Active Directory Security Assessment

Active Directory Security Assessment (ADSA)

In-depth review of Active Directory configuration and GPO settings that drive security for in-scope domains and their affiliated OUs, groups, computers, users, and service accounts. Illumant uses automated GPO settings analysis tools along with manual reviews of the findings and the domain configurations themselves to develop recommendations to improve the security of AD implementations

Illumant analyzes the Active Directory from a variety of perspectives in order to evaluate the security of the AD implementation, and the security AD provides to users, computers, and the organization as a whole:

Classification of users and groups as privileged or unprivileged

• Illumant observes a variety of factors of each Group in AD to determine whether or not it has above average privileges. Very useful when there are hundreds or thousands of groups.
• Once the groups are classified we can use that information to determine which users are privileged or not based on their group membership. Due to cutting edge analysis techniques it is possible to determine user's complete group membership even when extreme nesting of groups has taken place

Discovery of sensitive information hidden deep within world readable portions of the AD implementation. Illumant has a history of finding things like passwords or private encryption keys, even in mature AD deployments Review of GPO permissions

• It is not uncommon to discover sensitive GPOs which are modifiable by low privilege users resulting in privilege escalation Identifying accounts which are candidates for removal due to factors such as the last time it was logged in to, or has its password changed