Posture checks
Every posture check, and how to fix it.
The checks GraphnAI runs on your directories, Active Directory and Microsoft Entra ID, after every sync. Each page gives the MITRE ATT&CK technique, what the check reads, its Tiered Fidelity level, and how Select Fire fixes it.
As of GraphnAI v0.5.1-rc.3, the current release.
All posture checks
- 87checks
- 8categories
- 35with a Select Fire fix
- Each failing check becomes a finding on the Security Posture page, with the steps to fix it.
- A check that can't see the data it needs reads Not assessed, never a pass.
No checks match these filters.
Account security 24
- Critical
Duplicate names hidden by invisible characters
Two or more objects in the same forest have the same name once invisible characters are removed and case is ignored. One disguises itself as the other.
- Critical
Invisible character in an account's name
The account name, user principal name or a service principal name contains an invisible character, such as a zero-width space. Real names don't contain these.
- Critical
Well-known privileged SID in sIDHistory
The account's sIDHistory holds a RID under 1000 from any domain (such as Domain Admins, 512) or a built-in administrative group (such as Administrators).
- High
Account storing its password with reversible encryption
The directory keeps a copy of the password that can be decrypted to plaintext. Checks enabled accounts only.
- High
Account without Kerberos pre-authentication
The domain controller returns an AS-REP for this account to anyone who asks, without checking who they are (AS-REP roasting). Checks enabled accounts only.
- High
Built-in operator group with members
Account Operators, Server Operators, Print Operators and Backup Operators grant rights that reach the domain controllers. Most domains don't need them.
- High
KRBTGT password older than 180 days
KRBTGT signs every Kerberos ticket in the domain. Anyone holding its key can forge a ticket for any account (a golden ticket).
- High
Privileged account with a password that never expires
The password-never-expires flag exempts the account from the domain's password expiry policy. Group managed service accounts (gMSAs) are excluded.
- High
Privileged account with a service principal name
Any domain user can request a service ticket for this account and crack its password offline (Kerberoasting). Group managed service accounts (gMSAs) are excluded.
- High
Standing members in Schema Admins
Members of Schema Admins can change the forest schema, which defines every object in the forest.
- High
User principal name disguised as another account's name
With invisible characters removed, the part of this user principal name before the @ matches another account's sAMAccountName (pre-Windows 2000 name) in the same forest.
- Medium
Account exempt from the password requirement
The password-not-required flag lets this account have a blank or short password, whatever the domain policy says. Checks enabled accounts only.
- Medium
Account restricted to DES encryption
The account uses only DES for Kerberos, a cipher broken decades ago. Checks enabled accounts only.
- Medium
Built-in Administrator password older than 180 days
This is the account with RID 500, even if it has been renamed.
- Medium
Built-in Administrator used in the last 14 days
The built-in Administrator (RID 500) is reserved for break-glass use.
- Medium
Computer or group nested in an administrative group
A computer account or group is a direct member of a Tier 0 administrative group. Every account inside it gets that group's privileges.
- Medium
Enabled privileged account with no recent logon
No logon has been seen within the inactive limit for the account's type: 90 days for users, 180 for service accounts, 30 for computers. Accounts with no recorded logon count as inactive.
- Medium
Forest with more than 50 privileged accounts
Every privileged account is a path to control of the forest.
- Medium
Privileged account password older than 180 days
Group managed service accounts (gMSAs) are excluded because they change their own passwords.
- Medium
Privileged account with an email address
The account's mail attribute is set. It can be set without a real mailbox behind it, so check whether one exists.
- Low
adminCount left set on a non-privileged object
An object has adminCount set to 1 but is no longer a member of any protected group. The flag is a leftover from past privileged membership.
- Low
Built-in Guest account enabled
The built-in Guest account (RID 501) needs no password.
- Low
Privileged account created in the last 10 days
The finding clears on its own once the account is 10 days old.
- Low
Smart card account with a password hash that never changes
When "Smart card is required for interactive logon" is set on an account, the domain sets its password hash once and never changes it. Checks enabled accounts only.
Cross-tier exposure 1
- Critical
Cross-tier credential exposure
A Tier 0 credential was seen on a computer where a lower-tier account holds rights that can steal it. Other tier pairs are not yet assessed, and computers in a domain with no logon collection aren't checked.
Delegation and Kerberos 15
- Critical
Constrained delegation to a sensitive service
This account may delegate to a service on a domain controller, a Tier 0 system, the domain's Kerberos service or the Microsoft Entra single sign-on computer account (AZUREADSSOACC).
- Critical
Directory synchronization account can replicate directory secrets
This account looks like a directory synchronization account, which needs to replicate password hashes. Confirm it is yours. It can read every password in the domain.
- Critical
Lower-tier account can set up delegation on a Tier 0 object
An account outside Tier 0 can change who may act on this object's behalf. It can let an account it controls authenticate to this object as anyone.
- Critical
Non-default account can replicate directory secrets
This account can copy every password hash from the domain, or can give itself that permission. Only domain controllers and the built-in administrator groups need it.
- High
Delegated managed service account can take over another account's keys
A delegated managed service account is linked to this account as its replacement, and accounts outside its owners can read its keys or control it. Through that link they receive this account's keys. This is the part of the 2025 BadSuccessor issue that Microsoft's fix does not close.
- High
Delegation with protocol transition enabled
This account may obtain access to its delegation targets on behalf of a user without that user authenticating with Kerberos. The setting is protocol transition.
- High
Exchange permissions group can change the domain's permissions
This group looks like the one Exchange creates, and it can change the domain's permissions. A 2019 Exchange update removes this right.
- High
Key credentials on, or writable to, a Tier 0 object
This Tier 0 object has key credentials, or an account outside Tier 0 can add them. A key credential lets its holder authenticate as this object without the password. Windows Hello keys look the same as an attacker's key, so every key is listed.
- High
Lower-tier account can change another account's service or logon name
An account outside Tier 0 can change this account's service names or logon name. Changing the logon name can let it obtain a certificate that authenticates as someone else.
- High
Managed service account password readable too broadly
Accounts that don't run this service can read its password.
- High
Unconstrained delegation on an account that is not a domain controller
This account is trusted for unconstrained delegation. Services running as it keep the credentials of every user who authenticates to them and can use those credentials anywhere.
- Medium
Account can add a service name to an account that has none
An account can add a service name to this account. That makes this account's password crackable offline from a Kerberos ticket.
- Medium
Other accounts can act on this object's behalf (resource-based constrained delegation)
This object lists other accounts that may request access to its services on behalf of any user. The setting is resource-based constrained delegation (RBCD).
- Medium
Service account allows the weak RC4 cipher for Kerberos
This service account allows RC4 for Kerberos tickets. Tickets encrypted with RC4 can be cracked offline. This check assumes your domain controllers have the July 2026 or later update and can't see a registry override on them.
- Low
Computer or trust account password may be guessable offline
Anyone who can reach a domain controller can ask it, without authenticating, for a time reply signed with this account's password, then try to guess the password offline. That works when the password isn't random.
Directory infrastructure 2
- High
Domain controller account left behind after decommission
A computer account still carries a domain controller's flags, but the controller is out of service. The account keeps every right of the Domain Controllers group until someone runs the metadata cleanup.
- Medium
Domain controller with no recent logon
The controller is still registered in the forest and still changes its machine password, but no logon has been seen for 30 days.
Group Policy 10
- Critical
Group Policy preference stores a password
A Group Policy preference item in SYSVOL stores an account password. GraphnAI recorded where it is, not the password.
- Critical
Lower-tier account can edit a Group Policy object that applies to Tier 0 computers
An account outside Tier 0 can change this Group Policy object, and the policy applies to domain controllers or other Tier 0 computers.
- High
Account can edit a Group Policy object that applies to more critical computers
An account can change this Group Policy object, and the policy applies to computers that are more critical than the account.
- High
Domain controllers accept LAN Manager or NTLMv1 authentication
No Group Policy sets these domain controllers to refuse LAN Manager and NTLMv1, so they accept both.
- High
Domain password policy stores passwords with reversible encryption
The domain password policy stores passwords with reversible encryption.
- High
Group Policy grants administrator-equivalent rights to a lower-tier account
This policy grants a right equivalent to administrator, such as debugging programs or backing up files, to an account outside Tier 0 or to a broad group.
- High
Group Policy sends LAN Manager or NTLMv1 responses
This policy lets computers send LAN Manager or NTLMv1 responses when they authenticate to other systems.
- High
Lower-tier account can link Group Policy above Tier 0 computers
These accounts can link Group Policy objects to the domain, or to a container above domain controllers or other Tier 0 computers. A linked policy runs on every computer below it.
- Medium
Group Policy allows LAN Manager password hashes to be stored
This policy turns off 'Do not store LAN Manager hash value on next password change'.
- Medium
Link-Local Multicast Name Resolution not turned off by Group Policy
No Group Policy turns off Link-Local Multicast Name Resolution for the Windows computers in this container.
Entra ID and hybrid 20
- Critical
Unapproved tenant can sync users into this tenant
A partner tenant that isn't on the approved list is allowed to sync users into this tenant.
- High
Admin account is controlled from on-premises
A synced account holds a tenant-wide admin role. Whoever controls its Active Directory source account controls the cloud admin.
- High
Admin role assigned permanently
This account or group holds an admin role at all times. With Privileged Identity Management, the role is active only after someone activates it.
- High
Admin roles aren't covered by a strong sign-in policy
Holders of at least one admin role aren't required to sign in with multifactor authentication or a stronger method. Security defaults or a Conditional Access policy should cover every admin role.
- High
Device code sign-in isn't blocked
Device code flow lets a user sign in on one device with a code entered on another. Attackers use it for phishing, because the victim completes the sign-in for them.
- High
Federated domain trusts the identity provider's multifactor check
A federated domain accepts the multifactor check done by its identity provider, so Microsoft Entra skips its own.
- High
Guest or external account holds an admin role
A guest or external account holds an admin role in this tenant. Exchange Administrator counts here because it can read every mailbox.
- High
More than five Global Administrators
Global Administrator can change any setting in the tenant and any other admin's access. Every extra holder is another account an attacker can use to take the tenant.
- High
No baseline sign-in protection
Neither security defaults nor a Conditional Access policy requires multifactor authentication for all users. A password alone signs a user in.
- High
Single sign-on computer account key is old
The AZUREADSSOACC computer account holds the Kerberos decryption key for Microsoft Entra single sign-on. Microsoft advises rolling that key at least every 30 days.
- High
Unapproved partner tenant's sign-in claims are trusted
A partner tenant that isn't on the approved list is trusted for multifactor or device claims, or redeems invitations automatically.
- High
Unexpected holder of a directory sync role
Directory sync roles are for the service account that Microsoft Entra Connect or cloud sync creates. Any other holder can write directory objects the way the sync service does.
- High
Users can approve app access themselves
Users can approve app permissions without an admin. This tenant allows user consent for all apps, or for apps flagged as risky.
- Medium
Every external tenant's sign-in claims are trusted
The default cross-tenant access settings accept multifactor or device claims from any Microsoft Entra tenant. This tenant then trusts how every other tenant signs in its users.
- Medium
Fewer than two Global Administrators
Microsoft recommends at least two cloud-only Global Administrator accounts. With one, losing that account leaves the tenant without anyone who can administer it.
- Medium
Global Administrator activation doesn't need approval
An account that is eligible for Global Administrator can activate the role in Privileged Identity Management without approval.
- Medium
Guests can invite other guests
Guest invite restrictions let anyone in the organization invite guest users, including guests. Outside accounts can then bring in more outside accounts without an admin.
- Medium
On-premises accounts can take over cloud accounts
Hard-match or soft-match protection is off, or Microsoft's temporary bypass of the July 2026 hard-match hardening is on. An on-premises account can then take over a cloud account that has no on-premises link.
- Medium
Users can register applications
Any user can register an application in this tenant. A registered application holds its own credentials and requests permissions that outlast the user's access.
- Low
Users can create new tenants
Non-admin users can create new Microsoft Entra tenants. The creator becomes Global Administrator of the new tenant, which sits outside your policies.
Workload and agent identity 13
- Critical
App service principal holds a Tier 0 admin role
This app's service principal holds a Tier 0 admin role, such as Global Administrator, either assigned or eligible in Privileged Identity Management.
- Critical
Credential added to a third-party app's service principal
A credential was added in your tenant to the service principal of an app another organization owns, or of an app whose owner Microsoft Entra doesn't name.
- Critical
Credentials on a Microsoft first-party service principal
A credential was added in your tenant to the service principal of an app Microsoft publishes.
- Critical
Service principal holds a tenant-takeover permission
This service principal holds an application permission that leads to Global Administrator, either directly or through another object such as an app, a group or a policy.
- High
App disabled by Microsoft still holds permissions
Microsoft disabled this app for violating its services agreement, which happens after suspicious, abusive or malicious activity. Its service principal still holds app role assignments or consent grants.
- High
Illicit or over-consented OAuth grant
An app whose publisher isn't verified has consent to sensitive data: a tenant-wide grant that stays valid while no one is signed in, or the same kind of grant from many users.
- High
Long-lived service principal credential
An app your organization owns signs in with a credential that stays valid for more than 12 months, or 24 months for a certificate, or holds more than two active secrets.
- High
Non-privileged owner of a privileged app or service principal
Someone who isn't a Tier 0 administrator can add a credential to a privileged app, as its owner or through an admin role that manages app credentials.
- Medium
Dormant service principal is still privileged
A privileged app's service principal hasn't signed in for a long time, but it still holds its access.
- Medium
Privileged app registration with no active owner
No enabled user or service principal owns this app registration, though its service principal is privileged.
- Medium
Privileged service principal authenticates with a secret
A privileged app can sign in with a client secret, a password that can be copied and replayed from anywhere.
- Medium
Service account can log on interactively
An enabled service account with a service principal name has no Log On To restriction, so it can log on at any computer in the domain. Group managed service accounts are excluded.
- Medium
Service principal has more permissions than its peers
This service principal holds more permission weight than other service principals of the same kind in your tenant, by more than two standard deviations.
Certificate Services 2
- Critical
Certificate template where the requester chooses the subject
A certificate template permits client authentication and allows the requester to supply the subject name, while enrollment is open to a broad set of principals.
- Critical
Certification authority objects controlled by non-administrators
A principal outside the Tier 0 administrative set holds permissions over an enterprise certification authority object or the certificate configuration containers.
Detection rules for the attacks these exposures invite Fidelity tiers, attack paths and posture
MITRE ATT&CK® technique names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.