PingCastle¶
Synopsis: Commercial Active Directory (and Entra ID) security assessment tool — audits an AD environment and produces a risk score with a detailed report.
PingCastle (now maintained by Netwrix) quickly collects information from an Active Directory environment and evaluates it against a rule-based model to produce a risk assessment. The score is broken down into four categories — Stale Objects (object lifecycle: old computers/users, delegation), Privileged Accounts (administrators and other privileged accounts), Trusts (links to other Active Directories, which can be an attack path between forests), and Anomalies — each scored 0–100, with the highest of the four determining the overall domain risk level. A scan produces both an HTML report (for human review, with visualizations and remediation guidance) and an XML report (machine-readable, for consolidation/automation).
It's a commercial product with three licensing tiers: a free Community edition for auditing your own environment (no support, no reselling/auditing of third parties), a Service Providers edition required for auditing other organizations commercially, and an Enterprise edition (a centralized web app with continuous scanning, history, and reporting across many domains, aimed at larger environments). The internal repository above tracks how we run and license PingCastle internally.
Usage examples:
PingCastle.exe --healthcheck --server contoso.local
.\Export-CheckList.ps1 -OutputFile "C:\Temp\PingCastle.xlsx"
Export-CheckList/Export-CheckList.ps1, which
turns a PingCastle XML report into an XLSX checklist (via the ImportExcel
module) for tracking remediation of the findings over time. -Path points
at the PingCastle XML report, -OutputFile at the XLSX file to create.