retrievable | Info | Active Directory - Password Policy |
| AD-FOR-01 | Forest functional level should be retrievable | Medium | Active Directory - Forest |
| AD-FOR-02 | Forest domain count should be retrievable | Info | Active Directory - Forest |
| AD-FOR-03 | Tombstone lifetime should be retrievable | Info | Active Directory - Forest |
| AD-FOR-04 | Recycle Bin status should be retrievable | Info | Active Directory - Forest |
| AD-FORS-01 | UPN suffixes count should be retrievable | Info | Active Directory - Forest |
| AD-FORS-02 | UPN suffixes details should be retrievable | Info | Active Directory - Forest |
| AD-FORS-03 | SPN suffixes count should be retrievable | Info | Active Directory - Forest |
| AD-FORS-04 | Cross-forest references count should be retrievable | Info | Active Directory - Forest |
| AD-GCHG-01 | Average group membership changes per year should be investigated | Info | Active Directory - Group Changes |
| AD-GMC-01 | Distinct groups with members count should be retrievable | Info | Active Directory - Group Members |
| AD-GMC-02 | Distinct account types of members count should be retrievable | Info | Active Directory - Group Members |
| AD-GMC-03 | Member account types breakdown should be retrievable | Info | Active Directory - Group Members |
| AD-GMC-04 | Trust members count should be investigated | Info | Active Directory - Group Members |
| AD-GMC-05 | Trust members details by group should be investigated | Info | Active Directory - Group Members |
| AD-GMC-06 | Foreign SID principals count should be investigated | Info | Active Directory - Group Members |
| AD-GMC-07 | Foreign SID details by domain should be investigated | Info | Active Directory - Group Members |
| AD-GMC-08 | Empty non-privileged group count should be investigated | Info | Active Directory - Group Members |
| AD-GMC-09 | Empty non-privileged group details should be investigated | Info | Active Directory - Group Members |
| AD-GMC-10 | Privileged groups with members count should be investigated | Info | Active Directory - Group Members |
| AD-GMC-11 | Privileged groups with members details should be investigated | Info | Active Directory - Group Members |
| AD-GPO-01 | GPO total count should be retrievable | Info | Active Directory - Group Policy |
| AD-GPO-02 | GPO created before 2020 count should be retrievable | Info | Active Directory - Group Policy |
| AD-GPO-03 | GPO stale-before-2020 count should be investigated | Info | Active Directory - Group Policy |
| AD-GPO-04 | Unlinked GPO count should be compliant | Medium | Active Directory - Group Policy |
| AD-GPO-05 | GPO unlinked details should be compliant | Medium | Active Directory - Group Policy |
| AD-GPOL-01 | GPO linked count should be investigated | Info | Active Directory - Group Policy |
| AD-GPOL-02 | Disabled GPO link count should be retrievable | Info | Active Directory - Group Policy Links |
| AD-GPOL-03 | GPO unlinked target count should be compliant | Medium | Active Directory - Group Policy |
| AD-GPOL-04 | Enforced GPO link count should be retrievable | Medium | Active Directory - Group Policy |
| AD-GPOL-05 | GPO blocked inheritance count should be compliant | Medium | Active Directory - Group Policy |
| AD-GPOL-06 | GPO linked OU count should be retrievable | Info | Active Directory - Group Policy Links |
| AD-GPOREP-01 | No GPOs should be missing permissions | Medium | Active Directory - GPO State |
| AD-GPOREP-02 | No GPOs should be missing permissions | Medium | Active Directory - GPO State |
| AD-GPOREP-03 | GPOs without authenticated users count should be retrievable | Medium | Active Directory - GPO State |
| AD-GPOREP-04 | GPOs without authenticated users details should be retrievable | Medium | Active Directory - GPO State |
| AD-GPOREP-05 | GPOs without enterprise domain controllers count should be retrievable | Medium | Active Directory - GPO State |
| AD-GPOREP-06 | GPOs without domain computers count should be retrievable | Medium | Active Directory - GPO State |
| AD-GPOREP-07 | GPOs with deny ACE count should be retrievable | Medium | Active Directory - GPO State |
| AD-GPOREP-08 | GPOs with deny ACE details should be retrievable | Medium | Active Directory - GPO State |
| AD-GPOREP-09 | GPO inherited permissions count should be retrievable | Medium | Active Directory - GPO State |
| AD-GPOREP-10 | GPO no-apply Group Policy ACE count should be investigated | Info | Active Directory - GPO State |
| AD-GPOREP-11 | GPO no-apply Group Policy ACE details should be investigated | Info | Active Directory - GPO State |
| AD-GPOREP-12 | GPO disabled link count should be retrievable | Info | Active Directory - GPO State |
| AD-GPOREP-13 | GPO disabled link details should be investigated | Info | Active Directory - GPO State |
| AD-GPOREP-14 | GPO enforcement count should be investigated | Info | Active Directory - GPO State |
| AD-GPOREP-15 | No GPOs should have version mismatches | High | Active Directory - GPO State |
| AD-GPOREP-16 | No GPOs should have version mismatches | High | Active Directory - GPO State |
| AD-GPOREP-17 | No GPOs should contain a cpassword | Critical | Active Directory - GPO State |
| AD-GPOREP-18 | No GPOs should contain a cpassword | Critical | Active Directory - GPO State |
| AD-GPOREP-19 | No GPOs should contain a default password | High | Active Directory - GPO State |
| AD-GPOREP-20 | No GPOs should contain a default password | High | Active Directory - GPO State |
| AD-GPOS-01 | GPO state total count should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-02 | WMI filter count should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-03 | WMI filter details should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-04 | Disabled GPO settings count should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-05 | Computer disabled GPO settings details should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-06 | User disabled GPO settings details should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-07 | All disabled GPO settings details should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-08 | GPO owner distinct count should be investigated | Info | Active Directory - GPO State |
| AD-GPOS-09 | GPO owner details should be investigated | Info | Active Directory - GPO State |
| AD-GRP-01 | Group AdminCount should be retrievable | Info | Active Directory - Groups |
| AD-GRP-02 | Groups in container objects count should be retrievable | Info | Active Directory - Groups |
| AD-GRP-03 | Stale groups count should be retrievable | Info | Active Directory - Groups |
| AD-GRP-04 | Groups with manager count should be retrievable | Info | Active Directory - Groups |
| AD-GRP-05 | Group SID History count should be retrievable | Medium | Active Directory - Groups |
| AD-GRP-06 | Distribution group count should be retrievable | Info | Active Directory - Groups |
| AD-GRP-07 | Security group count should be retrievable | Info | Active Directory - Groups |
| AD-GRP-08 | Domain local group count should be retrievable | Info | Active Directory - Groups |
| AD-GRP-09 | Global group count should be retrievable | Info | Active Directory - Groups |
| AD-GRP-10 | Universal group count should be retrievable | Info | Active Directory - Groups |
| AD-KRBTGT-01 | KRBTGT password age should not exceed 180 days | High | Active Directory - Security Accounts |
| AD-KRBTGT-02 | KRBTGT last logon should be investigated | Info | Active Directory - Security Accounts |
| AD-KRBTGT-03 | KRBTGT should have standard UAC settings (disabled account) | High | Active Directory - Security Accounts |
| AD-MSA-01 | Managed service account count should be investigated | Info | Active Directory - Security Accounts |
| AD-OU-01 | OU overlapping name count should be retrievable | Info | Active Directory - Organizational Units |
| AD-OU-02 | OU at domain root count should be retrievable | Info | Active Directory - Organizational Units |
| AD-OU-03 | OU stale count should be retrievable | Info | Active Directory - Organizational Units |
| AD-OU-04 | OU empty count should be retrievable | Info | Active Directory - Organizational Units |
| AD-OU-05 | OU empty details should be retrievable | Info | Active Directory - Organizational Units |
| AD-PRINT-01 | Printer total count should be retrievable | Info | Active Directory - Printer |
| AD-PWDPOL-01 | Password history count should be retrievable | Info | Active Directory - Password Policy |
| AD-PWDPOL-02 | Password maximum age should be retrievable | Info | Active Directory - Password Policy |
| AD-PWDPOL-03 | Password minimum length should be retrievable | Info | Active Directory - Password Policy |
| AD-PWDPOL-04 | Password complexity requirement should be retrievable | Info | Active Directory - Password Policy |
| AD-PWDPOL-05 | Password reversible encryption status should be retrievable | Info | Active Directory - Password Policy |
| AD-PWDPOL-06 | Account lockout duration should be retrievable | Info | Active Directory - Password Policy |
| AD-PWDPOL-07 | Account lockout threshold should be retrievable | Info | Active Directory - Password Policy |
| AD-REPL-01 | No replication connections should be disabled | High | Active Directory - Replication |
| AD-REPL-02 | Non-auto replication connection count should be investigated | Info | Active Directory - Replication |
| AD-ROOTDSE-01 | Supported SASL mechanism count should be investigated | Info | Active Directory - Replication |
| AD-ROOTDSE-02 | Supported SASL mechanism details should be investigated | Info | Active Directory - Replication |
| AD-ROOTDSE-03 | Root DSE should be synchronized | High | Active Directory - Replication |
| AD-SCH-01 | Schema modification year count should be retrievable | Info | Active Directory - Schema |
| AD-SCH-02 | Schema modification year details should be retrievable | Info | Active Directory - Schema |
| AD-SCH-03 | Schema version entry count should be retrievable | Info | Active Directory - Schema |
| AD-SCH-04 | Schema version details should be retrievable | Info | Active Directory - Schema |
| AD-SCH-05 | LAPS should be installed in Active Directory | Medium | Active Directory - Schema |
| AD-SITE-01 | Site total count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SITE-02 | Sites without domain controllers count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SITE-03 | Sites without domain controllers details should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SITE-04 | Sites without subnet associations count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SITE-05 | Sites without subnet associations details should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SPN-01 | Computer SPN service class count should be retrievable | Info | Active Directory - SPN Analysis |
| AD-SPN-02 | Computer SPN service class usage should be retrievable | Info | Active Directory - SPN Analysis |
| AD-SPN-03 | Computer SPN unknown service class count should be retrievable | Info | Active Directory - SPN Analysis |
| AD-SPN-04 | Computer SPN unknown service class details should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-05 | Computer SPN non-FQDN hosts should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-06 | User SPN total count should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-07 | User SPN service class count should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-08 | User SPN service class usage should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-09 | User SPN unknown service class count should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-10 | User SPN unknown service class details should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-11 | User SPN non-FQDN hosts should be investigated | Info | Active Directory - SPN Analysis |
| AD-SPN-12 | No domain admin accounts should have SPNs configured | Critical | Active Directory - SPN Analysis |
| AD-SPN-13 | No domain admin accounts should have SPNs configured | Critical | Active Directory - SPN Analysis |
| AD-SUB-01 | Subnet total count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-02 | Sites with subnet associations count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-03 | Catch-all subnets count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-04 | IPv6 subnets count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-05 | IPv6 catch-all subnets count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-06 | Non-RFC1918 (public IP) subnets count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-07 | Non-RFC1918 (public IP) subnets details should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-08 | Distinct first octets count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-09 | Distinct first two octets (/16 networks) count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-10 | Distinct first three octets (/24 networks) count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-SUB-11 | Subnets without site associations count should be retrievable | Info | Active Directory - Sites and Subnets |
| AD-TRUST-01 | Trust total count should be investigated | Info | Active Directory - Trusts |
| AD-TRUST-02 | Trust inter-forest count should be investigated | Info | Active Directory - Trusts |
| AD-TRUST-03 | Trust quarantined count should be investigated | Info | Active Directory - Trusts |
| AD-TRUST-04 | No trusts should lack SID filtering (quarantine) | High | Active Directory - Trusts |
| AD-TRUST-05 | Trust configuration details should be investigated | Info | Active Directory - Trusts |
| AD-TRUST-06 | Trust stale count should be investigated | Info | Active Directory - Trusts |
| AD-TRUST-07 | Trust stale details should be investigated | Info | Active Directory - Trusts |
| AD-USER-01 | Disabled user count should be retrievable | Info | Active Directory - Users |
| AD-USER-02 | Dormant enabled user count should be retrievable | High | Active Directory - Users |
| AD-USER-03 | Non-expiring password user count should be retrievable | High | Active Directory - Users |
| AD-USER-04 | Reversible encryption user count should be retrievable | Medium | Active Directory - Users |
| AD-USER-05 | Delegation-enabled user count should be retrievable | High | Active Directory - Users |
| AD-USER-06 | DES-only Kerberos user count should be retrievable | High | Active Directory - Users |
| AD-USER-07 | No pre-authentication user count should be retrievable | High | Active Directory - Users |
| AD-USER-08 | Never-logged-in enabled user count should be retrievable | Info | Active Directory - Users |
| AD-USER-09 | Password-not-required user count should be retrievable | Info | Active Directory - Users |
| AD-USER-10 | Workstation-restricted user count should be retrievable | Info | Active Directory - Users |
| AD-USER-11 | User AdminCount count should be retrievable | Info | Active Directory - Users |
| AD-USER-12 | User non-standard primary group count should be retrievable | Medium | Active Directory - Users |
| AD-USER-13 | User SID History count should be retrievable | Medium | Active Directory - Users |
| AD-USER-14 | User SPN count should be retrievable | Info | Active Directory - Users |
| AD-USER-15 | User manager count should be retrievable | Info | Active Directory - Users |
| AD-USER-16 | User home directory count should be retrievable | Info | Active Directory - Users |
| AD-USER-17 | User profile path count should be retrievable | Info | Active Directory - Users |
| AD-USER-18 | User script path count should be retrievable | Info | Active Directory - Users |
| AD-USER-19 | User in container count should be retrievable | Info | Active Directory - Users |
| AD-USER-20 | Known service account count should be retrievable | Info | Active Directory - Users |
| AD-USER-21 | Known service account details should be investigated | Info | Active Directory - Users |
| AD-USER-22 | Built-in administrator account count should be investigated | Info | Active Directory - Users |
| AD-USER-23 | Enabled built-in administrator details should be investigated | Info | Active Directory - Users |
| AD-USER-24 | Built-in administrator last logon details should be investigated | Info | Active Directory - Users |
| AD-USER-25 | Built-in administrator password age details should be investigated | Info | Active Directory - Users |
| AD-USER-26 | Honey pot user count should be investigated | Info | Active Directory - Users |
| AD-USER-27 | Honey pot user details should be investigated | Info | Active Directory - Users |
| AD-USER-28 | User delegation configured count should be investigated | Info | Active Directory - Users |
| AD-USER-29 | No users should be configured for unconstrained delegation | High | Active Directory - Users |