Skip to content
ARCTIC FOX LABS

GUIDED ACTIVE DIRECTORY SECURITY ASSESSMENT

Active Directory Security Assessments for Microsoft Environments

Identify and prioritize Active Directory security risks through a guided, customer-authorized assessment. Collection and reporting run locally in your environment.

Request a Guided AssessmentHow the Assessment Works

Customer-authorized • Read-only collection by design • Runs locally • No automatic upload

Arctic Fox Labs — Active Directory Security Assessment

corp.example.local · example data

ILLUSTRATIVE UI CONCEPT

Rules evaluated

12 AFL-AD

Local report · HTML / JSON

  • Critical1
  • High3
  • Medium5
  • Info3

Prioritized findings

12 total

  • CRITICAL

    Potential DCSync Permission Grants

    AFL-AD-007 · 3 principals · requires review

  • HIGH

    Unconstrained Kerberos Delegation (Non-DC)

    AFL-AD-008 · 2 computer objects

  • HIGH

    AS-REP Roasting Exposure

    AFL-AD-010 · 1 account

  • MEDIUM

    Privileged Accounts Not in Protected Users

    AFL-AD-009 · 7 accounts

Illustrative examples — not results from a live customer assessment. Severity counts are illustrative, not a calculated score. v1.0.0 RC3 does not produce a numerical security score.

HOW IT WORKS

A Guided Assessment That Runs in Your Environment

  1. 01

    Define Scope & Authorization

    The customer and Arctic Fox Labs agree on assessment scope, authorized operations, prerequisites, and data-handling arrangements.

  2. 02

    Run Locally

    The customer's authorized administrator runs the assessment collector within their own environment, with guided technical support.

  3. 03

    Generate & Review Results

    Assessment reports are generated locally. Findings are reviewed through an agreed process, with secure transfer only when explicitly authorized.

  4. 04

    Prioritize Remediation

    Arctic Fox Labs provides technical interpretation, prioritized recommendations, and a guided findings review.

Arctic Fox Labs does not require direct administrative access to the customer's Active Directory for the guided assessment model.

SECURITY CHECKS

What We Assess

The current pilot release evaluates 12 Active Directory assessment rules, AFL-AD-001 through AFL-AD-012, covering privileged access, Kerberos exposure and identity hygiene.

  • Privileged Access

    • AFL-AD-003adminCount=1 Accounts
    • AFL-AD-006Current Privileged Accounts
    • AFL-AD-012Selected Privileged Identity Risk Review

  • Directory Permissions

    • AFL-AD-007Potential DCSync Permission Grants

  • Kerberos Pre-Authentication

    • AFL-AD-002Kerberos Pre-Authentication Disabled
    • AFL-AD-010AS-REP Roasting Exposure

  • Delegation & Service Accounts

    • AFL-AD-004Accounts with Service Principal Names
    • AFL-AD-008Unconstrained Kerberos Delegation (Non-DC)

  • Identity Protections

    • AFL-AD-009Privileged Accounts Not in Protected Users
    • AFL-AD-011SIDHistory Inventory

  • Account Hygiene

    • AFL-AD-001Password Never Expires
    • AFL-AD-005Disabled Accounts Inventory

Groupings are for readability only and do not reflect the Reporting Engine's internal rule classification. Findings are assessment indicators and should be validated against operational requirements, effective permissions, and business context before remediation. See all 12 rules

SAMPLE FINDINGS

See the Risks Before They Become Incidents

Illustrative examples — not results from a live customer assessment.

Findings overview

ILLUSTRATIVE EXAMPLES — NOT CUSTOMER RESULTS
Illustrative examples — not results from a live customer assessment.
CriticalAFL-AD-007Potential DCSync Permission GrantsPermission grants requiring review — effective replication rights must be validatedAffected objects: 3
HighAFL-AD-008Unconstrained Kerberos Delegation (Non-DC)Affected objects: 2
HighAFL-AD-002Kerberos Pre-Authentication DisabledAffected objects: 1
MediumAFL-AD-003adminCount=1 AccountsIndicator for review — not by itself proof of current privilegeAffected objects: 12
MediumAFL-AD-009Privileged Accounts Not in Protected UsersAffected objects: 4

SAMPLE REPORT

From Security Findings to Actionable Remediation

An assessment should do more than identify misconfigurations. It should explain the risk, provide technical evidence, and help your team prioritize remediation.

  • Executive Summary
  • Security Posture Overview
  • Findings by Severity
  • Affected Objects
  • Technical Evidence
  • Risk Explanation
  • Recommended Remediation
  • Prioritized Action Plan
Request a Guided Assessment

Security Assessment Report · Section 4.2

corp.example.local · example data

ILLUSTRATIVE EXAMPLE
HighAFL-AD-008 · Kerberos & Delegation

Unconstrained Kerberos Delegation (Non-DC)

Affected Objects
1 example computer object (SRV-APP01$)
Technical Evidence
Example computer object configured for unconstrained delegation (TRUSTED_FOR_DELEGATION set on userAccountControl).
Risk Explanation
Potential exposure of delegated Kerberos credentials if the system is compromised.
Recommended Remediation
Validate business dependencies and migrate to a more restrictive delegation model where appropriate.

Prioritized Action Plan

  1. 1. Confirm which services depend on delegation from this host.
  2. 2. Move to constrained or resource-based constrained delegation.
  3. 3. Add privileged accounts to Protected Users or mark them sensitive.

MSP PARTNERS

Active Directory Security Assessments for MSPs

Extend your managed security services with a focused Active Directory assessment delivered in collaboration with Arctic Fox Labs.

Your team retains control of the customer environment and relationship. We provide specialized AD security assessment expertise, reporting, and remediation guidance.

Discuss an MSP Partnership