Active Directory is a backbone of an enterprise. Security and reliability of AD services affect everything else – from on-prem Exchange to Certificate Services to ADFS/SSO to endpoint security and so on. Environments that do not have mature operations/standards developed around Active Directory should consider performing a health check once in a while, especially prior to embarking on a major project.
AD health check can be performed by in-house personnel, but in some cases (be they political or precautionary) it may be beneficial to engage an unbiased third-party. Microsoft runs a program called AD RAP (risk assessment program), in which they run a tool such as ADST (Active Directory Snapshot Tool) or a set of tools and produce a 70-something page report. Other vendors may have their own methodologies.
What Should be Covered by an AD Health Check
Active Directory health depends on technical factors as well as organizational / process factors. While it is easy enough to analyze configuration of Active Directory and conclude that it is healthy, lack of consistent approach to things like change control can introduce randomness to an otherwise stable environment. So what should an Active Directory health check cover?
- Active Directory Infrastructure / Configuration
- Active Directory forests, domains, and trust relationships
- Domain functional level, forest functional level
- Conformity to best practices and intended purpose
- Domain controllers
- Number and physical characteristics (virtualization)
- DC placement / location
- FSMO services placement
- Physical security
- Global catalog configuration
- Time hierarchy review
- Event log review
- Sites and Services Infrastructure
- Sites mapping to physical infrastructure
- Site link bridging configuration
- Preferred bridgehead configuration
- Site link schedule, cost configuration
- IP subnet definition and mapping to sites
- Connection objects
- Namespace and Name Resolution Services
- DNS forwarders and delegation
- Zone configuration, replication, security
- DNS zone scavenging
- DHCP dynamic registration
- DHCP service identity
- DHCP configuration
- Authentication and Authorization Strategy
- Password policy, password lockouts and expirations
- Stale objects, stale passwords
- Number of accounts with non-expiring passwords
- Number of privileged accounts in Domain, Enterprise Admins groups
- Delegation of authority strategy
- RBAC (Role Based Access Control)
- Replication Health Review
- Directory replication / convergence
- NTFRS replication
- DFSR SYSVOL replication
- Antivirus, Patching, and Backup/Recovery Practices
- Group Policy and OU Structure Review
This is a high-level overview of what should be covered by a thorough AD health check engagement, but it does not need to stop there. Typically AD health checks are done in preparation for the next phase of a project, whatever it may be – ADFS deployment for cloud SSO integration, Exchange schema prep, PKI/ADCS deployment or assessment, etc.
Depending on the size of the environment, an engagement like this may take 3-5 business days and cost approximately $3,000-$5,000. Some vendors may offer a no-cost but more limited assessment as part of a bigger engagement where AD health check or discovery is a pre-requisite.
Active Directory Assessment Tools
The following Microsoft tools (free or part of the operating system) may be used for the technical part of the assessment:
- ADST, Active Directory Snapshot Tool, available through ADRAP program
- ADTD, Active Directory Topology Diagrammer
- ADBPA, Active Directory Best Practices Analyzer, on Windows Server 2008 or higher
- MBSA, Microsoft Baseline Security Analyzer, 2.2 or higher
- GPMC, Group Policy Management Console
- Command line tools: dcdiag, nltest, dfsrdiag, repadmin, dnscmd, dsget
Visio can be handy for discovering OU structures, there is a good article about it here.
In addition to technical tools, interviews need to be conducted to obtain organizational / process information, such as change management and administration model information, etc.
Active Directory Health Check Samples
You can find a few AD health check assessment samples here.