Kerberos and legacy check for Active Directory | PowerShell script | Delegation, SMBv1, NTLM | Read-only report | German

A PowerShell script that checks an Active Directory and its domain controllers for known vulnerabilities in 26 areas – Kerberoasting, delegation, weak encryption, SMBv1, NTLMv1, unsigned LDAP, passwords in group policies – and generates a clear HTML report in German, with explanation and recommendation for each finding.

THIS IS INCLUDED
• PowerShell script Kerberos legacy check.ps1 (open source code, commented)
• Instructions as PDF
• Sample report of a test domain (HTML)

THE SCRIPT ONLY WORKS IN READING TIME
It makes no changes to Active Directory or the servers, requests no tickets, tests no passwords, and transfers no data. Anything that cannot be queried appears in the report as a finding and is never implicitly considered OK.

THE 26 CHECKPOINTS
• Kerberos and Delegation: Old password of the account krbtgt; Administrator accounts with SPN (Kerberoasting); Service accounts with SPN and old password; Kerberos pre-authentication disabled (AS-REP roasting); Unrestricted delegation outside of domain controllers; Delegation with protocol transition; Resource-based delegation; Accounts without AES (DES or RC4 only); Administrator accounts that may be delegated
• Legacy issues in the directory: adminCount remnants; Any user is allowed to create computer accounts; "Pre-Windows 2000 compatible access" with Everyone or Anonymous; Anonymous LDAP queries allowed; Accounts with SID history; Pre-created computer accounts without password requirements; Passwords in Group Policy (SYSVOL)
• Legacy protocols on domain controllers: SMBv1 active; SMB signing not enforced; LDAP signing not enforced; LDAP channel binding not always enforced; NTLMv1 is assumed; LM hashes are stored; Anonymous access with "Everyone" rights; Print queue running; Kerberos not restricted to AES; LDAP signing not explicitly set on Windows Server 2025

REQUIREMENTS
• Windows PowerShell 5.1 and the Active Directory module (present on domain controllers, otherwise RSAT)
• Part 1 with a normal domain account; Part 2 (domain controller settings) with administrator rights
• Tested with Windows PowerShell 5.1 on Windows Server 2025 in a test domain with two domain controllers, as an administrator and as a regular user; checkpoints were triggered with simulated errors. The SID history could not be reproduced. The rules for domain controllers up to Windows Server 2022 (NTLMv1, LDAP signing, installed SMBv1 functionality) could only be tested using predefined values, not on actual older servers.

FOR WHOM
Administrators and IT service providers who want to harden an existing Active Directory or prepare for an audit by insurance companies, customers, or auditors.

GOOD TO KNOW
• Digital download (ZIP and PDF) – no physical product will be shipped
• Language of script output, report and instructions: German
• The report identifies anomalies based on fixed rules; it does not replace security audits or monitoring.
• Use within your own company or for your own customers; no resale
• Use at your own risk

Note: Content and structure originate from the seller; AI tools were used to assist in its development. All content has been professionally reviewed by the seller.