Warning
As of v4 of this module, it requires Pester v5 or greater. If you're on an earlier version of this module and can't upgrade Pester, stay on the v2.x releases.
This project contains a PowerShell module named ADAudit with cmdlets for retrieving and exporting detailed information about the configuration of an Active Directory forest. The module also contains a set of Pester tests that can be used to validate whether any configuration drift has occurred as well as perform a series of health tests of AD.
The validation of AD configuration drifts works by you initially using Get-ADConfig | Export-ADConfig -AsGoldConfig to generate a current "known-good state" snapshot of the configuration of AD. After this you can use Test-ActiveDirectory, or run the ActiveDirectory.Checks.ps1 file directly (via Invoke-Pester) to compare the known good state to the current AD state (or a previously retrieved snapshot of the state).
This code builds on the Active Directory Operational Test work of Irwin Strachan (@IrwinStrachan) which he has detailed here:
This module is published in the PowerShell Gallery, so can be installed via:
Install-Module ADAudit -Scope CurrentUser
This module requires the following modules be installed/available:
- ActiveDirectory
- Pester (minimum version 5.0)
Execute to retrieve the current AD configuration as a PowerShell object.
Use to export the current AD configuration to an XML file. If you're saving the current known-good state, use -AsGoldConfig to have the exported configuration prefixed with GoldConfig-.
Execute to perform the following tests:
Active Directory configuration checks
- Various checks of the config between what has been stored previously and what has been captured now to detect configuration drift.
Active Directory health checks
- Runs NLTest /Query and checks the output for "Success"
- Runs DCDiag -a and checks the output for "failed"
- Runs RepAdmin /showrepl and checks each replication for the "Number of Failures" count being > 0
- Performs a Ping against each listed DC (per config)
- Tests that common AD ports respond locally: (53,88,135,139,389,445,464,636,3268,3269,9389)
- Checks that common AD services are running: ("ADWS","BITS","CertPropSvc","CryptSvc","Dfs","DFSR","DNS","Dnscache","eventlog","gpsvc","kdc","LanmanServer","LanmanWorkstation","Netlogon","NTDS","NtFrs","RpcEptMapper","RpcSs","SamSs","W32Time")
- Checks the SRV DNS records for _ldap.tcp.domainname and _kerberos.tcp.domainname
Use -Tag or -ExcludeTag to run a subset of the above, e.g. Test-ActiveDirectory -ExcludeTag ADHC to compare configuration only and skip the live health checks (useful on a host that isn't AD-connected, or doesn't have the AD administrative tools installed).