> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/ad-scan/results.md).

# Reading results

The `AD Scan` page shows a risk score and the vulnerabilities found in your Active Directory configuration.

## Risk score

The higher the score, the more closely the Active Directory configuration adheres to security best practices. The aggregate score takes the lowest score among the four security points analyzed by the scan:

* [**Expired Objects**](https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/active-directory-scan/stale-objects)**:** everything related to Active Directory objects and their lifecycle: computer and user creation, delegation.
* **Trusts:** also called "trust relationships", these are the links between Active Directories (reminder: one Active Directory can compromise another in the event of misconfigured trusts).
* [**Privileged Accounts**](https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/active-directory-scan/privileged-accounts)**:** analysis of accounts with administrator rights.
* [**Anomalies**](https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/active-directory-scan/anomalies)**:** rules that are not classified under outdated objects, trusts, or privileged accounts. It analyzes certain misconfigurations, for example weak password policies.

The score comes from PingCastle's points, while the Critical, High, Medium and Low labels are Stoïk's own. So fixing a "critical" finding does not always move the score, and a single category with many points keeps the score at 0. The `Indicators` section of the PingCastle report shows which rules weigh the most.

## Several domains or forests

* PingCastle scans the domains it can reach from the machine, including trusted domains. If a domain is missing, run the script from a machine joined to that domain.
* Each domain has its own results and score: switch domains with the selector at the top of the results page.
* Each run replaces the previous results for that domain: nothing is added up. One machine per domain is enough.
* A domain that no longer exists (for example after a trust was removed) stays on screen: contact <protect@stoik.io> to delete it.

## Vulnerabilities

The scan identifies configuration settings that could expose your environment to security risks. Vulnerabilities can be viewed via three tabs:

* **Cyber projects:** categorizes vulnerabilities by theme: access control, authentication, networks, privileged account management, updates.
* **Attack paths:** gives an overview of risky entry points: compromise of a domain machine, a domain account, or the AD itself.
* **List:** lists all vulnerabilities.

The misconfigured rules found and their criticality levels, ranked from low to critical, are displayed in a table on the `AD Scan` page. Click a vulnerability to see technical information such as its name, detection date, impact, and recommendations for remediating it.

{% hint style="info" %}
To fix a finding, see the [AD Scan remediation guide](https://docs.stoik.io/cyber-best-practices/vulnerability-remediation-guides/active-directory-scan/ad-scan-vulnerability-remediation-guide) for step-by-step remediation of each vulnerability.
{% endhint %}

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2F9McDV7aCr4DMFhHU5Pq0%2FScreenshot%202025-12-31%20at%2013.11.27.png?alt=media&amp;token=6dd1c933-b39e-4a4c-86ca-46fc28faef26" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FNieNKdKnMpC7d4ALow5b%2FScreenshot%202025-12-31%20at%2013.11.37.png?alt=media&amp;token=51687b78-f76d-4cd3-bef5-9d63e32489f4" alt=""><figcaption></figcaption></figure>

If SIDHistory has been deleted, you can use a [recovery script](https://github.com/spurrw/restore-sidhistory-access). Ensure that the ACL settings are recreated after the restoration.

Findings cannot be dismissed or marked as accepted risk today. The `AD Scan` page shows the latest report per domain: for older reports, contact <protect@stoik.io>. There is no export or API.

## Troubleshooting

<details>

<summary>A fixed finding is still reported</summary>

* **Did the scan run again?** Results only change when the script runs again (once a month for automatic runs).
* **Which account ran it?** An account without Domain Admin rights cannot see some settings, like password settings objects. This creates findings that come and go between runs (typically `A-NoServicePolicy`). Run the script again with a Domain Admin account, in a PowerShell opened as administrator.
* **What does the PingCastle report say?** Download it from the results page. It lists the exact accounts, machines and GPOs behind each finding.
* **Is it a PingCastle limit?** PingCastle only sees what it checks. For example, it does not detect LAPS replacements like Baramundi, and `A-SmartCardPwdRotation` only checks a domain setting, not whether smart cards are used.
* **Another tool says otherwise?** Stoïk runs PingCastle with its own configuration, so results will not match BloodHound or a different PingCastle version.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/prevention-tools/ad-scan/results.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.