Resources → Active Directory Audit Checklist
Active Directory is often one of the most important systems in a Windows environment, but it can become difficult to keep clean over time. User accounts are created, employees leave, roles change, groups accumulate members, and key directory attributes are not always maintained consistently.
This Active Directory audit checklist is designed for small IT teams, MSPs, and system administrators who need a practical way to review common AD hygiene issues before an internal review, external audit, client assessment, or cleanup project.
The goal is not to replace a full enterprise identity governance platform. The goal is to identify common issues that are easy to overlook and worth reviewing on a regular basis.
1. Review stale and inactive user accounts
Stale or inactive Active Directory accounts are one of the first things to review. These accounts may belong to former employees, unused service accounts, test users, contractors, or employees who have changed roles.
What to check
- User accounts with no recent logon activity
- Accounts that have not logged in within your organization's review threshold
- Enabled accounts that appear abandoned
- Old test accounts or temporary accounts
- Contractor or vendor accounts that are no longer needed
Why it matters
Inactive accounts increase the amount of unnecessary identity exposure in the environment. Even if the account is not currently being used, it may still have group memberships, permissions, mailbox access, VPN access, or application access tied to it.
A common review process is to identify inactive accounts, validate ownership with HR or management, then disable or remove accounts according to internal policy.
2. Review disabled, locked, and expired accounts
Account status can reveal operational and security issues. Disabled accounts may be legitimate, but they should not be ignored indefinitely. Locked accounts may indicate user issues, stale credentials, scheduled tasks, service misconfiguration, or attempted misuse. Expired accounts should be reviewed to confirm whether they are still needed.
What to check
- Disabled user accounts
- Locked user accounts
- Expired user accounts
- Accounts with expiration dates that have passed
- Accounts that are disabled but still belong to privileged groups
Why it matters
Disabled accounts can still clutter reports and create confusion if they remain in privileged groups or are not clearly tied to a termination or retention process. Locked accounts can point to password problems or systems repeatedly trying old credentials.
Reviewing account status helps IT teams distinguish between normal administrative activity and accounts that require cleanup.
3. Identify missing or inconsistent user attributes
Active Directory is often used as a source of identity information for email, access reviews, HR comparisons, reporting, and downstream applications. Missing or inconsistent attributes make it harder to understand who users are, where they work, and who is responsible for them.
Common attributes to review
- Display name
- Email address
- Title
- Department
- Manager
- Office
- Phone number
- Employee ID or other organization-specific identifier
Why it matters
Missing attributes can create problems during audits, access reviews, user validation, and HR reconciliation. For example, if a user has no department or manager listed, it may be harder to confirm whether the account still belongs in a group or should retain certain access.
A regular attribute review can help improve reporting quality and make future audits easier.
4. Review privileged group membership
Privileged groups should be reviewed regularly because they often grant broad administrative control. Even small environments can accumulate unnecessary administrative access over time.
Groups to review
- Domain Admins
- Enterprise Admins
- Schema Admins
- Administrators
- Account Operators
- Server Operators
- Backup Operators
- Print Operators
- Other organization-specific privileged groups
What to check
- Who is currently a member of each privileged group
- Whether each member still needs access
- Whether disabled or stale accounts are still members
- Whether nested groups grant indirect privileged access
- Whether service accounts or shared accounts have elevated rights
Why it matters
Privileged access should be limited, reviewed, and documented. A privileged group review can help identify users who no longer need elevated rights, accounts that were added temporarily and never removed, or access that was granted through nested group membership.
5. Compare HR census data to Active Directory
One of the most useful Active Directory audit steps is comparing HR data to AD. HR records can help confirm whether user accounts belong to current employees, whether user details are accurate, and whether terminated users still have active accounts.
What to compare
- Users in HR who are missing from Active Directory
- Users in Active Directory who are missing from the HR census
- Name mismatches
- Department mismatches
- Title mismatches
- Manager mismatches
- Status mismatches between HR and AD
Why it matters
HR/AD discrepancies often reveal process gaps. A terminated employee may still have an enabled account. A current employee may have outdated department information. A user may have changed roles but retained access from a previous position.
For small IT teams, even a basic HR-to-AD comparison can provide useful evidence for cleanup and audit preparation.
6. Review password and account hygiene settings
Certain account settings should be reviewed because they may weaken account security or indicate legacy exceptions that were never revisited.
What to check
- Accounts with "Password Never Expires" enabled
- Accounts with "User Cannot Change Password" enabled
- Accounts with "No Password Required" enabled
- Service accounts with unclear ownership
- Old accounts with special password exceptions
Why it matters
Some exceptions may be legitimate, especially for service accounts or legacy systems. However, exceptions should be documented, reviewed, and limited to accounts that truly require them.
A recurring review helps identify settings that were applied temporarily but never removed.
7. Review service accounts and non-human accounts
Service accounts, application accounts, scanner accounts, and other non-human accounts often remain in Active Directory for years. These accounts may have elevated permissions, password exceptions, or unclear ownership.
What to check
- Service accounts with no documented owner
- Service accounts with privileged group membership
- Service accounts with password exceptions
- Service accounts that have not been used recently
- Accounts that appear to be shared by multiple users or systems
Why it matters
Service accounts are easy to overlook because they may not belong to a normal employee lifecycle. Without regular review, they can become long-lived accounts with excessive access and poor documentation.
8. Check group membership for stale or inappropriate access
Group membership drives access in many Windows environments. Over time, users may accumulate group memberships from previous roles, temporary projects, or one-off access requests.
What to check
- Users with unusually high group membership counts
- Disabled or inactive users still present in access groups
- Former employees or contractors still present in groups
- Nested group access that grants more permissions than expected
- Groups with unclear purpose or ownership
Why it matters
Access reviews are easier when group membership is clean, documented, and tied to current business roles. Reviewing group membership can help reduce unnecessary access and identify cleanup opportunities.
9. Document findings and remediation steps
An Active Directory audit is most useful when the results are documented clearly. A list of findings should show what was found, why it matters, and what action should be taken next.
Useful report sections
- Summary of findings
- Stale or inactive accounts
- Disabled, locked, and expired accounts
- Missing user attributes
- Privileged group membership
- HR/AD discrepancies
- Recommended cleanup actions
- Date of review
Why it matters
Clear reports help IT teams track cleanup progress, support management review, and provide evidence that AD hygiene is being reviewed regularly.
10. Repeat the review on a regular schedule
Active Directory hygiene is not a one-time task. Accounts, roles, departments, and access needs change continuously. A useful audit process should be repeated on a regular schedule.
Suggested review frequency
- Monthly: stale users, locked accounts, privileged groups
- Quarterly: HR/AD comparison, group membership review, missing attributes
- Annually: broader AD cleanup, policy review, service account review
The exact schedule depends on the size of the environment, regulatory requirements, internal policies, and staffing levels. The important point is to make the review repeatable.
Active Directory audit checklist summary
| Audit Area | What to Review |
|---|---|
| Stale users | Inactive accounts, old test users, abandoned accounts |
| Account status | Disabled, locked, and expired accounts |
| User attributes | Missing title, department, manager, email, phone, office, or employee ID |
| Privileged access | Domain Admins, Enterprise Admins, Administrators, operator groups, nested access |
| HR comparison | Users missing from HR, users missing from AD, mismatched details |
| Password/account settings | Password never expires, no password required, user cannot change password |
| Service accounts | Ownership, activity, privileges, password exceptions |
| Group membership | Unnecessary access, disabled users in groups, unclear group ownership |
| Reporting | Document findings, cleanup actions, and review dates |
How AD Auditor can help
AD Auditor is a lightweight Windows tool designed to help small IT teams, MSPs, and system administrators generate Active Directory hygiene reports without setting up a large monitoring platform.
AD Auditor runs locally, performs read-only Active Directory checks, and helps report on common review areas such as stale or inactive users, disabled accounts, missing user attributes, privileged group membership, and HR census discrepancies.
It does not modify Active Directory and does not upload directory data. Reports are generated locally so they can be reviewed by the IT team, and exported to .txt, .csv, or .pdf for cleanup tracking or audit evidence.
Start a 14-day trial of AD Auditor to generate Active Directory audit reports in your own environment.
Frequently asked questions
How often should Active Directory be audited?
Many small IT teams benefit from a monthly or quarterly review. Privileged groups and stale accounts are good candidates for more frequent review, while HR/AD comparison and broader cleanup may be done quarterly or as part of an audit cycle.
What is the most important Active Directory audit check?
Privileged group membership and stale enabled user accounts are usually among the highest-priority checks. Privileged access should be limited and reviewed, and stale accounts should be validated or removed according to policy.
Should disabled accounts be removed from Active Directory?
That depends on company policy, retention requirements, and operational needs. Disabled accounts are often retained for a period of time, but they should still be reviewed and removed from unnecessary groups.
Why compare HR data to Active Directory?
HR data can help validate whether AD users represent current employees and whether user details such as department, title, manager, or employment status are accurate. This comparison can reveal terminated users, missing accounts, and outdated user information.
Does an Active Directory audit tool need to modify AD?
No. An audit or reporting tool can perform read-only checks and produce findings without making changes to Active Directory. Cleanup actions should be reviewed and performed according to internal change control procedures.