> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/ad-scan-vulnerability-remediation-guide.md). # Active Directory Scan Each vulnerability section includes: * **What it means:** a plain-language explanation of the risk * **What the scan checks:** the specific conditions that trigger the alert * **Why the alert may persist:** common partial fixes that are not enough * **How to diagnose:** PowerShell commands to identify affected objects * **How to fix:** step-by-step remediation > **Prerequisites:** All PowerShell commands require the `ActiveDirectory` module and should be run as a Domain Admin on a Domain Controller. > > ```powershell > Import-Module ActiveDirectory > ``` Remediation steps are grouped by PingCastle risk category: * [Anomalies](/cyber-best-practices/vulnerability-remediation-guides/ad-scan-vulnerability-remediation-guide/anomalies.md) * [Privileged accounts](/cyber-best-practices/vulnerability-remediation-guides/ad-scan-vulnerability-remediation-guide/privileged-accounts.md) * [Stale objects](/cyber-best-practices/vulnerability-remediation-guides/ad-scan-vulnerability-remediation-guide/stale-objects.md) ## Frequently Asked Questions #### The alert is still showing after I applied the fix. Why? The AD Scan does not run periodically. After applying a fix, you need to **run the script again** for the alert to clear. If the alert persists after a new scan, the fix was likely partial. Refer to the "Why the alert may persist" section of the relevant vulnerability. Make sure that you read the details of the vulnerability within your report, it often contains details on the impacted assets. #### Do I need Domain Admin rights to run the scan? Some vulnerabilities (e.g., A-NoServicePolicy) require elevated permissions to read certain AD objects. Running the scan with a **Domain Admin account** ensures all objects are visible and avoids false alerts caused by insufficient permissions. If not possible, you can still run the script as a simple domain user, though some vulnerabilities may appear because of missing visibility on AD objects. #### I fixed one vulnerability but a new one appeared. Is that normal? Yes. Some fixes can reveal other issues. For example, installing LAPS (fixing A-LAPS-Not-Installed) may trigger A-LAPS-Joined-Computers if computer objects have improper permissions. This is expected: work through each alert in order of severity. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/ad-scan-vulnerability-remediation-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.