Active Directory Security Assessment & Attack Surface Analysis
An open-source penetration testing tool to evaluate AD security, identify misconfigurations, and map exploitation paths before attackers do.

Over time, every Active Directory environment accumulates operational and security debt.

What often begins as a well structured and controlled infrastructure gradually degrades through years of:

• 🚫 Orphaned test and temporary accounts
• 🚫 Service accounts that are never reviewed or decommissioned
• 🚫 Excessive or misconfigured delegations
• 🚫 Weak or inconsistent password policies
• 🚫 Privileged group memberships left unchanged for extended periods

This lack of continuous governance often amplified by team turnover and insufficient visibility significantly expands the attack surface.

The result is an environment that appears compliant and secure on paper, yet conceals critical weaknesses that enable lateral movement, persistence, and privilege escalation for both internal and external attackers.

While PingCastle, PurpleKnight, and ORADAD are excellent tools, they have fundamental limitations:

ADcheck doesn't measure domain "maturity" it analyzes your attack surface:

✓ What are the administrative flaws?
✓ Which delegations can be abused?
✓ What accounts pose real compromise risk?
✓ What lateral movement paths exist?

The output provides direct interpretation, not raw data answers you can act on immediately.

Detect account-level vulnerabilities and misconfigurations:

Verify security policy compliance and endpoint hardening:

Assess domain-wide architecture and security posture:

Uncover privilege abuse vectors and delegation chains:

ADcheck provides readable, structured results with intuitive color-coding:

• 🔴 Red → Critical vulnerability or dangerous misconfiguration requiring immediate remediation
• 🟢 Green → Secure configuration or compliant setting
• ⚪ White → Informational reference data

Each finding is directly interpretable—no manual analysis required.

👉 View a sample HTML report

# 1. Install UV (fastest Python package manager)
pip install uv

# 2. Install ADcheck
uv tool install git+https://github.com/CobblePot59/ADcheck.git

# 3. Run your assessment
ADcheck -d 'example.com' -u 'Administrator' -p 'Password1' --dc-ip '192.168.1.1'

# 1. Clone the repository
git clone https://github.com/CobblePot59/ADcheck.git
cd ADcheck

# 2. Install dependencies with UV
uv sync

# 3. Run your assessment
uv run adcheck -d 'example.com' -u 'Administrator' -p 'Password1' --dc-ip '192.168.1.1'

Planned enhancements:

• Trusts
• Azure (Entra ID)
• Persistent attack trace (mimikatz, certipy, ticket, dsrm, acl)
• List of Named pipes
• Verify if Spooler service is enabled on remote target
• Outputs a human readable summary of acls

Before running :

• Use a dedicated testing machine when possible
• Verify authorization for Active Directory auditing
• Notify security/infrastructure teams before running assessments

Best Practices:

• Archive reports for historical trend analysis
• Share findings with infrastructure and security teams for prioritized remediation
• Use results to reconstruct real-world attack scenarios and improve defenses