Protected Users blocks NTLM, DES/RC4, delegation and credential caching for its members, with no per-account exceptions. An admin account that still depends on any of these can no longer sign in once it is added. ADPU-Analyzer reads the directory and the domain controllers' event logs and reports for each privileged account:
- clear to enrol, with the strength of the evidence (proven, plausible, unknown)
- blocked, and why (NTLM use, no AES keys, RC4, delegation, running services or tasks, …)
- what it could not see (auditing gaps, unreachable controllers)
- whether it held after enrolling (
-Verify)
It changes nothing. It prints the commands for you to run, including the rollback.
.\ADPU-Analyzer.ps1 # pick a domain interactively
.\ADPU-Analyzer.ps1 -Domain corp.example.net -Days 30 -HtmlPath .\report.html
.\ADPU-Analyzer.ps1 -Identity alice, 'CORP\bob' # check single accounts
.\ADPU-Analyzer.ps1 -Verify -Days 7 # after enrollingRequires Windows PowerShell 5.1+ or PowerShell 7, WinRM to the domain controllers, rights to read their Security log, and Logon, Kerberos Authentication Service and Credential Validation auditing. RSAT is not needed.
Tip
Enrol one account first and confirm it still signs in end to end before doing the rest.
- What it checks: blockers, hints, and what no tool can clear you of
- How the verdict works: confidence levels, scoping, break-glass accounts, the krbtgt trap
- Setup & auditing: requirements and the audit policy it needs
- Usage: all parameters, automation and exit codes, post-enrolment verification
- Limitations: read this before you trust a green verdict
- Development: repository layout and tests
Note
Parts of the code and documentation were written with Claude (Anthropic). I defined the requirements, reviewed the results and tested everything in a real Active Directory environment. Review it before running it in production.
MIT · Made by Carbon/Nobrac