Posture Detectors

Posture detectors perform static analysis of your environment to determine its overall risk. Rather than establishing behavioral baselines from audit logs, as the Risk Radar do, they inspect the current configuration of your Active Directory environment and report findings that weaken your security posture.

To open Risk Radar, navigate to System Tools / Risk Radar.

Analysis Schedule

Posture analysis is performed once per day, starting five minutes after midnight. To run the analysis less frequently, increase the Risk Radar posture statistics interval in System Settings.

Available Posture Detectors

Note: The set of posture detectors expands regularly. The following list reflects the detectors available in this release.

Privileged Groups

  • Account Operators group has members—Account Operators has one or more direct user members.
  • Administrators group contains direct user members—Builtin Administrators contains one or more direct user members.
  • Backup Operators group has members—Backup Operators has one or more direct user members.
  • DnsAdmins group has members—DnsAdmins has one or more direct user members.
  • Domain Admins membership size exceeds baseline—Direct user membership in Domain Admins exceeds the configured baseline.
  • Enterprise Admins membership size exceeds baseline—Direct user membership in Enterprise Admins exceeds the configured baseline.
  • Nested privileged groups—Privileged group contains another group as a member.
  • Privileged group disabled account—Disabled account is present in a privileged group.
  • Schema Admins membership present—Schema Admins has one or more direct user members.
  • Server Operators group has members—Server Operators has one or more direct user members.

Kerberos

  • Account: Do not require PAC—Users with NO_AUTH_DATA_REQUIRED set.
  • Duplicate SPN detected—Multiple principals share the same SPN.
  • Preauthentication disabled on privileged account—Privileged account appears to have Kerberos preauthentication disabled.
  • Privileged account DES enabled—Privileged account appears to permit DES-based Kerberos encryption.
  • Privileged account RC4 only—Privileged account lacks AES support and appears to rely on RC4-only Kerberos encryption.
  • Privileged user has SPN—Privileged account configured with a service principal name.
  • SPN on disabled account—Disabled account still has one or more SPNs registered.
  • SPN with weak encryption—Service account with SPN uses weak Kerberos encryption settings.
  • Service identity not using gMSA—User-based service identity detected via SPN registration.
  • krbtgt password age exceeds threshold—krbtgt password appears older than the configured threshold.

Delegation

  • Account: Trusted to authenticate for delegation—Users trusted for protocol transition.
  • Computer protocol transition enabled—Computer account appears trusted to authenticate for delegation.
  • Constrained delegation includes CIFS on DC—Computer account delegates to CIFS service on a domain controller.
  • Constrained delegation includes LDAP on DC—Computer account delegates to LDAP service on a domain controller.
  • Constrained delegation to sensitive services—Computer account delegates to sensitive service classes such as CIFS or LDAP.
  • Delegation configured on domain controllers—Delegation-related configuration detected on one or more domain controllers.
  • Delegation enabled on workstation endpoints—Delegation-related configuration detected on workstation-class systems.
  • Unconstrained delegation on DC—Domain controller is configured for unconstrained delegation.
  • Unconstrained delegation workstation—Workstation is configured for unconstrained delegation.

Identity Hygiene

  • Password older than threshold—Account password appears older than the configured threshold.
  • Stale enabled account—Enabled account appears stale based on last logon timestamp threshold.
  • Stale enabled computer—Enabled computer appears stale based on last password change threshold.
  • User: Duplicate / temporary account flag set—Users with duplicate/temporary UAC flags.
  • User: Password never expires—User accounts with DONT_EXPIRE_PASSWORD set.
  • User: Password not required—User accounts with PASSWD_NOTREQD set.
  • User: Primary group set to Domain Admins—Users whose primary group is Domain Admins.
  • adminCount residue—Account retains adminCount=1 but is not currently in the privileged set.

Trusts

  • Bidirectional external trust present—An external trust is configured bidirectionally.
  • External domain trust present—One or more external domain trusts were detected.
  • Forest trust present—One or more forest trusts were detected.
  • RODC present in environment—One or more read-only domain controllers were detected.
  • SID filtering disabled on trust—An external trust appears to lack SID filtering/quarantine.