performing-active-directory-vulnerability-assessment

Run PingCastle with the --healthcheck flag against your domain, collect data with SharpHound for BloodHound attack path analysis, and execute Purple Knight for a posture score. Cross-validate findings across at least two tools before reporting.

PingCastle scores domain health across stale objects, privileged accounts, trusts, and anomalies. BloodHound maps attack paths to privileged groups using graph queries. Purple Knight checks 130+ security indicators and produces an overall posture score.

Use the PowerShell command Get-ADUser filtered on ServicePrincipalName to list accounts with SPNs, or run the BloodHound Cypher query matching users with hasspn:true who belong to admin groups. Validate the account is enabled and crackable before rating it Critical.

A domain-joined workstation with a standard domain account covers basic collection, but read access to AdminSDHolder, GPOs, and session data is needed for complete results. Purple Knight and full PingCastle scans work best with domain admin or equivalent read rights.

Single collections capture only a snapshot, so live admin sessions that change constantly are missed, and single-domain collection ignores trust-based paths. Re-run SharpHound near the assessment window and enumerate all domains and trusts.

Read-only scope without sufficient rights causes PingCastle and SharpHound to miss ACLs and session data. Validate the scan account can read AdminSDHolder, GPOs, and session information, and confirm delegation findings are on reachable non-DC hosts.