Suggestions for improving Active Directory reports

[rebelinux]

In this thread, share any suggestions and ideas that could improve the report!

[klwood2000]

rebelinux,
Thank you for this. Here are the suggestions I have for the report. Some may be spawned out to separate as-built reports or tied into the AD report. I'll let you determine how best to handle these.

1. DHCP loaded on Domain controllers - This breaks security best practices. This should be called out in the report.
2. DNS Scavenging - Can you add something about whether this has been enabled on zones and the server and what the length of time records can stay in DNS?
3. Certificate Services - You have a great diagram and some information, but could you call out or have a note as to whether they are using single or multi-tier PKI? It may be hard if they are using an offline root, but there should be a way to decipher this. Additionally, if their root is domain joined, this should be called out as a security issue.
4. Is there any way to add additional information for certificate services? Certificate age, length of issue, CRL lengths, etc. I'm also not sure if it generates any warnings about the expiration of certificates (i.e. root has 6 months remaining)
5. Hyper-V report - I've developed one via vibe coding, but I'd like to see what you can build comparable to the VMware-Asbuilt. That document comes in handy more times than not and with the Broadcom moves of late, having a Hyper-V report will become beneficial as more users move over.

Please let me know if you have any questions,
Kevin Wood

[rebelinux]

Hello,

Thanks for the suggestions.

1. DHCP loaded on Domain controllers - This breaks security best practices. This should be called out in the report.

• In this requirement, do you mean that the DC has an IP address assigned by DHCP? Can you provide more details?

2. DNSScavenging - Can you add something about whether this has been enabled on zones and the server and what the length of time records can stay in DNS?

• If the DNS InfoLevel is set to 2 or higher the Scavenging information is retrieved for the Server and its zones:
  https://github.com/AsBuiltReport/AsBuiltReport.Microsoft.AD?tab=readme-ov-file#pencil2-configuration

Server:

Scope:

3. Certificate Services - You have a great diagram and some information, but could you call out or have a note as to whether they are using single or multi-tier PKI? It may be hard if they are using an offline root, but there should be a way to decipher this. Additionally, if their root is domain joined, this should be called out as a security issue.

• I will evaluate what I can do to add this information to the report.

4. Is there any way to add additional information for certificate services? Certificate age, length of issue, CRL lengths, etc. I'm also not sure if it generates any warnings about the expiration of certificates (i.e. root has 6 months remaining)

• If the CA InfoLevel is set to 1 or higher, the section can be enabled (disabled by default) and the PKI information will appear in the report.

Infolevels

CA Section Report Example

https://github.com/rebelinux/IMG/blob/e4a8e53ccea050b42c1ee4d88cfb919ae5fd6152/Microsoft%20Active%20Directory%20As%20Built%20Report.docx.pdf

5. Hyper-V report - I've developed one via vibe coding, but I'd like to see what you can build comparable to the VMware-Asbuilt. That document comes in handy more times than not and with the Broadcom moves of late, having a Hyper-V report will become beneficial as more users move over.

• The report you created is based on AsBuiltReport?
• The Windows AsBuiltReport have a section for HyperV:
  https://github.com/AsBuiltReport/AsBuiltReport.Microsoft.Windows

[klwood2000]

rebelinux,

Sorry for the delayed response.

1. DHCP - Calling out a Domain Controller running a DHCP address may already be covered, but if not, would be good to call out. I wanted to raise a notice if the Domain Controller was running the DHCP Server service. Per security protocol, DHCP Server services should be running on a server separate from a domain controller.
2. DNS Scavenging - Perfect, I'll try that level and see what the report produces.
3. Thank you
4. Again, I'll try the info level and see if that reports what I need.

Another suggestion I had, and it may already be available, is showing the DHCP pools and their current consumption. It would be interesting to see where DHCP pools are close to running out of addresses.

Thank you and I appreciate the openness for suggestions!

Kevin Wood

[rebelinux]

1. I will add this suggestion to the Infrastructure Services area.

"Another suggestion I had, and it may already be available, is showing the DHCP pools and their current consumption. It would be interesting to see where DHCP pools are close to running out of addresses."

• AsBuiltReport.Microsoft.Windows covers this request from the perspective of a single server, and AsBuiltReport.Microsoft.DHCP is used to document the DHCP server across the forest: https://github.com/AsBuiltReport/AsBuiltReport.Microsoft.DHCP.

Thanks!