Spot weaknesses in Active Directory before attackers do.

Active Directory (AD) holds the “keys to the kingdom,” and if not safeguarded properly, it will compromise your entire security infrastructure. Purple Knight is a free Active Directory security assessment tool built and managed by an elite group of Microsoft identity experts.

Active Directory and Azure AD is typically at the core of any organization’s security. At a basic level it is a primary mechanism for authenticating users and determining which network resources they can access. An important question here is when is the last time you audited your Active Directory? Check out podcast episode below.

“We were able to harden our Active Directory like never before – making sure it’s absolutely secure.” – VP of IT at AMOCO

What’s in the report and what does it look like?

This example report summarizes the Active Directory security assessment results performed by the Semperis Purple Knight tool. The assessment performed includes querying your Active Directory environment and running a series of security indicator scripts against domains in the selected forest. This assessment represents opportunities for enhancing this Active Directory environment from a security perspective in accordance with industry best practices. Click here for a sample Purple Knight report.

Use Cases:

• Active Directory Audit – Organization is preparing or recently paid for an IT audit and need a second tool
• Recent acquisition – visibility of their Active Directory before trusting or migrating a forest into your own
• Need more data for compliance reporting
• Another method to expand risk prevention

Tool Auditing Overview

• Active Directory Security Report Card
• Pre and Post Attack Security
• Community Driven Threat Models
• Prioritized, Actionable Guidance
• MITRE ATT&CK Correlation

Tool Highlights

• Simple download and execute; Domain Admin NOT required
• Scans Active Directory within connected enterprise domain
• Creates snapshot report of a “point in time” status & vulnerabilities
• Currently includes 70+ IOCs (compromise) and IOEs (exposure) based on MITRE ATT&CK framework
• Report output maps known vulnerabilities to a Risk Score (High, Med, Low) with description of vulnerabilities
• Suggests prescribed remediation activity for each IOC/IOE identified.
• Typically it takes less than 15 minutes

To get started, chat in the lower right or email info@mobiuspartners.com. We have an entire podcast episode dedicated to this topic: mobiuspartners.com/podcast. To see an overview of our Security expertise, please visit here.