Punk Security Active Directory Audit

Active Directory Audit is a consulting service from Punk Security that reviews and analyzes an organization's Active Directory environment for security, compliance, and operational efficiency. The audit covers several key areas: - User account management, including inactive/default accounts and separation between privileged and non-privileged accounts - Group Policy Object (GPO) configuration review to identify excessive permissions - Security settings such as password policies, account lockout policies, and auditing settings, benchmarked against CIS and NCSC best practices - Access rights and permissions review, including detection of excessive or hidden "shadow" permissions and inappropriate administrative privileges - Directory services health checks, including replication status and domain controller issues - Login and authentication log review to identify unauthorized access attempts or compromised credentials - Verification of system updates and patches on domain controllers - Review of auditing and monitoring policies to track changes and unusual activity - Password hygiene testing, including extraction and anonymized offline brute-force analysis of AD passwords to identify weak passwords and predictable password conventions The service produces a report with findings and recommendations to help organizations identify and mitigate security risks within their Active Directory infrastructure.