Your Active Directory underpins every login
Active Directory centralises authentication for your whole organisation. A single configuration weakness can be enough to open the way to the entire information system. Yet it is one of the least audited components, because it is technical and largely invisible day to day.
A complete review of your directory configuration, carried out read-only with no intrusive action. This is not a penetration test.
Detection of common configuration risks: excessive delegations, stale accounts, poorly controlled privileged accounts, weak passwords, misconfigured Group Policy Objects (GPOs).
A prioritised report written in plain language, readable by non-technical management.
Optional remediation support, agreed separately and sized on the sensitive points actually found.
Who is it for?
Organisations whose authentication relies on an on-premises or hybrid Active Directory, usually from around twenty accounts. If your workstations are not joined to any domain, the question does not arise.
Organisations working towards ISO 27001 or NIS2: the audit can contribute to that work, but on its own it is neither a certification nor full compliance.
Organisations that have suffered an incident involving compromised accounts or access.
Three distinct steps, only one of them systematic
Active Directory audit: a fixed price based on the size of the directory, with a full analysis and a prioritised report. It changes nothing in your environment.
Remediation (optional): quoted after the audit and billed on a daily rate according to the number and severity of the points found. No blind fixed price: you know exactly what you pay for and why. Always agreed separately before any change.
Related migrations: if the audit reveals a wider need (an ageing server to replace, for example), it is quoted separately.
Remediation carried out outside business hours carries a 50% uplift on the daily rate. This occasional availability is quoted case by case and comes with no security on-call duty or continuous monitoring.
No change is made before you have approved the scope and the quote in writing.
Pricing by directory size
The starting price shown above covers one domain with up to 50 accounts. A directory of 51 to 200 accounts in a single domain is priced in a higher tier. Multi-domain forests, complex environments or more than 200 accounts are priced on request.
The exact price for your directory is on the quote, see our pricing.
How the audit works
Preparation: scope of the directory to audit (number of domains, accounts and domain controllers).
Audit: read-only analysis of configuration, delegations, Group Policy Objects and privileged accounts.
Report: a plain-language report with a risk score and an action plan ranked as critical, high, medium or low.
The whole audit is carried out remotely, with read-only access that you provide and can withdraw at any time. The findings meeting takes place by video call, in English or French.
Deliverables
Active Directory audit report with a risk score and a map of risks and sensitive configuration points.
Prioritised remediation plan.
Executive summary for management.
A detailed remediation quote if sensitive points are identified.
Further reading
This audit is also part of the Security Audit package, combined with awareness training for your teams.
Frequently asked questions
Does the audit change anything in my Active Directory? No. The audit is a read-only, non-intrusive analysis: nothing is changed in your directory at this stage, and it is not a penetration test. Only remediation, which is optional and always approved by you beforehand, involves changes.
Why is the remediation price not fixed? Because it depends directly on the number and severity of the sensitive configuration points found. A clean directory needs a few hours of fixes; one neglected for years can need several days. The quote is only drawn up once the audit is finished, so that you only pay for what is actually needed.
Why is there an uplift for work outside business hours? Remediation on the directory can temporarily affect your staff's authentication. Many organisations prefer this work to be done outside production hours, which requires extended availability on our side, hence the 50% uplift on those slots. This availability remains occasional and quoted: it is neither security on-call duty nor continuous monitoring.
Is this audit enough for ISO 27001 or NIS2? No. The audit can contribute to an ISO 27001 or NIS2 programme by covering a control point that is often critical (identity and access management), but on its own it is neither a certification nor full compliance: other requirements of these frameworks fall outside the scope of this service.
Can you audit our directory if we are outside France? Yes. The audit is carried out entirely remotely with read-only access, whatever the country. The report is delivered in English or French, and the findings meeting takes place by video call. An on-site visit is possible on quote.
Does this service guarantee there will be no future vulnerability? No. Like any security audit, it is an obligation of means, not of result: it identifies and prioritises the main risks visible within the audited scope, in line with the state of the art, without being able to guarantee the absence of any future weakness or incident.