Setup

Prerequisites:

• Windows version:

  • Windows 10 or later on a workstation

  • Windows Server 2016 or later on a server (must have recent security patches applied)

• Internet access: outbound HTTPS (port 443), without SSL inspection, to:

  • api.prod.ad-scan.cyber.stoik.io

  • ad-scan-prod-pingcastle-zip.s3.eu-west-1.amazonaws.com

  • ad-scan-prod-reports.s3.eu-west-1.amazonaws.com

• Enrolled in Active Directory and connected to the domain controller

• Logged in to a domain administrator account

• Unsigned script execution allowed:

  • Option A: Set-ExecutionPolicy Unrestricted -Scope LocalMachine

  • Option B: Add the binary file to the ignore list in Defender or a similar solution, then run Set-ExecutionPolicy Bypass -Scope Process and run the script.

• Script downloaded within the last 24 hours

• Latest version of PowerShell installed, check with: $PSVersionTable.PSVersion

1

Open AD Scan

Click on AD Scan.

2

Download the script

Click Download the script.

If the AD scan script does not download, your security settings may be blocking it. Check if the file appears in the Downloads tab of your file explorer. If the problem persists, modify your security settings to allow downloads.

3

Run the script

Run the script in a PowerShell console from an endpoint that meets the prerequisites above.

Re-run the scan

Updating the AD scan is manual: each new run must be initiated manually. The downloaded script is only valid for 24 hours: after this time, you must download it again.

The scan can be rerun as many times as necessary:

• Under normal operation, we recommend running it monthly.

• During infrastructure security hardening phases, it can be run more frequently to verify that misconfigurations have been corrected.

The AD scan is automatically re-run monthly for Stoïk MDR customers.

Debugging the AD scan

Script closure after execution

This means that script execution is restricted in the terminal. Here is a three-step solution:

1. Download the script and go to Downloads, then type powershell -ep bypass in the search bar.

2. The PowerShell console should open automatically. Once it does, type & and press Tab until the correct script file is visible.

3. Press Enter.

PingCastle interruption

In this case, ensure that all of these conditions are met:

• You have an internet connection to your domain controller.

• Your firewall or proxy is not blocking access to api.prod.ad-scan.cyber.stoik.io, ad-scan-prod-pingcastle-zip.s3.eu-west-1.amazonaws.com, and ad-scan-prod-reports.s3.eu-west-1.amazonaws.com.

• SSL inspection is disabled for these hosts. A proxy that inspects or rewrites HTTPS traffic to the S3 buckets breaks the presigned download URL and causes the PingCastle download to fail or time out, even when DNS and TCP connectivity look fine.

Delete data after script execution

If you wish to delete the data after the script has run, execute the following command:

Finally {
    Remove-Item -Recurse -Force -ErrorAction SilentlyContinue "$Directory", "ad_hc_*"
    }
}