claudiomerola/adxray

Active Directory's Health Check script that generates a full HTML report of the environment's health, security and status based on Microsoft's Best Practices.

Active Directory xRay Script

The script does not record, create or modify anything in the environment (except for creating a folder named “ADxRay” in C:\ of the computer running the script. Inside that folder the log files and the main report file named “ADxRay_Report(YEAR-MONTH-DAY).htm” is created).

The script must be run at a Domain Controller running at least Windows Server 2012 (see requirements below).

The script must be run by a user with Domain Admin privileges (Enterprise Admins if dealing with multiple domains and forests).

This script may take several hours to complete!

How to run:

Just copy or download the ADxRay.ps1 and run on any computer that meets the requirements below.

Requirements:

The script must be run with the following requirements:

• Must be run on Domain Controller (due to the tools used during the inventory)
• Must be run with rights to read objects in the entire forest and run AD Tools (dcdiag, SETSPN, dsquery, GET-AD*)
• Must be run with elavated Powershell (Run as Administrator) - This is necessary to create the folders to keep the files generated
• Internet connection is not required*

Internet connection might be use by the script for version validation, but is not a requirement.

What the script does:

This script will create the folder C:\ADxRay and run a deep inventory of your entire Active Directory environment, indicating what’s bad and what’s good. All the tests and validations are explained and contains external links to official Microsoft documentation and/or well know blog post from MVPs.

The Inventory phase of the script may take a long time to run depending on the size of the environment.

Even the script may overload the server used to run, it is not harmful to the environment. The users will not be affected and no modifications will be made in the environment (there is not a single “set-” powershell command and the only “new-“ were regarding the creation of the html report file and the xml inventory files)

Screenshots:

User and Computer Account's health:

Group Policy Validations:

Domain Controller's Health:

Domain Controller's NTP and DNS Configuration:

Domain Controller's Security Policy Status (against Microsoft's Best Practices):

Domain Controller's Hardware Inventory:

Domain Controller's Software Inventory:

adxray's Issues

SMBv1 Incorrectly detect as enabled on Windows Server 2022

It appears that SMBv1 is being incorrectly detected an "enabled" in reports, when run against a Windows Server 2022 domain controller.

Getting SMB protocol information via Powershell confirms it is disabled:

PS> Get-SmbServerConfiguration | Select EnableSMB1Protocol

EnableSMB1Protocol
------------------
             False

General Inventory / RSOP Inv Issue

Running version 6.0.2 and getting General Inventory and RSOP Inventory failures in the script.
This doesnt display any of the DC, Users or Group information in the "Domains section"
This doesnt display anything information in the Domain Controllers, Security and Hardware / Software Sections

Let me know what you need to help debug this

DC Inventory

Hello,

First of all great script, I run it in my environment but I can't get it to generate the DC inventory section.

Happy bug hunting!

Domain Controller report is blank

Hi Claudio,

However, the script works fine in small environments when run in larger and complex forests. (i.e. more than 50 DCs)
The Domains tab shows zero domain controllers. Additionally, the Domain Controllers, Security, and Hardware/Software Reporting tabs are blank and display no results.
The log shows no errors. There are few warnings and messages.
My Forest/Domain Function level : 2012R2
OS under Forest : Mix of 2016 and 2019 ( On prem, Azure, AWS)

Errors in Script

Hello, was looking forward in running this script on my lab DC but encountered these errors: Did I forget to do something?

Mike D.

Issues.txt