We value your privacy

We use cookies to analyse site traffic and improve your experience. You can accept all cookies or reject non-essential ones. See our Privacy Policy for details.

GR IT SERVICES
  • Contact
Get a quote
  2. Audit and compliance
  3. Active Directory security audit
Active Directory security audit, UAE

Your Active Directory was built years ago and never reviewed since.

It still authenticates everything, it has accumulated a decade of accounts, groups and delegations, and an attacker who reaches it reaches everything. We audit what is actually in your directory, not what the documentation says, and we start with the findings that would matter tomorrow.

Book an Active Directory auditSee what we examine
Active Directory security audit for UAE organisations
  • Still the targetCompromise AD, own the estate
  • Windows LAPSFree, built in, usually not deployed
  • Legacy LAPSDeprecated since Windows 11 23H2
  • Hybrid includedEntra Connect is in scope too
What we examine

Eight areas, ordered by what an attacker would reach for first.

An Active Directory audit is not a health check of replication and DNS, useful though those are. It is an assessment of the paths by which an ordinary user account could become a domain administrator, and of the accumulated decisions that make those paths shorter than anyone realises.

Privileged groups, and everyone who is quietly in them

Domain Admins, Enterprise Admins, Schema Admins, Account Operators, Backup Operators and the built-in Administrators group, plus every nested group inside them. Nesting is what hides the real number: a group added years ago for a project can carry a dozen accounts nobody would list if you asked. We resolve membership fully rather than reading the top level.

Delegation and the permissions granted along the way

Rights delegated on organisational units so a helpdesk could reset passwords, permissions granted to a service account during an installation, and access control entries that nobody has looked at since. Individually each was reasonable. Collectively they often create a route from an ordinary account to full control, and that route is what an audit is for.

Service accounts, which are the standing weakness

Accounts with passwords that have not changed in years, that are members of privileged groups because it was easier at install time, and whose credentials sit in a script or a scheduled task somewhere. These are the accounts attackers look for first, because they are powerful, they are rarely monitored, and nobody dares change them in case something breaks.

Local administrator passwords, and whether LAPS is deployed

A single shared local administrator password across the estate means compromising one machine gives an attacker every machine. Windows LAPS solves this, it is built into Windows and Microsoft states it is free on all supported platforms, and Microsoft names protection against pass-the-hash and lateral traversal as the benefit. Most UAE estates we assess have either nothing or the deprecated legacy product.

Stale accounts, stale computers and old protocols

Accounts for people who left, computer objects for machines decommissioned years ago, passwords that never expire, and legacy authentication protocols still enabled because a single old application needed them once. Each is a small thing. Together they are the difference between an estate that is hard to move through and one that is not.

Certificate services, if you run them

An internal certificate authority is powerful infrastructure and it is frequently configured once and never reviewed. Template permissions and enrolment settings can create privilege escalation paths that are not obvious from the certificate authority console. If you run AD Certificate Services we assess its configuration specifically, because it is a well-known and under-examined route.

The hybrid join to Microsoft Entra

Almost every UAE organisation with on-premises Active Directory also synchronises to Microsoft Entra, which means the two are one connected identity system rather than two separate ones. The synchronisation server itself is highly privileged, the sync account is powerful, and compromising on-premises frequently means compromising the cloud. We assess the join rather than treating the two sides separately.

Whether you would see any of it happening

Domain controller audit policy, what is actually being logged, whether those logs leave the domain controllers, and how long they are kept. An attacker who reaches Active Directory can alter or clear local logs, so logs that only exist on the domain controller are logs you may not have when you need them. This is the difference between investigating an incident and guessing at one.

One free fix worth doing regardless

If every machine shares one local admin password, fix that first.

This is the highest-return item on most UAE Active Directory assessments, it is free, it is built into Windows, and it is nearly always either absent or running on a deprecated product.

  • The problem it solves is lateral movement. If the same local administrator password works on every machine, an attacker who compromises one laptop has functioning credentials for every other machine in the estate. Microsoft names protection against pass-the-hash and lateral-traversal attacks as exactly what Windows LAPS is for.
  • Windows LAPS is built into Windows and shipped in updates released on 11 April 2023. It is available on Windows 11 23H2 and later, on Windows 10 and 11 that have the April 2023 update, on Windows Server 2025 and later, and on Server 2019 and 2022 with that same update. Microsoft states the feature is free on all supported Windows platforms.
  • The legacy Microsoft LAPS product, the separate download from 2016, is deprecated as of Windows 11 23H2 and later. Installation of its installer package is blocked on newer operating system versions and Microsoft no longer considers code changes for it. If your estate is running that, you are on a product with no future, and there is a supported replacement already present on your machines.
  • One planning point that catches people out: passwords can be backed up to Active Directory or to Microsoft Entra ID, but not to both. Devices joined only to Entra back up to Entra, devices joined only to Active Directory back up to Active Directory, and hybrid-joined devices can use either. Decide which before you deploy rather than after.
Ask us to check your LAPS position
How we audit

Four things that make the findings usable rather than alarming.

It is easy to run a tool against Active Directory and produce four hundred findings. That report gets read once and filed, because nobody can act on four hundred of anything.

We rank by exploitability, not by tool severity

A scanner reports what deviates from a template. We report what actually shortens the path from an ordinary user to domain control in your specific directory. Those two lists overlap less than you would expect, and the second one is far shorter, which is precisely what makes it something your team can work through.

We work with what you can realistically change

Every long-lived directory has a service account nobody dares touch and an old application requiring a protocol that should have gone years ago. Telling you to remove them is not advice, it is a description of the problem. We propose sequences that reduce risk while the underlying constraint is worked on separately, because a recommendation nobody can act on achieves nothing.

We treat on-premises and Entra as one identity system

They are connected, the synchronisation server is highly privileged, and an attacker who owns Active Directory frequently owns the cloud tenant too. Auditing one side and ignoring the other produces a false picture, so we assess the join, the sync account and what a compromise on either side would reach.

We fix things, not only list them

Findings come with what to change, roughly what it takes, and what could break. Your team can execute or we can, and either is fine. Where a finding is genuinely urgent, an exposed path to domain control for instance, we say so during the audit rather than saving it for the report.

When organisations ask for this

Six situations that bring UAE businesses to a directory audit.

Almost nobody audits Active Directory proactively, which is unfortunate because it is where the highest-severity findings in most estates are sitting.

After a ransomware incident at a peer or a supplier

The most common trigger and a rational one. Ransomware in a Windows estate almost always runs through Active Directory, because that is how an attacker goes from one machine to all of them. Somebody senior reads about a comparable business losing a week of operations and asks whether it could happen here. The honest answer usually requires looking.

A regulated firm facing supervisory expectations

DIFC and ADGM firms are expected to control privileged access and to be able to evidence it. Active Directory is where most of that access actually lives for a firm with on-premises infrastructure, and it is frequently the weakest documented area precisely because it predates the compliance work.

Manufacturing, logistics and site-based operations

Long-lived estates, older equipment, machines that cannot be patched on a normal cadence, and shared accounts on the shop floor that exist for genuine operational reasons. Here the audit has to be pragmatic about what can change, and the value is in containing the risk from the parts that cannot rather than pretending they will be fixed.

A business that has changed IT provider

A new provider inherits a directory built by somebody else, containing administrative accounts, delegations and service accounts whose reasons nobody remembers. An independent audit at handover establishes a baseline and, reliably, finds accounts belonging to the previous relationship that should have been removed when it ended.

A group that has grown by acquisition

Multiple domains, trusts established during integrations that were never revisited, and inconsistent standards across entities. Trusts are worth particular attention because they extend the blast radius: a weakness in the least-managed entity can become a problem for the best-managed one.

An insurer or client questionnaire that asked specifics

Cyber insurance proposals increasingly ask directly about privileged account numbers, local administrator password management and administrative account separation. These are questions you cannot answer optimistically, because a claim can turn on the accuracy of the answer, and most organisations cannot answer them from records at all.

Three directory positions

What we find when we audit Active Directory in the UAE.

The middle column is overwhelmingly the most common. The directory was built properly by somebody competent, and then a decade of projects, staff changes and consultants happened, and nobody looked at the whole thing again.
Domain Admin count known and small
Audited and tiered
Built once, then accumulatedGrown quietly
Never reviewedUnknown
Administrative accounts separate from daily accounts
Audited and tiered
Built once, then accumulatedPartially
Never reviewed
Service accounts scoped rather than privileged
Audited and tiered
Built once, then accumulatedMixed
Never reviewed
Local admin passwords unique per machine
Audited and tiered
Built once, then accumulatedSometimes
Never reviewed
Delegations documented and justified
Audited and tiered
Built once, then accumulated
Never reviewed
Stale accounts and computers removed
Audited and tiered
Built once, then accumulatedOccasionally
Never reviewed
Legacy protocols disabled
Audited and tiered
Built once, then accumulatedPartially
Never reviewed
Domain controller logs centralised
Audited and tiered
Built once, then accumulatedSometimes
Never reviewed
Privileged group changes alerted
Audited and tiered
Built once, then accumulated
Never reviewed
How common in the UAE market
Audited and tieredUncommon
Built once, then accumulatedThe default
Never reviewedCommon in SMEs
Feature
Audited and tiered
Built once, then accumulated
Never reviewed
Domain Admin count known and small
Grown quietlyUnknown
Administrative accounts separate from daily accounts
Partially
Service accounts scoped rather than privileged
Mixed
Local admin passwords unique per machine
Sometimes
Delegations documented and justified
Stale accounts and computers removed
Occasionally
Legacy protocols disabled
Partially
Domain controller logs centralised
Sometimes
Privileged group changes alerted
How common in the UAE market
UncommonThe defaultCommon in SMEs
Local administrator password management

Windows LAPS against legacy LAPS against nothing.

Every entry in the first two columns comes from Microsoft own documentation. The third column is the position most UAE estates are actually in, and it is the one that turns a single compromised laptop into a compromised estate.
Windows LAPSLegacy Microsoft LAPSNo LAPS
Built into WindowsYesNo, separate installerNot applicable
Currently supportedYesDeprecated on Windows 11 23H2 and laterNot applicable
Installer blocked on newer WindowsNot applicableYesNot applicable
Receives code changes from MicrosoftYesNoNot applicable
Backs up to Active DirectoryYesYesNo
Backs up to Microsoft Entra IDYesNoNo
Password encryption in Active DirectoryYesNoNo
Password historyYesNoNo
Manages DSRM password on domain controllersYesNoNo
Cost of the feature itselfFree on supported WindowsFreeNil, and expensive later
One compromised machine reaches the restNoNoYes
How the audit runs

Five stages, typically one to two weeks.

The collection is read-only and does not disrupt anything. What takes the time is interpretation, because a permission that is dangerous in one directory is entirely reasonable in another and the difference is context.
  1. 1

    Scope and read-only collection

    What is in scope, including how many domains, whether certificate services are present, and whether the estate is hybrid-joined to Microsoft Entra. Collection is read-only and runs against domain controllers without changing anything. We agree the access we need and how it is granted, and you can revoke it afterwards.

  2. 2

    Privilege and path analysis

    Full resolution of privileged group membership including nesting, delegation across organisational units, service account rights, and the paths by which a standard account could reach domain control. This is where the highest-severity findings come from, and it is where we spend most of the analysis time.

  3. 3

    Hygiene and configuration review

    Stale accounts and computers, password policy in practice rather than in policy, legacy protocols, local administrator password management and whether LAPS is deployed and in which form, plus certificate services configuration where present.

  4. 4

    Visibility and recovery review

    Domain controller audit policy, whether logs leave the domain controllers, retention, whether privileged group changes would generate an alert, and whether anybody has tested restoring a domain controller. Directory recovery is materially different from file recovery, and it is usually the least-rehearsed part of a continuity plan.

  5. 5

    Report, prioritise, and remediate

    Findings ranked by how much they shorten an attack path in your directory, with what to change, what it takes and what could break. Then the work, by your team or by us. Where you want it we re-audit afterwards so the improvement is evidenced rather than assumed, which matters if an insurer or a client asked the original question.

“We thought we had six domain administrators. Once nested groups were resolved it was thirty one, including a service account for a reporting tool we decommissioned in 2021 whose password had not changed since it was installed. Nobody had done anything wrong, it had just accumulated for eleven years.”
Infrastructure Manager
Manufacturing group, Jebel Ali · Client reference available on request
Straight answers

What organisations ask about an Active Directory audit.

Yes, and arguably more so during a migration than before it. Most UAE organisations moving to Microsoft 365 keep Active Directory synchronised to Entra for years, which means the two are one connected identity system rather than a legacy one and a new one. An attacker who compromises on-premises Active Directory frequently reaches the cloud tenant through that connection. Auditing the directory you are leaving is not wasted work while it still authenticates your people and still feeds your cloud identity.

No. Collection is read-only and runs against domain controllers without changing configuration, and users notice nothing. What can be disruptive is remediation, particularly anything touching service accounts or authentication protocols, which is why we separate the two and plan changes with you. If we find something genuinely urgent during collection we raise it immediately rather than waiting for the report.

Privileged group membership that is far larger than anybody believes, once nested groups are fully resolved. The second is service accounts sitting in Domain Admins with passwords that have not changed in years, usually placed there during an installation because it made something work. The third is a single shared local administrator password across the estate, which turns one compromised laptop into a compromised estate and is free to fix with Windows LAPS.

Windows LAPS automatically manages and backs up the local administrator password on each machine, so every device has a different one. It is built into Windows, it shipped in updates released on 11 April 2023, and Microsoft states the feature is free on all supported Windows platforms. Microsoft names protection against pass-the-hash and lateral-traversal attacks as its purpose, which is precisely the movement that turns a single infection into an estate-wide incident. If you have no local administrator password management, this is the highest-return free change available to you.

It depends which one. The legacy Microsoft LAPS product, the separate download from 2016, is deprecated as of Windows 11 23H2 and later, its installer is blocked on newer operating system versions, and Microsoft no longer considers code changes for it. Windows LAPS is the built-in successor and adds backup to Microsoft Entra ID, password encryption in Active Directory and password history. If you are on the legacy product, you are on something with no future while a supported replacement is already present on your machines.

No, and this catches people out during planning. Microsoft states directly that you cannot back up passwords to both. Devices joined only to Microsoft Entra ID back up only to Entra, devices joined only to Active Directory back up only to Active Directory, and hybrid-joined devices can use either one but not both. Decide the destination before deployment based on where your devices are actually joined and where your administrators will retrieve passwords from.

Very few, and every one of them for a stated reason. There is no universal number, but the pattern is consistent: the count grows because a project needed it, a vendor asked for it, or somebody was granted it temporarily and it was never removed. Alongside the count, the questions worth asking are whether administrative accounts are separate from the daily accounts those people use for email and browsing, and whether any service account is in the group because it was easier at install time.

Tiering separates administration by the sensitivity of what is being administered, so that credentials capable of controlling domain controllers are never used on ordinary workstations where they can be captured. It is genuinely effective and it is a significant piece of work to implement properly. For a smaller UAE organisation, separating administrative accounts from daily accounts and deploying LAPS delivers most of the practical benefit for a fraction of the effort, and we would usually recommend that first.

Directly, because they are connected. If you synchronise identities, the synchronisation server is one of the most privileged machines you own and the sync account is powerful. A compromise of on-premises Active Directory frequently becomes a compromise of the cloud tenant through that path. We assess the join as part of this audit, and where you want the cloud side examined in the same depth, that is our Microsoft 365 security audit and the two are commonly run together.

One to two weeks for a typical single-domain UAE estate. We need read access sufficient to enumerate the directory, granted in a way you control and can revoke, plus a conversation with whoever knows the history: which service accounts belong to what, why a particular delegation exists, which application still needs the old protocol. That history is what turns raw findings into a report you can act on.

They can, with the same caveat we apply to ourselves elsewhere: they built or have run the directory, so their audit is an assessment of their own work. That is a structural issue rather than an accusation. Where we manage a client estate we say plainly that our audit of it is not independent, and we are comfortable with a third party reviewing it. For an insurer or a regulator, independence is often part of the point.

If you run an internal certificate authority it is in scope, and it deserves specific attention. It is powerful infrastructure, it is usually configured once during a project and never reviewed, and its template and enrolment settings can create privilege escalation paths that are not visible from the ordinary administrative view. Many organisations do not know whether they still run it, which is itself a finding worth having.

This is normal and it is the constraint we most often work around rather than remove. The unhelpful answer is to tell you to disable the protocol. The useful approach is to establish exactly which systems require it, restrict its use to those systems rather than the whole estate, monitor its use so anomalies are visible, and put a documented plan against the application itself. That reduces the risk substantially while the real fix, which is usually a vendor conversation, proceeds on its own timeline.

A directory accumulates continuously, so annually is a reasonable cadence, with an additional audit after a significant change such as an acquisition, a domain restructure or a change of IT provider. What matters as much as frequency is that the second audit is comparable to the first, so it shows whether anything actually improved. We keep the method and the basis for each judgement documented for exactly that reason.

We scope per organisation, driven by the number of domains, whether certificate services and hybrid identity are in scope, and whether you want remediation included or only the assessment. What we will tell you free in the first conversation is how to check two things yourself: your fully resolved Domain Admins membership, and whether any form of local administrator password management is deployed. Those two answers usually indicate how much of a problem you have.
Directory health check

Fifteen questions about your own Active Directory.

The first group is privilege, which is what an attacker is trying to reach. The second is the accumulated debt every long-lived directory carries. The third is whether you would see an attack or find out afterwards.

Privilege

  • How many accounts are in Domain Admins, counting nested groups?
    Resolve nesting fully. The real number surprises people.
  • Do any of those accounts also read email and browse the web?
    Administrative work should not share a session with daily work.
  • How many service accounts sit in privileged groups?
    Usually placed there at install time to make something work.
  • When did service account passwords last change?
    If the answer is never, that is the finding.
  • Who can reset passwords for privileged accounts?
    Delegation granted for helpdesk convenience reaches further than intended.

Accumulated debt

  • How many enabled accounts have not signed in for 90 days?
    Every one is a live credential nobody is watching.
  • How many computer objects no longer exist as machines?
    Stale objects clutter the picture and can be reused.
  • Which accounts have passwords set never to expire?
    Almost always service accounts, almost always privileged.
  • Are legacy authentication protocols still enabled?
    Usually for one old application nobody wants to touch.
  • Is there a documented reason for each delegation on each OU?
    If nobody can explain it, it should probably go.

Would you see it

  • Do domain controller logs leave the domain controllers?
    Local logs can be cleared by whoever compromised the box.
  • How long are those logs retained?
    Investigations routinely need to look back further than people expect.
  • Would a new Domain Admin membership generate an alert?
    One of the few events that is always worth alerting on.
  • Is Windows LAPS deployed, and to what?
    Free, built in, and usually absent.
  • Has anybody tested restoring a domain controller?
    Recovering a directory is not like recovering a file server.
Related reading

The pages around this one.

Microsoft 365 security audit

The cloud half of the same identity system, including conditional access gaps and how far back your audit evidence actually reaches.

Learn more

IT audit services in Dubai

The wider audit practice, and how to tell which kind of engagement your situation actually calls for before anybody quotes for one.

Learn more

Microsoft Entra

The identity platform your directory synchronises into, and the controls that close many of the findings this audit produces.

Learn more
Next step

Two questions you can answer this afternoon.

How many accounts are in Domain Admins once nested groups are fully resolved, and is any form of local administrator password management deployed. If the first number surprises you or the second answer is no, an audit is worth a week of your time and we will tell you what we would look at first.

Book an Active Directory auditCall +971 56 613 2743

Related Services

Explore more solutions that work great with this service

Microsoft 365 Security Audit

Tenant review, and how far back your evidence really goes

Learn more

IT Audit Services Dubai

Assessment, technical test or certification, scoped properly

Learn more

Microsoft Entra

Identity and access management solutions

Learn more

Managed Security Services

MSS on Microsoft Defender XDR and Sentinel

Learn more

Endpoint Security

Defender for Endpoint and Intune managed

Learn more

NIST CSF 2.0 Assessment

Know where you stand, without committing to certification

Learn more

ISO 27001 Certification UAE

The 2022 edition, and whether you should certify at all

Learn more
GR IT SERVICES

Leading IT services provider in Dubai,
delivering enterprise-grade solutions
for businesses across the UAE.

Microsoft CSP PartnerCISGuard

Get the Helpdesk app

Raise and track IT tickets from your phone.

Download on the App StoreGet it on Google Play
Learn more about the app

Microsoft 365

  • Microsoft 365 Administration
  • M365 Reporting & Auditing
  • Microsoft 365 Licensing
  • Microsoft Copilot
  • Microsoft 365 Apps
  • Windows 365 Cloud PC
  • Microsoft SharePoint
  • Outlook & Exchange

Security

  • Microsoft Defender
  • Microsoft Purview
  • Microsoft Intune
  • Microsoft Entra
  • Compliance Manager
  • Cybersecurity Audits
  • Copilot for Security
  • Microsoft Sentinel
  • Microsoft Priva

Infrastructure

  • Google Workspace
  • Cloud Migration Services
  • Data Analytics & BI
  • Active Directory
  • Server Management
  • Apple Business
  • Apple Jamf Pro
  • IP Telephone
  • Data Backup
  • Website Development

IT Services

  • Managed IT Services
  • IT Support Dubai
  • IT AMC Dubai
  • New Office IT Setup
  • IT Relocation
  • Remote IT Support
  • On-Call IT Support
  • Startup IT Business Kit
  • Disaster Recovery & BC

Company

  • About Us
  • Careers
  • Contact
  • Blog

Contact

  • Iris Bay Tower, Office 903,
    Business Bay, Dubai, UAE
  • +971 56 613 2743
  • hello@gritservices.ae
  • gritservices.ae

© 2026 GR IT Services. All rights reserved.

Privacy PolicyTerms of UseCookie Policy