Skip to content
ARCTIC FOX LABS

GUIDED ASSESSMENT · LOCAL COLLECTION & REPORTING

Active Directory Security Assessment

Identify and prioritize Active Directory security risks through a guided, customer-authorized assessment. Collection and reporting run locally in your environment.

Request a Guided Assessment
  1. STEP 1

    Define Scope & Authorization

    The customer and Arctic Fox Labs agree on assessment scope, authorized operations, prerequisites, and data-handling arrangements.

  2. STEP 2

    Run Locally

    The customer's authorized administrator runs the assessment collector within their own environment, with guided technical support.

  3. STEP 3

    Generate & Review Results

    Assessment reports are generated locally. Findings are reviewed through an agreed process, with secure transfer only when explicitly authorized.

    View illustrative sample report →
  4. STEP 4

    Prioritize Remediation

    Arctic Fox Labs provides technical interpretation, prioritized recommendations, and a guided findings review.

Arctic Fox Labs does not require direct administrative access to the customer's Active Directory for the guided assessment model.

CURRENT RELEASE

Active Directory Security Assessment Pilot v1.0.0 RC3

The pilot is delivered through guided engagements. It is not available as a public download.

Collector
ArcticFox.ADCollector v0.8.1
Data format
JSON Schema v0.8.0
Reporting
Reporting Engine v0.9.4
Assessment rules
12 (AFL-AD-001 – AFL-AD-012)
Reports
HTML, JSON and optional PDF — generated locally
Release status
PILOT · RC3Passed laboratory QA · not approved for unrestricted public distribution

Not included

  • ×Automatic upload of assessment data
  • ×Cloud-based assessment processing
  • ×Automatic remediation

ASSESSMENT RULES

What Does the Assessment Check?

The current release implements these 12 assessment rules. Some are informational inventories; others identify configurations or potential security exposures that require technical review.

Findings are assessment indicators and should be validated against operational requirements, effective permissions, and business context before remediation.

  1. 01Password Never Expires

    AFL-AD-001

    Lists accounts configured so their password never expires.

  2. 02Kerberos Pre-Authentication Disabled

    AFL-AD-002

    Lists accounts that do not require Kerberos pre-authentication.

  3. 03adminCount=1 Accounts

    AFL-AD-003

    Lists objects flagged with adminCount=1 — an indicator for review, not by itself proof of current privilege.

  4. 04Accounts with Service Principal Names

    AFL-AD-004

    Lists user accounts that have Service Principal Names registered.

  5. 05Disabled Accounts Inventory

    AFL-AD-005

    Inventories disabled accounts that remain in the directory.

  6. 06Current Privileged Accounts

    AFL-AD-006

    Inventories current members of built-in privileged groups.

  7. 07Potential DCSync Permission Grants

    AFL-AD-007

    Identifies principals with directory replication permission grants on the domain object that require review.

  8. 08Unconstrained Kerberos Delegation (Non-DC)

    AFL-AD-008

    Identifies non-domain-controller objects trusted for unconstrained Kerberos delegation.

  9. 09Privileged Accounts Not in Protected Users

    AFL-AD-009

    Lists privileged accounts that are not members of the Protected Users group.

  10. 10AS-REP Roasting Exposure

    AFL-AD-010

    Highlights accounts potentially exposed to AS-REP roasting.

  11. 11SIDHistory Inventory

    AFL-AD-011

    Inventories objects that carry SIDHistory values.

  12. 12Selected Privileged Identity Risk Review

    AFL-AD-012

    Reviews selected risk indicators on privileged identities.

SECURITY & DATA HANDLING

Security by Design

These describe how the assessment is designed and delivered. The product has not completed an independent security audit or penetration test.

  • The collector is designed to perform read-only assessment operations.
  • Explicit authorization is required before collection.
  • Collection and reporting run locally in your environment.
  • No automatic upload of assessment data is implemented.
  • Any transfer of assessment results requires a separately agreed secure process.
  • No passwords are collected and no directory configuration changes are made.

Assessment data may contain sensitive infrastructure and identity information and should be protected accordingly. Findings are not a guarantee of security or compliance.

GUIDED ENGAGEMENT

What the Guided Assessment Includes

Every assessment starts with an agreed scope. Arctic Fox Labs then provides:

  • ›Scoping and authorization
  • ›Guided collector execution support
  • ›Technical interpretation of findings
  • ›Privileged access analysis
  • ›Risk prioritization
  • ›Remediation recommendations
Request a Guided Assessment

Sharing Assessment Results

This website does not accept assessment files, and the collector does not upload data automatically. Any transfer of assessment results requires a separately agreed secure process.

Please do not send Active Directory exports, passwords or credentials through any form or email.