AD Policies

Active Directory policies set what a scan collects and checks in on-premises Active Directory environments.

Edit Scan Policy (Active Directory)

On the General tab you enable or disable the scan modules, set the options and define exclusions. The Edit Scan Policy page has four tabs: General, Vulnerability, Tier 0 Assets and Compliance (see Compliance Frameworks).

Active Directory Scan Policy Settings

Vulnerability Policies and Tier 0 Assets (Active Directory)

The Vulnerability tab sets which checks run during the scan (see Vulnerability Policies). The Tier 0 Assets tab marks your most critical directory objects (see Tier 0 Assets).

Active Directory Scan Modules

• Active Directory Assessment: Checks vulnerabilities, misconfigurations and attack paths on each Active Directory object and the relations between them. It is the core module and cannot be disabled. When it is the only enabled module, the engine communicates only with the domain controllers.

• Network Security Assessment: Collects network information such as SMB port status, Spool service status, shared files and the contents of GPO and GPP files. This data is used for checks that need network access, such as sensitive information in files, MS17-010, BlueKeep, Zerologon and SMB signing enforcement. Optional. The engine communicates with each computer found in Active Directory.

  Important Note: Service-Based Security Assessment, Session Enumeration, Local Entity Enumeration, ADCS Enumeration, Coercion Enumeration and Credential Discovery Enumeration require Network Security Assessment. Disabling it disables them too. Tier0 Analysis and Over-Privilege Analysis (Beta) do not depend on it.

• Service-Based Security Assessment: Finds weaknesses in the Kerberos and NTLM authentication protocols, such as the CVE-based Drop the MIC attacks. Optional. The engine communicates with each computer found in Active Directory.

• Session Enumeration: Collects the active sessions on computers, so you can see which users have sessions on which machines. It also reveals tier model issues caused by sessions between entities of different tiers. Optional. The engine communicates with each computer found in Active Directory.

• Local Entity Enumeration: Collects local users, local groups and their memberships, including domain members. It also shows which entities can use DCOM, PowerShell or RDP on a computer, and the local admin paths to each computer. Optional. The engine communicates with each computer found in Active Directory.

• ADCS Enumeration: Collects Active Directory Certificate Services data such as certificate authorities, subordinate certificate authorities, exposed enrollment services and certificate templates. It reads Active Directory and the servers with certificate services roles, over HTTP, HTTPS and LDAP, and with remote registry reads.

• Coercion Enumeration: Collects the data for coercion vulnerabilities from online computers. When the module is disabled, coercion vulnerabilities are not shown on the Issues page.

• Credential Discovery Enumeration: Feeds the Credential Discovery page. It searches accessible SMB shares on all online computers for regex-based secrets, such as clear-text or weakly protected passwords, cryptographic keys, certificates and configuration files with credentials. The engine lists the shares, samples file contents where permitted, and flags shares that Everyone can read or write. The engine communicates with each computer found in Active Directory.

• Tier0 Analysis: An analytics-only module that calculates the attack paths from Tier 2 assets to Tier 0 assets, with shortest-path, choke-point and blast-radius analyses. It uses the data collected by Active Directory Assessment and generates no extra network traffic. Use the results to see privilege-escalation routes and to prioritize remediations.

• Over-Privilege Analysis (Beta): Collects SACL audit data during Active Directory enumeration and reports audit coverage on the Dashboard. Reading SACLs requires Requirement 15 of Requirements. Splunk is optional. When a Splunk integration is configured, the module correlates Security events with dangerous ACE relations. Relations with activity are marked as verified, and relations without activity as unused, based on the policy Inactivity Threshold.

In the Default Policy, all modules except Over-Privilege Analysis (Beta) are enabled.

Options (Active Directory)

• Include Inactive Accounts: Includes inactive accounts in the scan. Enabled by default.

• Inactivity Threshold: The number of days after which an account counts as inactive. The default value is 90.

• Include Disabled Accounts: Includes disabled accounts in the scan. Enabled by default.

Exclusions (Active Directory)

Click Add New to add an exclusion row, then select the entity type and enter the entity. The types and their identifiers are listed under General Exclusions.

Tier 0 Assets (Active Directory)

On the Tier 0 Assets tab you mark objects as Admin and Privileged. The types are User, Computer, Group, OU, MSA, GMSA and DMSA. These objects are not marked as Shadow Admin. When you select an OU or a group, the objects in it are Tier 0 assets too.

Adding Tier 0 Assets

Tier 0 Assets Description and Files

Each Tier 0 asset can have an optional description and supporting files such as PDF and image documents.