Protected Users blocks NTLM, DES/RC4, delegation and credential caching for its members — with no per-account exceptions. Add an admin that still depends on any of that and its sign-in breaks. ADPU-Analyzer reads the directory and the domain controllers' event logs and tells you, per privileged account:
- clear to enrol — with how strong the evidence is (proven, plausible, unknown)
- blocked — and exactly why (NTLM use, no AES keys, RC4, delegation, running services or tasks, …)
- what it could not see — auditing gaps, unreachable controllers
- whether it held after enrolling (
-Verify)
It never changes anything. It prints the commands for you to run, including the rollback.
.\ADPU-Analyzer.ps1 # pick a domain interactively
.\ADPU-Analyzer.ps1 -Domain corp.example.net -Days 30 -HtmlPath .\report.html
.\ADPU-Analyzer.ps1 -Identity alice, 'CORP\bob' # check single accounts
.\ADPU-Analyzer.ps1 -Verify -Days 7 # after enrollingNeeds Windows PowerShell 5.1+ or PowerShell 7, WinRM to the domain controllers, rights to read their Security log, and Logon, Kerberos Authentication Service and Credential Validation auditing. No RSAT required.
Tip
Enrol one account first, confirm it still signs in end to end, then do the rest.
| What it checks | blockers, hints, and what no tool can clear you of |
| How the verdict works | confidence levels, scoping, break-glass accounts, the krbtgt trap |
| Setup & auditing | requirements and the audit policy it needs |
| Usage | all parameters, automation and exit codes, post-enrolment verification |
| Limitations | read this before you trust a green verdict |
| Development | repository layout and tests |
Note
Built with AI assistance. Parts of the code and documentation were written with Claude (Anthropic): I defined the requirements, reviewed the results and tested everything in a real Active Directory environment. Review it before running it in production.
MIT · Made by Carbon/Nobrac