// service · Assessment Technology
Active Directory exposure audit for OT
Map the domain trust path an attacker would take into the plant
A signed, read-only script your domain admin runs maps the trust path from enterprise AD into OT. No password hashes collected, no writes, no agent.
// how the engagement runs
- 01
Script review
Your domain team reads the signed ADScope script before it runs. Every cmdlet it calls is a read.
- 02
Collection
Your administrator runs the script. The output is one JSON file on a path you choose, and it stays with you until you hand it over.
- 03
Rule analysis
Six rule modules run offline against the export. We score findings by severity and group them by the exposure they create.
- 04
Path mapping
We map identity exposure against OT assets from host and network collection, so a Kerberos finding lands on a named plant system.
// who does the work
Led by senior OT practitioners
-
Engagement lead
-
Lead assessor
-
Security engineer and architect
-
Analyst
Ransomware in a plant rarely starts in the plant. It starts in the enterprise domain and walks a trust relationship into OT. Few teams have mapped that path, because mapping it means a domain-wide query against production that a change board hesitates to approve.
This audit removes that objection. Your own domain administrator runs one signed, read-only script, and we turn the export into a map of the trusts, accounts, and Kerberos exposure that reach your plant systems.
What this audit does not do
- Collect, export, or crack password hashes, in any tier.
- Write to the directory. It creates no accounts and changes no groups or policies.
- Install an agent, service, or scheduled task. It runs once and writes one JSON file.
- Score replication health or enumerate hotfixes. We report operating system support lifecycle as a proxy and label it as one.
We send the signed script to your domain team for review before any conversation about scope. The audit is one of four evidence sources in OT asset discovery and network visibility. To test whether that trust path would let ransomware stop a line, pair it with an OT ransomware readiness assessment. Book a consultation to request the script.
// after the engagement
The findings keep moving
Clients who want help running the fixes can put the findings in Resilion, the platform we use to run programs. Each fix gets a named owner at a named site, and the evidence lands as it closes.
See how Resilion works
// FAQ
Questions about Active Directory exposure audit for OT
- Who runs the collection?
- Your domain administrator. ADScope is a signed PowerShell script that your team reads before it runs. Every cmdlet it calls is a read, and the signature chains to a Microsoft root.
- Do you collect password hashes?
- No. The script collects no password material in any tier, and we will not add it on request. It makes no writes to the directory and installs no agent, service, or scheduled task.
- Why does Active Directory matter for plant security?
- Ransomware in a plant usually starts in the enterprise domain and walks a trust relationship into OT with credentials that were never meant to reach a control system. The audit maps that path and lands each finding on a named plant system.
Talk to the people who do this work
Thirty minutes with a senior OT security practitioner. We confirm fit, plant scope, and who should be in the room. If it is not a match, we say so.