Scan Health
Scan Health provides an overview of configuration, permission, and connectivity issues that may affect the completeness of an Active Directory scan.
It helps identify whether required scan data was successfully collected and highlights conditions that may cause security checks to return incomplete results. As the page itself states, these results describe scan completeness and reliability, not vulnerabilities.
The page is opened from the heartbeat icon inside the Finished badge of a scan on the Scans list. The icon is shown for finished scans that include Active Directory.
The page is made up of the sections below, in this order. Each section ends with two lines:
Impact describes which security checks may be incomplete when the section reports a problem.
Recommendation describes what to change, usually with a reference to the Forestall Requirements.
Computer counts in the sections can be selected to open the corresponding computers in Search & Reports.
Local Enumeration Module
Local Enumeration Status
Shows whether the Local Enumeration module was enabled for the selected scan (Enabled or Disabled). When enabled, the scan can collect local user, local group, and local administrator information from eligible computers.
Network access: Restrict clients allowed to make remote calls to SAM
Shows whether eligible non-Domain Controller computers are covered by the required Remote SAM policy and whether SAM access succeeded during the scan. The section contains:
GPO COVERAGE: Eligible Non-DC Computers, Applied / Covered, Not Applied / Not Covered and Errors, with the covered, not covered and error shares.
GPO BREAKDOWN: the GPOs that configure the setting, with GPO Name, Applied Computers and Coverage columns.
RUNTIME REMOTE SAM RESULT: Eligible Computers, Remote SAM Blocked / Error and Remote SAM Available.
RUNTIME FAILURE REASONS and GPO COVERAGE REASONS: the number of computers for each reason, for example
SMB port 445 was closed or unreachable - the SAMR attempt could not begin.orNo Effective RestrictRemoteSAM GPO.
Scan Credential Local Administrator
Shows whether local administrator access was observed for the scan credential across eligible computers (Local Administrator or Not Local Administrator).
This helps indicate whether the credential has the expected local administrator coverage for local enumeration.
SMB Share Enumeration
SMB Share Enumeration shows whether SMB share collection was successfully completed for eligible computers. It reports collection reliability, not a security finding.
The section displays Eligible Computers, SMB Share Enumeration Not Confirmed, SMB Share Enumeration Successful, Shares Observed, and the COLLECTION FAILURE REASONS when available.
Certificate Services
Certificate Services shows whether Certificate Authority and Certificate Template objects were collected successfully and whether the required registry information can be read from Domain Controllers.
The section displays the number of Certificate Authorities, Certificate Templates, DC Registry Access Available and DC Registry Access Failed, followed by the discovered Certificate Authorities (Certificate Authority, CA Server). When no Certificate Authority was returned, a notice says that the forest may not contain an Enterprise CA, or that the scan credential may not have visibility of CA objects.
The DC Registry Access (Kdc / Schannel) table feeds the Weak Certificate Mappings on Domain Controllers (FS1161) check. It lists each Domain Controller with its DNS Host Name, the DC Registry Access result and the Reason when the Kdc and Schannel values could not be read.
DNS Node Read Access
DNS Node Read Access shows whether the scan credential can read DNS Node objects from the required Active Directory DNS locations.
The section displays results separately for DomainDnsZones, System MicrosoftDNS, and ForestDnsZones, with the Domain, Scope, Search Base, Nodes Observed, Direct Generic Read, Enumeration Result and Reason columns. ForestDnsZones is forest-wide, so it is shown once per forest, on the forest root domain only.
WSUS Access
WSUS Access shows whether configured WSUS references match servers detected during the scan and whether those servers are reachable.
The section displays the number of Configured References and Detected Servers, and a table with the Target, Source, Defined In (the GPO where the WSUS setting is defined), Reachability and Reason columns.
Example: WSUS Access Not Reachable
This example shows a WSUS server that was detected and matched to a configured WSUS reference, but the endpoint could not be reached during the scan.
The Reachability result is shown as Not Reachable, and the Reason field explains the connection issue.
DMSA Read Access
DMSA Read Access shows whether the scan credential can read Delegated Managed Service Account (dMSA) objects in domains running Windows Server 2025.
The section displays the number of applicable domains and whether dMSA access was confirmed, not confirmed, or could not be evaluated. The domain table lists the Domain, the detected Windows Server 2025 Domain Controllers, the DMSA Access result and the Reason for the result.
Example 1: DMSA Access Not Confirmed
This example shows a domain where dMSA access could not be confirmed for the scan credential.
No direct dMSA delegation was detected and no dMSA objects were retrieved. This may indicate insufficient read access or that the domain does not contain any dMSA objects. The Reason field explains the condition behind the result.
Example 2: DMSA Read Access Not Applicable
This example shows an environment where DMSA Read Access evaluation is not applicable because no supported Windows Server 2025 Domain Controller was detected.
The domain is marked as Not Applicable, and the Reason field explains why DMSA validation was not performed.
Permission Audit Coverage
Permission Audit Coverage shows what could be measured for the Over-privilege audit logging card on the Dashboard. The section is always shown. When the scan policy does not enable the Over-Privilege Analysis (Beta) module, it states: "The Over-Privilege Analysis module was not enabled for this scan, so audit coverage was not measured."
The Object-level audit coverage (SACL) table lists each domain as Measured, SACL Not Readable or Read Failed. SACL Not Readable means the Forestall user does not have the Manage auditing and security log right on the Domain Controllers of that domain (Requirement 15 in Requirements).
The Domain controller audit policy section displays the number of Domain Controllers whose required audit settings are Disabled by GPO, Not defined by GPO, or Could not be read. Audit settings applied locally or with auditpol are not read by the scan, so Domain Controllers without a GPO setting should be checked on the server.
The Permission usage verification (Splunk) section shows whether audited permissions were checked in Splunk. The result is Verified, Not Configured, Failed or Skipped.
Last updated
Was this helpful?