> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/ad-scan/setup.md).

# Setup

Download the AD scan script from Stoïk Protect and run it in PowerShell on a machine joined to your domain.

## Prerequisites

* Windows version:
  * Windows 10 or later on a workstation
  * Windows Server 2016 or later on a server (must have recent security patches applied)
* Internet access: outbound HTTPS (port 443), without SSL inspection, to:
  * `api.prod.ad-scan.cyber.stoik.io`
  * `ad-scan-prod-pingcastle-zip.s3.eu-west-1.amazonaws.com`
  * `ad-scan-prod-reports.s3.eu-west-1.amazonaws.com`
* Enrolled in Active Directory and connected to the domain controller
* Logged in to a domain administrator account
* Unsigned script execution allowed:
  * Option A: `Set-ExecutionPolicy Unrestricted -Scope LocalMachine`
  * Option B: Add the binary file to the ignore list in Defender or a similar solution, then run `Set-ExecutionPolicy Bypass -Scope Process` and run the script.
* Script downloaded within the last 24 hours
* Latest version of PowerShell installed, check with: `$PSVersionTable.PSVersion`

## Running the scan

{% stepper %}
{% step %}

### Open AD Scan

Click `AD Scan`.
{% endstep %}

{% step %}

### Download the script

Click `Download script`.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2Fgit-blob-3c3e9d5fd29ffc83ce39abb83fc910617e57b854%2FCapture%20d%E2%80%99%C3%A9cran%202026-06-09%20%C3%A0%2016.03.34.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
If the AD scan script does not download, your security settings may be blocking it. Check if the file appears in the `Downloads` tab of your file explorer. If the problem persists, modify your security settings to allow downloads.
{% endhint %}
{% endstep %}

{% step %}

### Run the script

Run the script in a PowerShell console from an endpoint that meets the prerequisites above.
{% endstep %}
{% endstepper %}

## Re-running the scan

Updating the AD scan is manual: each new run must be initiated manually. The downloaded script is only valid for 24 hours: after this time, you must download it again.

The scan can be rerun as many times as necessary:

* Under normal operation, we recommend running it monthly.
* During infrastructure security hardening phases, it can be run more frequently to verify that misconfigurations have been corrected.

A script can be run on several machines during its 24 hours, and downloading a new one does not cancel the previous one. Each run replaces the previous results for the domain it scanned. New results show up a few seconds after the script ends.

### Automatic scan with Stoïk MDR

For Stoïk MDR customers on CrowdStrike, Stoïk runs the script once a month through CrowdStrike, on a machine that CrowdStrike identifies as a domain controller. The machine and the date cannot be chosen. The script runs with the domain controller's own account, so it sees everything a Domain Admin sees. For SentinelOne and Microsoft Defender customers, the script must be run manually.

`AD Scan` > `Settings` lists the automatic runs and their status. A failed run is not retried before the next month, but you can run the script manually at any time. The most common cause of failure is a domain controller on Windows Server 2016 or older, see ["Could not create SSL/TLS secure channel"](/prevention-tools/ad-scan/setup-errors.md#could-not-create-ssl-tls-secure-channel). To stop automatic runs, contact <protect@stoik.io>.

## Deleting leftover files

The script deletes its files when it ends. If files are left behind (for example after a run with `-KeepLog` or `-NoDelete`), run this command in a PowerShell opened as administrator, from the folder where you ran the script:

```powershell
Remove-Item -Recurse -Force -ErrorAction SilentlyContinue "C:\Temp\Stoik", ".\ad_hc_*"
```

## Troubleshooting

If the script fails, see [Setup errors](/prevention-tools/ad-scan/setup-errors.md). For what the script sends to Stoïk and why it is not signed, see [Common questions](/prevention-tools/ad-scan/common-questions.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/prevention-tools/ad-scan/setup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.