Tools · Active Directory defense · 19 / 23
How to run a PingCastle Active Directory health check and act on the report
Run PingCastle’s health check as a regular user, read the four risk categories, and turn the top findings into a short remediation plan.
What PingCastle does
PingCastle is a free-for-internal-use AD auditing tool that runs as an ordinary domain user and produces an HTML report scoring four areas: stale objects, privileged accounts, trusts, and anomalies. Each finding links to an explanation and remediation guidance, and the overall score is the worst of the four.
Because it uses read access that every user has, the report also shows how much an attacker with a single compromised account can learn.
Lab: run the health check
Download PingCastle from its official site onto a lab workstation, run it, choose healthcheck, and accept the detected domain. It writes ad_hc_domain.html and an XML file. Open the HTML report, sort findings by points, and read the top ten.
Your planted mistakes from earlier tutorials, such as the account without pre-authentication and the weak service account, should appear.
PingCastle.exe --healthcheck --server lab.internal # outputs ad_hc_lab.internal.html and .xml
From report to plan
Pick findings that are high in points and low in effort first: disabling the Print Spooler on DCs, removing accounts from privileged groups, clearing risky flags, enabling the Recycle Bin, and setting ms-DS-MachineAccountQuota to 0. Then plan larger items like krbtgt rotation, LAPS rollout, and NTLM reduction.
Each item should have an owner and a target date. Rerun the health check monthly and compare scores.
Handling the report
The report is a map of your weaknesses. Store it with restricted access and do not email it widely.
Commercial and other free tools, such as Purple Knight, provide similar checks. Using two occasionally catches gaps in either.
Diagram
PingCastle risk categories
The overall score is the worst of the four.
- Stale objects
Old accounts, obsolete OSes, unused settings.
- Privileged accounts
Admin group size, protections, delegation.
- Trusts
Trust relationships and SID filtering.
- Anomalies
Risky settings like Spooler on DCs or GPP passwords.
Check yourself
1. What privileges does PingCastle’s health check need?
2. How is the overall PingCastle score determined?
3. Why restrict access to the report?