AD Assessment Questions

Question 1 of 11

Which best describes your organization's Active Directory forest architecture?

Single forest with root and single child

Nice! A manageable structure that still maintains some logical separation. Keep monitoring for unnecessary domain sprawl.

Multiple forests

That’s a complex setup! If possible, review whether all forests are truly needed—consolidation could reduce attack surface and simplify operations.

Root domain with multiple child domains

You’ve got structure, but it might be adding complexity. Consider consolidation opportunities to simplify management and reduce replication overhead.

Single domain forest

Excellent! A single domain forest is the gold standard for simplicity and manageability. You’re minimizing complexity and risk—well done!

How many Active Directory domain controllers are deployed across your environment?

5 or fewer

Nicely balanced! You’ve kept your DC footprint efficient and easier to manage while still maintaining resilience.

6-10

Good coverage. You’ve got a healthy number of DCs for redundancy—just ensure patching and replication remain consistent.

11-50

Growing larger! As environments scale, it’s critical to maintain standardized management and backup practices.

50-100

That’s a lot of DCs—complexity and overhead can add up. Review whether all are necessary or if consolidation could improve efficiency.

Greater than 100

That’s a massive AD footprint! Consider modernizing with consolidation or cloud integration to reduce operational burden.

Which best describes your organization's Active Directory backup strategy?

No dedicated AD backups

Risk alert! Without system state backups, AD recovery could be painful. Implement a dedicated backup strategy ASAP.

VM backups of DCs only

Partial protection—remember, VM backups alone don’t always ensure full AD recovery. Consider dedicated system state backups.

Daily, full system state backups of all DCs

Fantastic! You’re setting the standard for AD resilience—this is the best practice.

Weekly system state backups of some DCs

Solid start, but increasing frequency or coverage will strengthen your recovery posture.

How does your organization manage and secure privileged accounts?

PAM solution implemented, managing most accounts

Strong progress! You’re nearly there—close the final gaps to ensure complete privileged account coverage.

No PAM solution

Time to act! PAM is critical for stopping lateral movement and credential abuse. Start evaluating PAM options soon.

Limited PAM implementation

You’re on the right path—consider expanding PAM to cover more accounts and improve auditability.

PAM solution implemented and managing all privileged accounts

Excellent! Most organizations haven’t fully implemented PAM, so you’re ahead of the curve. Keep up the great governance!

Which best describes your organization's domain controller patching practices?

DCs not patched in 90+ days

Critical risk! Unpatched DCs are prime targets—establish a consistent patch cycle immediately.

Regular patching without formal testing

You’re staying current—adding structured testing could take you from good to great.

Inconsistent or manual patching

Some progress, but inconsistent patching leaves windows of vulnerability. Automate where possible.

Monthly patching with formal testing/change management

Excellent hygiene! You’re modeling disciplined patch management—key for AD security.

Which best describes your organization's tiered administration model for privileged access?

Partial tiering implementation

Strong effort. Expand your model to close privilege escalation paths across all systems.

Full tiered administration implemented

Excellent! You’ve separated privileges smartly—this is key for containing attacks.

No tiering - same credentials across all systems

High risk! Shared credentials create major exposure—implement tiering soon.

Admin accounts segregated by some function

Decent start! You’ve reduced some risk but full tiering will give you stronger isolation.

How widely is Multi-Factor Authentication enforced across your organization?

MFA enforced for administrative/high-risk accounts only

Good progress—next step is to extend MFA to all users for complete protection.

MFA enforced for all users (admin and standard)

Outstanding! You’ve built a robust security culture that goes beyond compliance.

No MFA implementation

Urgent! MFA is one of the easiest and most effective defenses—get started right away.

MFA available but not consistently enforced

Close, but enforcement is key. Attackers love inconsistent MFA setups.

Which best describes your organization's identification of business-critical applications?

Most business-critical applications identified:

Solid footing. Take it one step further to ensure everything mission-critical is accounted for.

Some business-critical applications identified

You’re making progress. A complete inventory will drive more effective recovery planning.

All business-critical applications identified

Excellent visibility! You know what matters most—a strong foundation for resiliency.

Business-critical applications not identified

Time to start mapping! You can’t protect what you haven’t identified.

What is the current state of disaster recovery (DR) planning for your business-critical applications?

No DR plans for business-critical applications

High risk! Without DR plans, downtime could be costly—time to prioritize recovery strategy.

DR plans for most business-critical applications

Great progress—expand coverage and practice those plans regularly.

Some DR plans for some applications

You’re thinking about DR, but coverage gaps remain. Build consistency across all critical apps.

Detailed DR plans for all business-critical applications

Excellent! You’re ready to recover quickly and confidently.

How dependent are your critical business applications on Active Directory / Microsoft Entra ID?

Some business-critical apps require AD/Entra ID

Partial dependency—review alternatives or ensure strong AD recovery plans exist.

Business-critical apps don't depend on AD/Entra ID

Smart architecture! You’ve designed resilience into your stack.

All business-critical apps require AD/Entra ID

Heavy dependency—if AD goes down, everything stops. Prioritize AD recovery readiness.

How is AD integrated into your organization's cyber resiliency and recovery plans?

AD in DR plan with documented procedures (not practiced)

Strong documentation. Add regular testing to truly validate readiness.

AD-specific disaster recovery plan exists

Good start—integrate it into your broader cyber-resiliency strategy for complete coverage.

AD in cyber-resiliency plan with practiced forest recovery

Gold standard! You’ve moved from planning to practiced readiness—impressive!

AD not included in any recovery plans

Major gap—AD is mission-critical. Make it part of your resiliency plan immediately.

RED ZONE: Critical Risk

Your AD infrastructure faces critical security and recovery gaps that could result in extended downtime during an incident.

Minimal to no backup strategy

No privileged access management

Limited or no recovery planning

High vulnerability to ransomware/cyberattacks

ORANGE ZONE: Moderate Risk

Your AD has foundational protections but lacks comprehensive resiliency measures for business continuity.

Basic security measures in place

Some backup and recovery planning

Room for significant improvement

Moderate resilience to incidents

GREEN ZONE: Strong Resiliency

Your AD demonstrates strong resiliency practices with minor optimization opportunities.

Comprehensive security posture

Robust backup and recovery plans

Well-prepared for incident response

Strong business continuity capabilities

First Name

Last Name

Business Email

Work Phone

Company

Job Title

Country

Company Website

Identity Resilience Assessment

You are at risk — see how you compare and get your full report.

You may be at risk — see how you compare and get your full report.

You are not at risk — see how you compare and get your full report.