> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/ad-scan/setup-errors.md).

# Setup errors

Fix the most common errors printed by the Active Directory scan script when it fails.

## Reading the script output

Most errors come from an endpoint (workstation or server) that does not meet the [prerequisites](/prevention-tools/ad-scan/setup.md#prerequisites). The script output says which one:

* The script runs 10 numbered checks and prints `OK` or `NOK` for each, then a `Mandatory issues` summary. The `NOK` line usually says what to fix.
* If the window closed, open the log file `C:\Temp\Stoik\Stoik_ADScan_<date>.log`. It is kept when the run fails.

## Troubleshooting

<details>

<summary>"Script download age: NOK", "Token expired" or "400 Bad Request"</summary>

The script is more than 24 hours old (check 5 shows its age in hours). Download a new one from Stoïk Protect.

</details>

<details>

<summary>"Domain-joined: NOK"</summary>

The machine is not part of the domain (a server in a workgroup, a personal laptop). Use a domain-joined machine.

If you have no on-premise Active Directory at all (Entra ID only), the AD scan does not apply: use the [Cloud scan](/prevention-tools/cloud-scan.md).

</details>

<details>

<summary>"Could not create SSL/TLS secure channel"</summary>

The Stoïk API only accepts TLS 1.2 and 1.3 with recent ciphers. Two usual causes:

* **Old Windows:** Windows Server 2012 and many Windows Server 2016 machines do not offer these ciphers. The easiest fix is to run the script from a more recent domain-joined machine. It does not have to be the domain controller.
* **SSL inspection** on your proxy or firewall: see [PingCastle cannot be downloaded or the report cannot be uploaded](#pingcastle-cannot-be-downloaded-or-the-report-cannot-be-uploaded).

On Windows Server 2016, you can also enable the ciphers from a PowerShell opened as administrator, then run the script again:

```powershell
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" | ForEach-Object { Enable-TlsCipherSuite -Name $_ }
```

</details>

<details>

<summary>The script closes automatically after execution</summary>

This means that script execution is restricted on the terminal. Here is a three-step solution:

1. Download the script and go to `Downloads`, then type `powershell -ep bypass` in the search bar:

   <figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FeQr2oHMVVuuNE3wGWQmA%2Fadscan-powershell-ep-bypass.png?alt=media&amp;token=acd7b9c4-f9e0-4b13-a1ce-d86c228bdff3" alt=""><figcaption></figcaption></figure>
2. The PowerShell console should open automatically. Once it has opened, type `& '.\` then press Tab until the correct script file is visible:

   <figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2F5YiH2kagFiINDZVXSxnR%2FCapture%20d%E2%80%99e%CC%81cran%202026-07-03%20a%CC%80%2014.46.44.png?alt=media&amp;token=f7205bb2-f424-46c9-bec7-1088ab7906d1" alt=""><figcaption></figcaption></figure>
3. Press Enter.

</details>

<details>

<summary>PingCastle cannot be downloaded or the report cannot be uploaded</summary>

The machine must reach the three hosts listed in the [prerequisites](/prevention-tools/ad-scan/setup.md#prerequisites) over HTTPS, without SSL inspection. A proxy that inspects HTTPS traffic to the S3 buckets breaks the download link, even when DNS and TCP connectivity look fine. If that is already done:

* **The `PingCastle.exe` download stalls, then fails with 403** (or the config file downloads but not the `.exe`): a web filter blocks executable files. `PingCastle.exe` is about 230 MB.
* **"Upload failed for ad\_hc\_….xml"** (403 or "Unable to connect"): the firewall blocks uploads to the reports host. If only the `.html` upload failed, results show up but the report cannot be downloaded.
* **Downloading in a browser works, the script does not:** the proxy treats PowerShell traffic differently, usually because of SSL inspection.
* **You go through a proxy:** the script uses the Windows proxy settings. To force one, run it with `-Proxy "http://proxy:8080"`.

To test from the same machine, this command must answer `{"status":"ok"}`:

```powershell
Invoke-WebRequest https://api.prod.ad-scan.cyber.stoik.io/v1/public/health
```

</details>

<details>

<summary>"PingCastle has stopped working" or "No report files found"</summary>

PingCastle is an Active Directory audit tool, so antiviruses often flag it (for example as `Riskware.PingCastle`). Other signs: PingCastle stops with an exit code, or a check mentions that the antivirus may have deleted a file.

* Exclude the script, `PingCastle.exe` and the `C:\Temp\Stoik` folder, or pause the EDR during the scan.
* If your EDR is managed by Stoïk MDR, contact <protect@stoik.io>.
* To help Stoïk investigate, run the script again with `-PCDebug -KeepLog -NoDelete` and send the logs to <protect@stoik.io>.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/prevention-tools/ad-scan/setup-errors.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.