This project contains a PowerShell module named ADAudit with cmdlets for retrieving and exporting detailed information about the configuration of an Active Directory forest. The module also contains a set of Pester tests that can be used to validate whether any configuration drift has occurred as well as perform a series of health tests of AD.
The validation of AD configuration drifts works by you initially using Get-ADConfig | Export-ADConfig -AsGoldConfig to generate a current "known-good state" snapshot of the configuration of AD. After this you can use Test-ActiveDirectory, or run the ActiveDirectory.tests.ps1 file directly to compare the known good state to the current AD state (or a previously retrieved snapshot of the state).
This code builds on the Active Directory Operational Test work of Irwin Strachan (@IrwinStrachan) which he has detailed here:
This module is published in the PowerShell Gallery, so can be installed via:
Install-Module ADAudit -Scope CurrentUser
This module requires the following modules be installed/available:
- ActiveDirectory
- Pester
Execute to retrieve the current AD configuration as a PowerShell object.
Use to export the current AD configuration to an XML file. If you're saving the current known-good state, use -AsGoldConfig to have the exported configuration prefixed with GoldConfig-.
Execute to perform the following tests:
Active Directory configuration checks
- Various checks of the config between what has been stored previously and what has been captured now to detect configuration drift.
Active Directory health checks
- Runs NLTest /Query and checks the output for "Success"
- Runs DCDiag -a and checks the output for "failed"
- Runs RepAdmin /showrepl and checks each replication for the "Number of Failures" count being > 0
- Performs a Ping against each listed DC (per config)
- Tests that common AD ports respond locally: (53,88,135,139,389,445,464,636,3268,3269,9389)
- Checks that common AD services are running: ("ADWS","BITS","CertPropSvc","CryptSvc","Dfs","DFSR","DNS","Dnscache","eventlog","gpsvc","kdc","LanmanServer","LanmanWorkstation","Netlogon","NTDS","NtFrs","RpcEptMapper","RpcSs","SamSs","W32Time")
- Checks the SRV DNS records for _ldap.tcp.domainname and _kerberos.tcp.domainname