discovering forest
phase Discover RUN
Connecting to ad.evotec.xyz via LDAP (DC01.ad.evotec.xyz)
Forest ad.evotec.xyz: 2 domains, 10 domain controllers, 4 sites
WARN DC10.eu.ad.evotec.xyz responded slowly (812 ms LDAP bind)
phase Discover PASS (2.8s)
phase Collect RUN
collecting rule inputs
Collecting 18 data sources per domain controller
VERB Using cached schema snapshot from 2026-10-15
phase Collect PASS (4.0s)
phase Evaluate RUN
evaluating 332 rules on 6 workers
ad.evotec.xyz (domain) started
ad.evotec.xyz (domain): evaluating 16 rules
eu.ad.evotec.xyz (domain) started
eu.ad.evotec.xyz (domain): evaluating 16 rules
DC01.ad.evotec.xyz started
DC01.ad.evotec.xyz: evaluating 30 rules
DC02.ad.evotec.xyz started
DC02.ad.evotec.xyz: evaluating 30 rules
DC03.ad.evotec.xyz started
DC03.ad.evotec.xyz: evaluating 30 rules
DC04.ad.evotec.xyz started
DC04.ad.evotec.xyz: evaluating 30 rules
lanes: 6 running, 0 done, 6 queued
ERR DC03.ad.evotec.xyz: Credential Guard posture failed - virtualization-based security is off
ERR eu.ad.evotec.xyz (domain): Password never expires failed - 18 user accounts never expire their p
assword
WARN DC01.ad.evotec.xyz: DC locator SRV records - stale SRV record for a retired DC
lanes: 6 running, 0 done, 6 queued
WARN DC01.ad.evotec.xyz: Event log sizes - Directory Service log under 64 MB
ERR DC03.ad.evotec.xyz: Lingering objects failed - 3 lingering objects in the configuration partitio
n
WARN eu.ad.evotec.xyz (domain): Site link costs - 2 site links use default cost 100
eu.ad.evotec.xyz (domain) FAIL: 13 passed, 1 failed, 1 warnings, 1 skipped in 16s
DC05.ad.evotec.xyz started
DC05.ad.evotec.xyz: evaluating 30 rules
ERR DC03.ad.evotec.xyz: DC locator SRV records failed - _ldap._tcp.dc._msdcs record missing
WARN DC02.ad.evotec.xyz: Local administrators - nested group in BUILTIN\Administrators
ERR ad.evotec.xyz (domain): Service account SPN hygiene failed - duplicate SPN HTTP/intranet registe
red twice
WARN DC03.ad.evotec.xyz: krbtgt password age - krbtgt password is 190 days old
DC01.ad.evotec.xyz WARN: 26 passed, 0 failed, 3 warnings, 1 skipped in 17s
DC06.ad.evotec.xyz started
DC06.ad.evotec.xyz: evaluating 30 rules
ERR DC04.ad.evotec.xyz: Unconstrained delegation failed - 2 servers trusted for unconstrained delega
tion
DC02.ad.evotec.xyz WARN: 23 passed, 0 failed, 6 warnings, 1 skipped in 17s
DC07.eu.ad.evotec.xyz started
DC07.eu.ad.evotec.xyz: evaluating 30 rules
WARN ad.evotec.xyz (domain): CA weak key size - issuing CA certificate expires in 9 months
WARN DC05.ad.evotec.xyz: LDAP channel binding - channel binding set to 'when supported'
WARN DC04.ad.evotec.xyz: Local administrators - nested group in BUILTIN\Administrators
DC03.ad.evotec.xyz FAIL: 23 passed, 3 failed, 4 warnings in 19s
DC08.eu.ad.evotec.xyz started
DC08.eu.ad.evotec.xyz: evaluating 30 rules
DC04.ad.evotec.xyz FAIL: 25 passed, 1 failed, 3 warnings, 1 skipped in 19s
DC09.eu.ad.evotec.xyz started
DC09.eu.ad.evotec.xyz: evaluating 30 rules
WARN DC06.ad.evotec.xyz: Secure Boot certificate rollout - update staged, reboot pending
ERR DC07.eu.ad.evotec.xyz: Operating system support failed - Windows Server 2012 R2 is out of suppor
t
WARN DC05.ad.evotec.xyz: Replication latency per partner - latency to DC05 is 42 minutes
ERR DC07.eu.ad.evotec.xyz: Replication latency per partner failed - no successful inbound replicatio
n from DC02 for 4h
WARN DC09.eu.ad.evotec.xyz: Credential Guard posture - Credential Guard configured but not running
ERR ad.evotec.xyz (domain): Functional level failed - domain functional level is Windows Server 2008
R2
ERR DC07.eu.ad.evotec.xyz: USN rollback detection failed - event 2095 logged (USN rollback suspected
)
ad.evotec.xyz (domain) FAIL: 9 passed, 2 failed, 5 warnings in 24s
WARN DC07.eu.ad.evotec.xyz: SYSVOL DFSR state - DFSR backlog of 37 files
lanes: 5 running, 6 done (4 failed), 1 queued
DC10.eu.ad.evotec.xyz started
DC10.eu.ad.evotec.xyz: evaluating 30 rules
ERR DC07.eu.ad.evotec.xyz: Tombstone lifetime failed - tombstone lifetime is 60 days
ERR DC10.eu.ad.evotec.xyz: Print Spooler disabled failed - Spooler service is running
WARN DC10.eu.ad.evotec.xyz: LSA protection enabled - RunAsPPL set without UEFI lock
WARN DC07.eu.ad.evotec.xyz: DNS scavenging - no-refresh interval longer than 7 days
ERR DC10.eu.ad.evotec.xyz: Operating system support failed - Windows Server 2012 R2 is out of suppor
t
WARN DC10.eu.ad.evotec.xyz: NTLM audit configuration - audit enabled for incoming traffic only
WARN DC08.eu.ad.evotec.xyz: Root hints reachable - root hints file older than 2 years
WARN DC10.eu.ad.evotec.xyz: Replication latency per partner - latency to DC05 is 42 minutes
WARN DC08.eu.ad.evotec.xyz: Clock skew - clock skew of 48 seconds
WARN DC09.eu.ad.evotec.xyz: DNS forwarders consistency - one forwarder does not answer
ERR DC10.eu.ad.evotec.xyz: USN rollback detection failed - event 2095 logged (USN rollback suspected
)
ERR DC09.eu.ad.evotec.xyz: Clock skew failed - clock skew of 7 minutes against the PDC emulator
ERR DC06.ad.evotec.xyz: krbtgt password age failed - krbtgt password not changed for 812 days
DC07.eu.ad.evotec.xyz FAIL: 21 passed, 4 failed, 4 warnings, 1 skipped in 16s
lanes: 5 running, 7 done (5 failed), 0 queued
DC05.ad.evotec.xyz WARN: 26 passed, 0 failed, 3 warnings, 1 skipped in 18s
DC08.eu.ad.evotec.xyz WARN: 24 passed, 0 failed, 4 warnings, 2 skipped in 16s
ERR DC10.eu.ad.evotec.xyz: DNS scavenging failed - scavenging disabled on all zones
ERR DC10.eu.ad.evotec.xyz: DC locator SRV records failed - _ldap._tcp.dc._msdcs record missing
DC09.eu.ad.evotec.xyz FAIL: 25 passed, 1 failed, 3 warnings, 1 skipped in 21s
DC06.ad.evotec.xyz FAIL: 24 passed, 1 failed, 4 warnings, 1 skipped in 26s
DC10.eu.ad.evotec.xyz FAIL: 17 passed, 5 failed, 7 warnings, 1 skipped in 20s
phase Evaluate WARN (44s)
phase Report RUN
writing report
lanes: 0 running, 12 done (8 failed), 0 queued
OK Report written to Reports\Assessment-ad.evotec.xyz.html (4.2 MB)
phase Report PASS (1.8s)
332 rules · 256 passed · 18 failed · 47 warnings · 11 skipped
Done.
Run summary
Target Status Passed Failed Warnings Skipped Duration
───────────────────────── ────── ────── ────── ──────── ─────── ────────
ad.evotec.xyz (domain) ✗ FAIL 9 2 5 0 24s
eu.ad.evotec.xyz (domain) ✗ FAIL 13 1 1 1 16s
DC01.ad.evotec.xyz ▴ WARN 26 0 3 1 17s
DC02.ad.evotec.xyz ▴ WARN 23 0 6 1 17s
DC03.ad.evotec.xyz ✗ FAIL 23 3 4 0 19s
DC04.ad.evotec.xyz ✗ FAIL 25 1 3 1 19s
DC05.ad.evotec.xyz ▴ WARN 26 0 3 1 18s
DC06.ad.evotec.xyz ✗ FAIL 24 1 4 1 26s
DC07.eu.ad.evotec.xyz ✗ FAIL 21 4 4 1 16s
DC08.eu.ad.evotec.xyz ▴ WARN 24 0 4 2 16s
DC09.eu.ad.evotec.xyz ✗ FAIL 25 1 3 1 21s
DC10.eu.ad.evotec.xyz ✗ FAIL 17 5 7 1 20s
───────────────────────── ────── ────── ────── ──────── ─────── ────────
Total 256 18 47 11