Builtin Administrator Audit

This is an interactive task that performs an audit against the builtin Administrator account on Active Directory.

Several parameters from the following Microsoft security guide are checked during the audit.

Playbook Files

This playbook was built for PPA version 3.3

# The task was built to work with these plugin versions.
plugins:
  ppa: ^11.4
  hashicorp_vault: ^8.0
  active_directory: ^13.0


steps:


  - name: Intro
    actions:

      - ppa.ui.output_markdown:
          doc: >
            {{ globals.icons.active_directory.full }}


            ### Builtin Administrator Audit


            This task reports on Administrator account security in Active Directory.


            The following information will be audited:


            - Account state

            - Password state

            - User Account Control flags


            __Note:__ see this Microsoft <a target='_blank' href='https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-d--securing-built-in-administrator-accounts-in-active-directory#appendix-d-securing-built-in-administrator-accounts-in-active-directory-1'>security guide</a> for more information.

      - ppa.ui.input_accept:
          text: Start


  - name: Get Secrets
    actions:

      - hashicorp_vault.key_value.read_secret_keys:
          secret: active_directory
          reason: Getting Active Directory details
          keys:
            - name: address
            - name: domain
            - name: username
            - name: password
              sensitive: true
          create_missing: true
        save: domain_controller


  - name: Find Administrator Account
    actions:

      - active_directory.users.search:
          search_params:
            sAMAccountName: Administrator
        load:
          domain_controller: domain_controller
        save: search_result


  - name: Exit If No Administrator Account
    when: search_result.total == 0
    actions:

      - ppa.ui.output_info:
          text: No builtin Administrator account was found on the domain, goodbye!

      - exit:
          exit_code: 0


  - name: Audit Administrator Account
    actions:

      - ppa.ui.output_progress:
          text: Auditing builtin Administrator account...
          percent: null
          element_id: auditing_builtin_administrator

      - set:
          name: administrator
        load:
          value: search_result.first

      - active_directory.users.has_reversible_password:
        load:
          distinguishedName: administrator.distinguishedName
          domain_controller: domain_controller
        save: password_reversible

      - active_directory.users.password_will_expire:
        load:
          distinguishedName: administrator.distinguishedName
          domain_controller: domain_controller
        save: password_will_expire

      - active_directory.users.password_has_expired:
        load:
          distinguishedName: administrator.distinguishedName
          domain_controller: domain_controller
        save: password_has_expired

      - active_directory.users.can_be_delegated:
        load:
          distinguishedName: administrator.distinguishedName
          domain_controller: domain_controller
        save: can_be_delegated

      - active_directory.users.smart_card_required:
        load:
          distinguishedName: administrator.distinguishedName
          domain_controller: domain_controller
        save: smart_card_required

      - ppa.ui.output_progress:
          text: Audited builtin Administrator account
          percent: 100
          element_id: auditing_builtin_administrator


  - name: Display Audit Report
    actions:

      - ppa.ui.output_markdown:
          doc: >
            ## Builtin Administrator Account


            ### Account State


            The account is {{ '**enabled**' if administrator.is_enabled else '**disabled**' }} & {{ '**locked**' if administrator.is_locked else '**unlocked**' }}.


            Its credentials {{ '**can be delegated**' if can_be_delegated else 'cannot be delegated' }}.


            A smart card {{ 'is required' if smart_card_required else '**is not required**' }} for interactive logon.


            Its password {{ '**is reversible**' if password_reversible else 'is **not reversible**' }} & {{ 'has an expiry' if password_will_expire else 'will **never expire**' }}.


            The password {{ '**has expired**' if password_has_expired else 'has **not expired**' }} & is {{ administrator.password_age.days or 'N/A' }} days, {{ administrator.password_age.hours or 'N/A' }} hours, & {{ administrator.password_age.minutes or 'N/A' }} minutes old.


            For more information see this Microsoft <a target='_blank' href='https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-d--securing-built-in-administrator-accounts-in-active-directory#appendix-d-securing-built-in-administrator-accounts-in-active-directory-1'>security guide</a>.

Running this Playbook

Click download playbook
Import the playbook on the Playbooks page in PPA
Build the playbook from the Edit & Build tab
Run the playbook from the Preview & Deploy tab

Integrations

PPA User Interface
Hashicorp Vault Key-Value engine
Active Directory Users

Required Vault Details

Active Directory

IP/DNS address of a Domain Controller
Domain FQDN
Username
Password

The Active Directory credentials require permission to read user account information.

Vault Configuration Wizard

The first time you run a task built from this playbook, PPA will check the required Vault details exist.

If they don't exist, PPA will ask you to supply the details at the start of the task.

Below you can see a user providing details the first time they run an Active Directory task.

vault-config-wizard

Once the details are added to Vault, the task won't ask for them again.

If you don't know the required details, ask an administrator to run the task or configure Vault manually.

What the Task Does

Once started, this task will:

Find the builtin Administrator account in Active Directory
Audit several account attributes & UAC flags
Generate a report based on this Microsoft security guide.

See our other playbooks

Get PPA for free!

Start automating your estate with a free 30 day trial today. No signup required!

Get PPA Express

Documentation

Installation Guide
See how easy it is to get started with our installation guide
Playbooks
View our task writing reference guide
Plugins
See how to integrate with different systems using our plugins reference guide.