AuditHat — Active Directory & Group Policy Audit Report for IT Committees
One PowerShell script. No install, no modules to download, no agent, no database, no cloud service.
Copy Export-ADAuditReport.ps1 to a domain controller, run it, and you get a complete Active Directory
and Group Policy audit report plus a print-ready IT Committee report — with change tracking,
management response boxes, and control mapping to FFIEC, NIST CSF 2.0, the CRI Profile and
CIS Controls v8.
Built for community banks, credit unions and the MSPs that serve them — but it runs against any
Active Directory domain.
| |
|---|
| What it is | A single .ps1 file. Nothing else is needed. |
| What it does | Read-only audit of every GPO, every user, privileged groups, service accounts and logon restrictions |
| What you get | Two self-contained HTML reports + CSV exports you can hand to an auditor |
| Change tracking | Differential tables over a rolling window (default 30 days), not "since last run" |
| Version | 3.15.0 — script last updated 2026-10-15. See Version history. |
| License | Apache 2.0 |
Why this exists
Every bank and credit union IT examination asks the same questions about Active Directory. Who has
administrative access, and did it change since the last review? Is account lockout turned on? How long
before an idle session locks? Can service accounts log on at a console? Which accounts are stale? Is the
logon banner actually displayed? Examiners from the FFIEC agencies, the NCUA, state regulators and
third-party IT auditors ask for this evidence every cycle, and most institutions rebuild it by hand each
time from GPMC screenshots and ADUC exports.
This script was written to answer those questions in one pass, in the format auditors and examiners
expect, with the control citations they look for already attached. Run it before the exam and hand the
detailed review to the auditor. Run it monthly and the IT Committee report drops straight into the
committee packet, with change tracking and management response boxes ready for the minutes. It saves
hours every review cycle and gives the committee a consistent document to approve.
See it before you run it
Two complete sample reports are in samples/. Every domain, account, computer and GPO in
them is fictional.
Download the file and open it in any browser. Both samples are fully self-contained — no server,
no internet connection, no dependencies. They are exactly what the script writes to disk.
The detailed review
Auditor focus areas — which GPO configures each thing an examiner asks about, and whether it is
actually applying:
The complete user inventory auditors ask for, with clickable filter tiles, search, CSV export and a
print button that drops the sidebar:
Per-user logon restrictions — logon hours drawn as a 7×24 grid, workstation limits and account expiry:
Service account review — what looks like a service account, and whether anything actually stops it
signing in at a console or over RDP:
The IT Committee report
A separate, print-ready document for the IT Committee / IT Steering Committee packet:
Change tracking — five differential tables covering control areas, Group Policy settings,
privileged group membership, user accounts and computer accounts. Each one says plainly what changed
and what did not:
Every open item carries a recommendation and a ruled management response / action box — type into
it in the browser, or print it and write in it:
And every open item has an exhibit at the back with current vs recommended settings and a change
request written so it pastes straight into a ticket:
Step-by-step: running your first report
1. Get the script
Download Export-ADAuditReport.ps1 — click the file above, then the
Download raw file button. That one file is the whole tool.
2. Copy it to a domain controller
Or to any domain-joined machine with RSAT: Group Policy Management Tools and RSAT: Active
Directory module for Windows PowerShell installed. A domain controller already has both.
Put it somewhere simple, like C:\Temp\.
3. Open PowerShell as an administrator
Right-click Windows PowerShell → Run as administrator.
4. Unblock the file
Windows marks files downloaded from the internet. Clear that flag once:
Unblock-File C:\Temp\Export-ADAuditReport.ps1
5. Allow the script to run in this session
This changes nothing permanently — it applies only to the PowerShell window you have open:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
6. Run it
cd C:\Temp
.\Export-ADAuditReport.ps1
That is it. No parameters are required — it discovers the domain it is joined to.
7. Open the reports
Everything lands in a timestamped folder under C:\GPOReports\:
以上為 README 的開頭部分。其餘內容請閱讀原文。 檢視完整 README ↗
