An Active Directory or LDAP directory drifts every week, and a hardening checklist completed once does not tell you whether the directory is still in the state you signed off. This health check is a quarterly measurement routine: ten metrics, each with a formula, a data source and a threshold, that show whether privileged membership, Kerberos exposure, stale objects and change control are getting better or worse. It is written for directory owners, identity engineers and the security team that reviews them. The hardening steps themselves live in the Active Directory Security Checklist; this page measures the result rather than repeating them.
What this health check covers
The scope is every directory that issues identities your systems trust for authentication: Active Directory domains and forests, and standalone LDAP directories that hold user, service and computer accounts. The review is run by the directory or identity operations team, checked by security, and signed off by the identity service owner. Use the Active Directory Security Checklist when you are building or fixing the controls, and the Active Directory Security Monitoring and Event IDs Guide for real-time detection. This page sits between the two: a repeatable audit of how active directory security is holding up, with trends you can report.
The ten metrics were chosen because each maps to a technique that the joint ASD ACSC, CISA, NSA, NCSC-UK, CCCS and NCSC-NZ guidance on detecting and mitigating Active Directory compromises treats as a common route to domain compromise, and each can be measured from an export without specialist tooling. Where a metric does not apply to a pure LDAP directory (Kerberos delegation, for example), the review records it as out of scope for that directory rather than green.
Key takeaways
- Measure the population, not the policy. Every metric is a count or ratio of real objects, so the result shows what is in the directory today, not what the standard says.
- Privileged membership is the first number to watch. Growth in highly privileged groups, and service accounts inside them, is the clearest early sign of directory decay.
- Kerberos exposure is measurable. Kerberoastable accounts, unconstrained delegation and the age of the krbtgt secret are three numbers that predict how bad a compromise would be.
- Tier violations need logon data, not configuration data. Only sign-in records show whether tier 0 credentials are actually being used on lower tier hosts.
- Trend beats a single score. Keep each quarter's figures in the findings log so the sign-off shows direction, and so a sudden jump triggers investigation.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Active Directory and LDAP Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Full ten-metric health check | Quarterly | Directory operations lead | Identity service owner and CISO delegate | Metric workbook, raw exports with hashes, findings log |
| Privileged group membership snapshot (DIR-01, DIR-06) | Monthly | Directory operations | Security operations lead | Membership export, diff against last month, approval tickets |
| Tier 0 logon review (DIR-07) | Monthly, plus after any incident | Security operations | Identity service owner | Query output, investigated exceptions |
| Kerberos secret rotation check (DIR-09) | Quarterly and after any suspected domain compromise | Directory operations | Identity service owner | Last rotation dates per domain, change records |
| Ad hoc rerun | After a merger, forest migration, major outage or incident | Directory operations lead | CISO delegate | Same as quarterly |
The approver must not be the person who administers the directory day to day. Separation between the person who collects the numbers and the person who accepts them is what makes the sign-off evidence for an auditor (NIST SP 800-53 AC-6(7) review of user privileges, and AU-6 audit record review).
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. "Enabled accounts" means accounts that are not disabled at the time of the export. Count each account once per domain.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| DIR-01 | Privileged group members | Enabled accounts in highly privileged groups (forest and domain admin groups, built-in administrators, schema, enterprise key and backup operator groups), including nested membership / total enabled user accounts | Directory group membership export with nesting resolved | < 0.1% and no unexplained additions | 0.1% to 0.5%, or additions without a ticket | > 0.5%, or any unknown member |
| DIR-02 | Kerberoastable service accounts | Enabled user accounts with a service principal name and a password older than 365 days or a password not generated by a managed rotation process / enabled user accounts with a service principal name | Directory account export with SPN and password-last-set attributes | 0% | Above 0% to 10% | > 10%, or any such account in a privileged group |
| DIR-03 | Stale computer accounts | Enabled computer accounts with no logon timestamp update in 90 days / total enabled computer accounts | Directory computer object export with last logon timestamp | < 2% | 2% to 10% | > 10% |
| DIR-04 | Passwords never expire | Enabled user accounts with the "password never expires" flag and no documented compensating control (managed rotation, smart card required) / total enabled user accounts | Directory account export with account control flags | < 1% | 1% to 5% | > 5%, or any privileged account |
| DIR-05 | Unconstrained delegation hosts | Count of enabled computer and user accounts trusted for unconstrained delegation, excluding domain controllers | Directory object export with delegation flags | 0 | 1 to 2 with a dated retirement plan | Any without a plan, or any increase |
| DIR-06 | AdminSDHolder protected users | Enabled accounts carrying the protected-object marker (adminCount set) that are no longer in any protected group / all enabled accounts carrying the marker | Directory account export plus resolved privileged membership from DIR-01 | < 5% | 5% to 20% | > 20%, or unexplained changes to the AdminSDHolder object's permissions |
| DIR-07 | Tier 0 logons on lower tiers | Successful interactive, remote interactive or network-with-cleartext logons by tier 0 accounts on hosts outside tier 0 during the quarter / total successful logons by tier 0 accounts | Domain controller and member server security event logs held in the SIEM, joined to a tier asset list | 0 | Any, each with an approved break-glass record | Any without a record |
| DIR-08 | Local administrator password management coverage | Enabled workstations and member servers with a managed, unique, rotated local administrator password recorded in the directory within the rotation period / enabled workstations and member servers | Directory computer object export with password expiry attribute, joined to the endpoint inventory | > 98% | 90% to 98% | < 90% |
| DIR-09 | krbtgt password age | Days since the krbtgt account password was last set, per domain (report the maximum across domains) | Directory account export (password-last-set attribute) and change records | <= 180 days | More than 180 days to 365 days | > 365 days, or not reset twice after a suspected compromise |
| DIR-10 | GPO changes unreviewed | Group Policy object create, modify, link and delete events in the quarter without a matching approved change record / total Group Policy change events in the quarter | Directory service change audit events in the SIEM, joined to the change management system | 0% | Above 0% to 5% | > 5%, or any unreviewed change to a policy linked to domain controllers |
Two notes on the formulas. DIR-02 counts accounts whose secret a remote attacker could request a ticket for and crack offline (MITRE ATT&CK T1558.003 Kerberoasting): a long, managed, regularly rotated secret moves an account out of the numerator, which is why the metric tracks password age and management rather than SPN presence alone. DIR-09 tracks the secret that signs every ticket in the domain; a forged ticket built from a stolen krbtgt secret (T1558.001 Golden Ticket) stays valid until that secret has been changed twice, so the reset after an incident is a two-step operation with replication time between steps.
How to collect the data
Collect everything in one window, ideally on the same day, so the ratios share a denominator. Store raw exports read-only with a hash so the next quarter can be compared like for like.
- Account and computer exports: run a read-only LDAP query, from a tier 0 admin host with a dedicated read account, for users and computers with these attributes: enabled state, account control flags, password last set, last logon timestamp, service principal names, delegation settings and the protected-object marker. This one export feeds DIR-02 to DIR-06, DIR-08 and DIR-09.
- Group membership with nesting: resolve nested membership for each highly privileged group (DIR-01). Flat exports undercount; nested groups are where unexpected members hide. An attack path graphing tool, run under authorisation, is a useful cross-check; see the BloodHound and Active Directory Attack Path Guide.
- Logon events: from the SIEM, pull successful logon events for the tier 0 account list over the quarter, with logon type and target host, and join to the tier asset list (DIR-07). If logon data is not retained for 90 days, record the metric as red for data availability.
- Change events: from directory service change auditing, pull Group Policy object changes and links, then join each to change records by time and object (DIR-10). The same events cover changes to the AdminSDHolder object for DIR-06.
- Endpoint inventory: take the device count from the endpoint management or asset inventory, not from the directory, so DIR-03 and DIR-08 are measured against what really exists.
- LDAP directories: for standalone LDAP servers, take the equivalent attributes (account lock and expiry operational attributes, password change time, group membership) from a read-only bind; record Kerberos-only metrics as not applicable.
Record the query text, the account used, the time window and the record count for each export. The question an auditor asks first is "how was this number produced", and the answer should be in the workbook.
Red flags that need action now
- Any account in a highly privileged group that nobody can name an owner or a ticket for.
- A service account with an SPN in a domain admin group, or with a password older than the domain itself.
- Any new host trusted for unconstrained delegation since the last review.
- A krbtgt secret older than a year, or not reset after an investigation that found domain admin credentials exposed.
- Tier 0 credentials used to sign in to a workstation or a general purpose server without a break-glass record.
- Changes to the AdminSDHolder object permissions, or new access control entries granting write rights on privileged groups (MITRE ATT&CK T1098 Account Manipulation).
- A Group Policy change linked to the domain controllers container with no change record (T1484.001 Group Policy Modification).
- Logon or directory change audit data missing for part of the quarter, which means the other numbers cannot be trusted either.
If several red flags appear together, treat the review as a possible compromise rather than hygiene and move to the Active Directory Domain Compromise Response Playbook.
Findings log
Use one row per finding, keep closed rows, and carry open rows into the next quarter with their original due date.
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-DIR-01 | [Number] enabled accounts in highly privileged groups without an approval record | DIR-01 | [Critical / High / Medium / Low] | [Name, role] | [YYYY-MM-DD] | [Open / In progress / Closed / Risk accepted] |
| HC-DIR-02 | [Number] SPN accounts with unmanaged passwords older than 365 days | DIR-02 | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
| HC-DIR-03 | [Finding] | [DIR-nn] | [Severity] | [Name, role] | [YYYY-MM-DD] | [Status] |
Suggested severity: any red on DIR-01, DIR-05, DIR-07 or DIR-09 is critical with a 30-day due date; other reds are high at 60 days; ambers are medium at 90 days. A risk-accepted row needs the approver's name and an expiry date.
Remediation map
| Finding type | Where the fix is described |
|---|---|
| Excess or unknown privileged group members (DIR-01) | Active Directory Security Checklist, section 3 Privileged groups; Active Directory Delegation |
| Service accounts with domain admin rights | How to find service accounts with Domain Admin rights |
| Kerberoastable and never-expiring service accounts (DIR-02, DIR-04) | How to build a service account inventory from Active Directory; How to assign owners to orphaned service accounts |
| Stale computer accounts (DIR-03) | Active Directory Security Checklist, section 4 Accounts and credentials |
| Unconstrained delegation, krbtgt age (DIR-05, DIR-09) | Active Directory Security Checklist, section 5 Kerberos and delegation |
| Orphaned protected-object markers and ACL drift (DIR-06) | Active Directory ACL and Delegation Hygiene Guide |
| Tier 0 logons on lower tiers (DIR-07) | Active Directory Security Checklist, section 2 Administrative tiering; How to detect interactive logons by service accounts |
| Local administrator password gaps (DIR-08) | Active Directory Security Checklist, section 4 Accounts and credentials |
| Unreviewed Group Policy changes (DIR-10) | Group Policy Security Guide |
| Missing audit data | Active Directory Security Monitoring and Event IDs Guide |
Framework mapping
| Metric | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|
| DIR-01, DIR-06 | AC-6 Least Privilege; AC-6(7) Review of User Privileges | PR.AA-05 | T1078.002 Domain Accounts; T1098 Account Manipulation |
| DIR-02, DIR-04, DIR-09 | IA-5 Authenticator Management | PR.AA-01 | T1558.003 Kerberoasting; T1558.001 Golden Ticket |
| DIR-03 | AC-2 Account Management; AC-2(3) Disable Accounts | PR.AA-01 | T1078.002 Domain Accounts |
| DIR-05, DIR-07 | AC-6 Least Privilege; AC-6(9) Log Use of Privileged Functions | DE.CM-03 | T1550.003 Pass the Ticket |
| DIR-08 | IA-5 Authenticator Management | PR.AA-01 | T1078.002 Domain Accounts |
| DIR-10 | CM-3 Configuration Change Control; AU-6 Audit Record Review | PR.PS-04 | T1484.001 Group Policy Modification |
In CIS Controls v8.1 the metrics fall under Control 5 (Account Management), Control 6 (Access Control Management) and Control 8 (Audit Log Management). Use GV.OV-03 in CSF 2.0 for the quarterly sign-off itself: it is the outcome that says risk management performance is evaluated and reviewed.
Related guides
- Active Directory Security Checklist: the hardening checklist this health check measures.
- Identity Security Maturity Model: where repeatable directory measurement sits on the maturity scale.
- Identity Security Metrics Guide: how to roll these directory figures into programme reporting.
- Active Directory Domain Compromise Response Playbook: what to do when the numbers suggest an attacker rather than drift.
- Active Directory Forest Recovery Runbook Template: the recovery plan the krbtgt and tier 0 findings feed into.
References
- CISA: Detecting and Mitigating Active Directory Compromises
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls Version 8.1
- MITRE ATT&CK: Kerberoasting
- MITRE ATT&CK: Golden Ticket
- MITRE ATT&CK: Group Policy Modification
Related NHI Mgmt Group resources: Active Directory Fundamentals, Decoy accounts in Active Directory, Active Directory Trusts and SID Filtering Guide, AD CS Security Guide.