Who holds privileged access — and should they?
The directory is where privilege is granted and, too often, forgotten. This module reads it continuously and tells you who holds power, which accounts have gone quiet and where the configuration is risky — with the evidence behind every answer, not just a severity label.
Privileged means privileged by membership. Protected accounts are recognised through the built-in administrative groups and everything nested into them, matched by well-known identifier — so a renamed group still counts, and an account merely named like an admin does not.
Accounts that have stopped signing in, accounts that never should have been kept, and the lifecycle gaps that let both accumulate — 40+ checks in all across the directory.
Domain trusts are judged from this domain's side — the trusts it relies on — with forest trusts understood as filtered unless something re-opens them. The default password policy is judged against the CIS Windows Server benchmark.
An at-a-glance map of the directory's structure, and the ability to compare its state between two points in time to see exactly what changed.
Every directory check as one pass/fail list, grouped by area, each with its reference. Certificate-services checks sit on their own card.
Each with the evidence behind it, not just a severity label.
A built-in explainer on every finding — what it is, why it matters, what to do.
Rolled up from the findings and trended over time.
Findings mapped to the framework controls they evidence.
A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.
Findings from this module evidence the access-control and identity-management control areas of every activated framework.
Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.