ADPulse 🩺

A zero-dependency PowerShell toolkit for Active Directory health checks and security auditing.

No agents. No installs. No third-party tools. Just PowerShell and built-in Windows utilities — drop it on any Domain Controller and run.

---

What It Does

ADPulse gives you two scripts that generate self-contained HTML reports you open in any browser:

Script	Purpose
DC-HealthCheck-Full.ps1	Full Domain Controller health check across all DCs in your domain
AD-AccountAudit.ps1	AD account and security audit — finds hygiene issues and risks

---

DC Health Check — What It Covers

Runs remotely against all DCs in your domain from a single execution:

• FSMO Roles — which DC holds each role, confirms all are online
• AD Replication — repadmin /replsummary + per-DC repadmin /showrepl with collapsible detail
• Time Synchronization — source, stratum, offset per DC — flags drift over 30s/180s
• SYSVOL & NETLOGON — share availability on every DC
• DNS Health — dcdiag /test:dns per DC with false positive suppression
• DCDiag — full diagnostic suite per DC, parsed into pass/warn/fail counts
• Critical Services — Netlogon, ADWS, DNS, KDC, DFSR, W32Time on every DC
• Uptime & OS — last boot time and Windows version per DC

Smart loopback detection — when running on a DC that is also being checked, the script automatically runs local checks instead of remote to avoid SMB loopback timeouts.

---

AD Account Audit — What It Covers

Queries your entire domain and flags:

#	Check
01	Currently locked accounts
02	Inactive accounts (no logon in 90+ days)
03	Accounts that never logged in
04	Password never expires flag
05	Passwords older than 180 days
06	Disabled accounts still in security groups
07	Privileged group memberships (Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators)
08	Stale admin accounts — privileged users inactive 90+ days
09	Admin accounts with password never expires
10	Detected service accounts
11	User distribution by OU with activity bar
12	Accounts expiring in the next 14 days

Also includes a Management Summary at the top — plain English bullet points you can paste directly into an email or report.

---

Requirements

• Windows Server with Active Directory Domain Services role
• Must be run on a Domain Controller
• Must be run as Domain Admin
• PowerShell ActiveDirectory module (included with AD DS, no install needed)
• No WinRM configuration required beyond default DC-to-DC settings

---

How to Run

1. Copy the script(s) to your Domain Controller desktop
2. Open PowerShell as Administrator
3. Run:

PowerShell -ExecutionPolicy Bypass -File ".\DC-HealthCheck-Full.ps1"

PowerShell -ExecutionPolicy Bypass -File ".\AD-AccountAudit.ps1"

The HTML report is saved automatically to your Desktop and opens in your default browser when done.

Note on Execution Policy: -ExecutionPolicy Bypass only applies to that single execution. Nothing is changed permanently on your system.

---

Report Output

Both scripts generate a self-contained HTML file — no external dependencies, no internet required to view. The file can be:

• Opened in any browser
• Emailed to management or colleagues
• Archived for compliance records
• Compared against previous runs to track changes over time

Reports are saved to %USERPROFILE%\Desktop\ with a timestamp in the filename:

DC-HealthCheck-Full-2026-03-26_09-41.html
AD-AccountAudit-2026-03-26_12-29.html

---

Known Behavior & False Positives

DNS Auth Test

The dcdiag /test:dns Authentication sub-test will always fail when run without explicit credentials. This is a known artifact — ADPulse automatically suppresses this from the FAIL logic and notes it in the report. All other DNS sub-tests (Basic, Forwarders, Delegation, Dynamic, RReg) are still evaluated.

DCDiag OutboundSecureChannels

This test only runs when /testdomain: is explicitly passed to dcdiag. ADPulse excludes it from the pass/fail count since it is always skipped.

Loopback Checks

When running from HADITHDC1 for example, dcdiag tests like SysVolCheck, NetLogons, and Services can fail with error 121 (semaphore timeout) when the script tries to connect to HADITHDC1 remotely from itself. ADPulse detects the local DC and runs these checks locally, eliminating the false failure.

---

Thresholds (configurable at top of each script)

Variable	Default	Description
$InactiveDays	90	Days before an account is considered inactive
$OldPasswordDays	180	Days before a password is considered old
$ExpiringInDays	14	Days ahead to warn about expiring accounts

---

Folder Structure

ADPulse/
├── scripts/
│   ├── DC-HealthCheck-Full.ps1     # Domain Controller health check
│   └── AD-AccountAudit.ps1         # AD account & security audit
├── reports/                        # Drop your generated HTML reports here
├── docs/
│   └── screenshots/                # Screenshots for documentation
├── README.md
└── CHANGELOG.md

---

Roadmap

Planned scripts for future releases:

• GPO-Audit.ps1 — GPO inventory: unlinked, empty, last modified, settings export
• ComputerAudit.ps1 — Stale computer objects, OS version breakdown, inactive machines
• GroupMembership.ps1 — Full privileged group membership report with nested group expansion
• ADHealthTrend.ps1 — Scheduled runner that appends results to a log for trend tracking

---

Contributing

Pull requests welcome. If you find a false positive, a check that behaves differently on your environment, or want to add a new check — open an issue or PR.

---

License

MIT License — free to use, modify, and distribute.

---

Author

Naif Asiri — @Naif-Asiri

Built by a sysadmin, for sysadmins. Tested on Windows Server 2019 and 2022 with single-domain multi-DC environments.

If this saved you time, a ⭐ on the repo is appreciated.