The following table contains an alphabetical list of all indicators that originate from Security Guardian Assessments,
| Indicator | Type | Severity |
|---|---|---|
| Abnormally large number of Tier Zero user accounts in the domain | Hygiene | High |
| Accounts that allow Kerberos protocol transition delegation | Hygiene | High |
| Active Directory Tier Zero object synchronized to Entra ID | Hygiene | Medium |
| Active Directory Operator groups that are not protected by AdminSDHolder | Hygiene | Critical |
| Administrators are not enabled for self service password recovery | Hygiene | Medium |
| All domain users can create computer accounts | Hygiene | High |
| Anonymous Logon and Everyone groups are members of the Pre-Windows 2000 Compatible Access group | Hygiene | Critical |
| Anonymous access to Active Directory is enabled | Hygiene | High |
| Built-in Guest account is enabled | Hygiene | Critical |
| Built-in Administrator account that has been used | Hygiene | Critical |
| Computer accounts with non-default Primary Group IDs | Hygiene | Critical |
| Computer accounts with reversible password | Hygiene | High |
| Computer accounts with unconstrained delegation | Hygiene | High |
| Computer accounts without readable Primary Group ID | Hygiene | Critical |
| Default Active Directory groups which should not be in use contain members | Hygiene | Critical |
|
DnsAdmins group contains members |
Hygiene | Critical |
| DNS zone configuration allows anonymous record updates | Hygiene | High |
| Domain Admins can log into computers with non-Tier Zero group policy | Hygiene | Critical |
| Domain trust configured insecurely | Hygiene | High |
| Domain trust without Kerberos AES encryption enabled | Hygiene | High |
| Domain with obsolete domain functional level | Hygiene | Medium |
| Domain Controller is running SMBv1 protocol | Hygiene | High |
| Enabled Tier Zero user accounts that are inactive | Hygiene | High |
| Entra ID cloud applications that are not included in a conditional access policy | Hygiene | Medium |
| Entra ID Conditional Access policies do not block legacy authentication for all users | Hygiene | High |
| Entra ID Conditional Access policies do not protect all non-privileged users with multi-factor authentication (MFA) | Hygiene | High |
| Entra ID Conditional Access policies do not protect all privileged users with multi-factor authentication (MFA) | Hygiene | High |
| Entra ID Conditional Access policies do not protect all users from high user risk | Hygiene | High |
| Entra ID Conditional Access policies do not protect all users from risky sign-ins | Hygiene | High |
| Entra ID Conditional Access policies do not protect all users with strictly enforce location for Continuous Access Evaluation | Hygiene | High |
| Entra ID Conditional Access policies do not require token protection for sign-in sessions for users | Hygiene | Medium |
| Entra ID Conditional Access policy configured to disable Continuous Access Evaluation for users | Hygiene | Critical |
|
Entra ID guest user accounts that are inactive |
Hygiene | Medium |
| Entra ID Microsoft Authenticator policy does not require geographic location and application name contexts for all users | Hygiene | Medium |
| Entra ID Privileged accounts that are not secured by multi-factor authentication (MFA) | Hygiene | High |
| Entra ID privileged role members whose passwords have not changed recently | Hygiene | Medium |
| Entra ID users are allowed to consent for all applications | Hygiene | Medium |
| Foreign Security Principals are members of a Tier Zero group | Hygiene | High |
| Group Policy allows reversible passwords | Hygiene | High |
| Group Policy does not enforce built-in Administrator account lockout on all computers | Hygiene | Medium |
| Groups with SID from local domain in their SID History | Hygiene | Critical |
| Groups with well-known SIDs in their SID History | Hygiene | Critical |
| Guest accounts assigned to the Global Administrator role | Hygiene | High |
| Inheritance is enabled on the AdminSDHolder container | Hygiene | Critical |
| Kerberos KRBTGT account password that has not changed recently | Hygiene | Medium |
| KRBTGT accounts with Resource-Based Constrained Delegation | Hygiene | Critical |
| Managed and Group Managed Service accounts that have not cycled their password recently | Hygiene | Critical |
| More than recommended number of Global Administrators in the organization | Hygiene | Medium |
| More than recommended number of privileged role assignments | Hygiene | Medium |
| Non-default configuration of the Microsoft Local Administrator Password | Hygiene | High |
| Non-privileged accounts are able to log onto privileged computers | Hygiene | Critical |
| Non-Tier Zero accounts are able to log onto Tier Zero computers | Hygiene | Critical |
| Non-Tier Zero accounts can link GPOs to the domain | Hygiene | Critical |
| Non-Tier Zero accounts can link Group Policy Objects to an Active Directory site | Hygiene | Critical |
| Non-Tier Zero accounts can link Group Policy Objects to Domain Controller OU | Hygiene | Critical |
|
Non-Tier Zero accounts can steal password hashes (DCSync) |
Hygiene | Critical |
| Non-Tier Zero accounts have access to write properties on certificate templates | Hygiene | Critical |
| Non-Tier Zero accounts that can promote a computer to a domain controller | Hygiene | Critical |
| Non-Tier Zero computer can be compromised through Resource-Based Constrained Delegation | Hygiene | High |
| Non-Tier Zero user accounts configured for Password Never Expires | Hygiene | High |
| Non-Tier Zero user accounts with Service Principal Names | Hygiene | Critical |
| Non-Tier Zero user accounts with write permissions over Resource-Based Constrained Delegation on the KRBTGT account | Hygiene | Critical |
| Non-Tier Zero users with access to gMSA password | Hygiene | Critical |
| Non-Tier Zero account can request an overly permissive certificate with privileged EKU (ESC2) | Hygiene | High |
| Non-Tier Zero accounts can access the gMSA root key | Hygiene | Critical |
| Non-Tier Zero accounts with Microsoft Local Administrator Password (LAPS) access | Hygiene | High |
| Non-Tier Zero accounts with Reanimate tombstones permission delegation | Hygiene | Critical |
| Non-Tier Zero account can use a misconfigured certificate template to impersonate any user | Hygiene | High |
| Non Tier-Zero accounts with Unexpire password permission delegation | Hygiene | Critical |
| Non Tier-Zero accounts with Migrate SID history permission delegation | Hygiene | Critical |
| Ordinary user accounts with hidden privileges (SDProp) | Hygiene | Critical |
| Password hash synchronization with on-premises Active Directory is delayed | Hygiene | Medium |
| Password hash synchronization with on-premises Active Directory is not enabled | Hygiene | Medium |
| Printer Spooler service is enabled on a domain controller | Hygiene | Medium |
| Protected group credentials exposed on read-only domain controllers | Hygiene | High |
| Protected Users group is not being used | Hygiene | High |
| Schema Admins group contains members | Hygiene | Critical |
| Security defaults are enabled | Hygiene | Medium |
| Suspicious ESX Admins group detected in domain | Hygiene | High |
| Synchronization with on-premises Active Directory is delayed | Hygiene | Medium |
| Synchronized Active Directory user is assigned an Entra ID privileged role | Hygiene | Medium |
| Tier Zero account token can be stolen from a read-only domain controller | Hygiene | High |
| Tier Zero computer accounts that have not cycled their password recently | Hygiene | High |
| Tier Zero computer can be compromised through Resource-Based Constrained Delegation | Hygiene | High |
| Tier Zero computer is owned by a non-Tier Zero account | Hygiene | Critical |
| Tier Zero computer that has write permissions on Resource-Based Constrained Delegation granted to a non-Tier Zero account | Hygiene | High |
| Tier Zero computers that have not recently authenticated to the domain | Hygiene | High |
| Tier Zero Group Policy allows Authenticated Users to add computers to the domain | Hygiene | Medium |
| Tier Zero Group Policy allows Recovery Mode to be not password-protected | Hygiene | Critical |
| Tier Zero groups that have computer accounts as members | Hygiene | High |
| Tier Zero groups with SID History populated | Hygiene | Critical |
| Tier Zero user account is disabled | Hygiene | Medium |
| Tier Zero user accounts configured for Password Never Expires | Hygiene | High |
| Tier Zero user accounts whose passwords have not changed recently | Hygiene | High |
| Tier Zero user accounts with Service Principal Names | Hygiene | Critical |
| Tier Zero user accounts with SID History populated | Hygiene | Critical |
| Tier Zero users owned by non-Tier Zero accounts | Hygiene | Critical |
| Tier Zero account can be delegated | Hygiene | High |
| User accounts do not require a password | Hygiene | High |
| User accounts have a reversible password | Hygiene | High |
| User accounts in protected groups that are not protected by AdminSDHolder (SDProp) | Hygiene | Critical |
| User accounts using DES encryption to log in | Hygiene | High |
| User accounts with non-default Primary Group IDs | Hygiene | Critical |
| User accounts with Kerberos pre-authentication disabled | Hygiene | High |
| User accounts with SID from local domain in their SID History | Hygiene | Critical |
| User accounts with unconstrained delegation | Hygiene | High |
| User accounts with well-known SIDs in their SID History | Hygiene | Critical |
| User accounts without readable Primary Group ID | Hygiene | Critical |