PowerShell · ADOpsKit

ADOpsKit – PowerShell Module for Active Directory Operations

ADOpsKit is a PowerShell Gallery module that packages commonly needed Active Directory operations into a single install: DC health checks, replication topology diagrams, GPO inventory, LDAP security auditing, account lockout tracing, and Entra Connect sync monitoring.

By K Shankar R Karanth PowerShell Active Directory Module Guide

Quick idea: Install ADOpsKit once from the PowerShell Gallery and get ready-to-run Active Directory functions for reporting, auditing, health checks, and operational troubleshooting.

Health

DC health reports, port tests, and performance baseline deployment across the environment.

Audit

Account lockout tracing and insecure LDAP bind detection through event log analysis.

Inventory

AD architecture assessment, replication topology diagrams, and GPO inventory reporting.

Overview

ADOpsKit is built for Active Directory administrators, infrastructure engineers, and SRE teams who need repeatable operational checks without rebuilding the same scripts every time.

The module brings together health checks, inventory reports, security audits, lockout reporting, GPO visibility, and hybrid identity monitoring into one installable package.

View on PowerShell Gallery View Source on GitHub

Installation

Install ADOpsKit directly from the PowerShell Gallery. No manual download or cloning is required.

# Install for the current user. Admin rights are not required.
Install-Module ADOpsKit -Scope CurrentUser

# Install system-wide. Run PowerShell as Administrator.
Install-Module ADOpsKit -Scope AllUsers

# Verify the install and list available functions.
Get-Command -Module ADOpsKit

If you are on Windows Server 2016, 2019, or 2022 with a restricted TLS configuration, run the following line first. Without it, the Gallery connection may fail with an SSL or TLS error.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-Module ADOpsKit -Scope CurrentUser

Permanent TLS fix: To avoid setting TLS manually every session, enable strong crypto for .NET on the server.

Set-ItemProperty `
  -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' `
  -Name 'SchUseStrongCrypto' `
  -Value 1 `
  -Type DWord

Prerequisites

Different functions in ADOpsKit have different requirements. The table below shows the main dependencies.

Category	Requirement
All functions	Windows PowerShell 5.1 or later, with permissions appropriate to the target environment.
Health, Audit, GPO	Active Directory RSAT PowerShell module.
GPO functions	Group Policy PowerShell module.
Replication diagram	`repadmin.exe` available on the path. This is included with RSAT and on Domain Controllers.
Entra Connect	ADSync module installed with Entra Connect on the sync server.
Network	Connectivity to Domain Controllers over LDAP, RPC, SMB, WMI, or WinRM depending on the function.

Function Overview

Function	Category	Notes
`Get-ADReplicationTopologyDiagram`	Inventory	Builds an HTML/SVG replication topology diagram using LDAP and repadmin.
`Get-ADArchitectureAssessment`	Inventory	Creates a broad AD inventory and assessment report.
`Get-ADForestHealth`	Health	Generates a forest-wide Domain Controller health report.
`Test-DCPortHealth`	Health	Tests critical AD-related TCP ports across Domain Controllers.
`Enable-DCPerformanceBaseline`	Health	Deploys Performance Monitor baseline collectors to Domain Controllers.
`Get-AccountLockoutReport`	Audit	Reports locked accounts and likely source computers using Event ID 4740.
`Get-InsecureLDAPBinds`	Audit	Detects unsigned and simple LDAP binds using Event ID 2889.
`Get-GPOInventory`	GPO	Inventories GPO metadata, links, permissions, and WMI filters.
`Get-GPOInventoryWithSettings`	GPO	Reads configured settings from GPO XML reports.
`Get-EntraConnectSyncStatus`	Hybrid Identity	Reports Entra Connect sync health and connector status.

Get-ADReplicationTopologyDiagram

This function generates a self-contained HTML file with an SVG diagram of your Active Directory replication topology. The PDC Emulator sits in the centre, while other Domain Controllers are arranged around it.

Site membership is colour-coded and replication health is shown per link. The function is useful when you need a quick visual of how Domain Controllers are connected and where failures are appearing.

Gold Border

PDC Emulator and central reference point in the topology.

Blue Border

Standard Domain Controller with healthy replication.

Red Border

Domain Controller with one or more replication failures.

# Generate with a default output path.
Get-ADReplicationTopologyDiagram -OutputPath "C:\temp\topology.html"

# Target a specific DC to query.
Get-ADReplicationTopologyDiagram `
  -DomainController "DC01.corp.contoso.com" `
  -OutputPath "C:\Reports\ADTopology.html"

How it works: DC inventory comes from the Configuration partition over LDAP. Replication partnerships come from repadmin /showrepl * /csv.

Get-ADForestHealth

This function produces a colour-coded health report for Domain Controllers across the forest. It discovers domains, identifies Domain Controllers, runs health checks, and produces a consolidated HTML output.

# Run with defaults.
Get-ADForestHealth

# Write report to a network share.
Get-ADForestHealth -OutputFolder "\\fileserver\Reports\ADHealth"

Typical checks include DCDiag results, replication health, OS drive free space, CPU usage, memory usage, and uptime.

Test-DCPortHealth

This function tests critical Active Directory TCP ports against Domain Controllers. It is useful when authentication, LDAP, DNS, SMB, RPC, or Global Catalog connectivity appears inconsistent.

# Default timeout.
Test-DCPortHealth

# Custom timeout with CSV export.
Test-DCPortHealth -TimeoutSeconds 5 -ExportPath "C:\temp\DCPortHealth.csv"

Authentication

Kerberos, Kerberos password change, and DNS checks.

Get-AccountLockoutReport

This function queries currently locked AD accounts, searches Security Event ID 4740 on the PDC Emulator, and attempts to identify the source computer that triggered each lockout.

# Default paths and lookback.
Get-AccountLockoutReport

# Custom paths and 24-hour lookback.
Get-AccountLockoutReport `
  -TempPath "D:\temp" `
  -SharedPath "\\fileserver\Reports\Lockouts" `
  -LookbackMilliseconds 86400000

Operational use: Schedule this from a secured admin host or management server to build a recurring lockout investigation trail.

Get-InsecureLDAPBinds

This function detects clients performing unsigned LDAP binds or simple binds over non-SSL connections by reading Event ID 2889 from Domain Controllers.

It is especially useful before enforcing LDAP signing or channel binding policies, because it helps identify legacy applications and appliances that need remediation first.

# Check the last 24 hours across Domain Controllers.
Get-InsecureLDAPBinds

# Check the last 72 hours and export to a custom folder.
Get-InsecureLDAPBinds -Hours 72 -OutputPath "C:\temp\LDAPBinds"

Before enforcing LDAP signing: Run the report for at least a full week to catch scheduled tasks, monitoring tools, and infrequent legacy application binds.

Get-GPOInventory

This function generates a GPO inventory report for a domain. It collects GPO names, timestamps, links, status, permissions, trustees, and WMI filter information.

Get-GPOInventory -DomainName "corp.contoso.com"

# Custom output path.
Get-GPOInventory `
  -DomainName "corp.contoso.com" `
  -OutputPath "D:\Reports\GPOInventory.html"

Get-GPOInventoryWithSettings

This function extends GPO inventory by parsing raw XML from Get-GPOReport and extracting the actual configured settings inside each GPO.

Get-GPOInventoryWithSettings -DomainName "corp.contoso.com"

# Custom output path.
Get-GPOInventoryWithSettings `
  -DomainName "corp.contoso.com" `
  -OutputPath "D:\Reports\GPOWithSettings.html"

Use case: Run this before a migration, audit, or domain consolidation to understand what your GPO estate is actually configuring.

Get-ADArchitectureAssessment

This function creates a broad Active Directory inventory covering domains, Domain Controllers, users, computers, groups, OUs, sites, site links, replication health, GPOs, ports, and services.

Get-ADArchitectureAssessment `
  -DomainName "corp.contoso.com" `
  -OutputFolder "C:\temp\ADAssessment"

Use for handover documentation: Run this when taking over a new environment. The HTML output provides a useful architecture summary, while JSON and CSV outputs can support deeper review.

Enable-DCPerformanceBaseline

This function creates and starts a Performance Monitor Data Collector Set on Domain Controllers. It captures CPU, memory, disk, network, NTDS, and LDAP counters at regular intervals.

# Deploy to all discovered Domain Controllers.
Enable-DCPerformanceBaseline

Common counters include processor usage, available memory, disk activity, free disk space, network throughput, LDAP searches, directory reads, and directory writes.

Safe to re-run: If a Data Collector Set already exists on a DC, the function should warn rather than blindly overwrite the existing collector.

Get-EntraConnectSyncStatus

This function reports the health and sync status of an Entra Connect server. It can collect sync cycle details, connector status, error counts, password hash sync status, staging mode, auto-upgrade configuration, and pending export information.

# Run on the Entra Connect server itself.
Get-EntraConnectSyncStatus

# Run against a remote Entra Connect server.
Get-EntraConnectSyncStatus -ComputerName "AADCONN01"

# Export connector statistics.
Get-EntraConnectSyncStatus `
  -ComputerName "AADCONN01" `
  -ExportPath "C:\temp\EntraConnectStatus.csv"

Check	Healthy Value
Staging Mode	`False`, unless this is intentionally a staging server.
Sync Enabled	`True`.
Scheduler Suspended	`False`.
Auto-Upgrade	`Enabled`, depending on operational policy.
Export Errors	`0` per connector.
Import Errors	`0` per connector.
Password Sync Enabled	`True`, if Password Hash Sync is your authentication method.

Updating and Managing the Module

# Check installed version.
Get-Module ADOpsKit -ListAvailable

# Update to the latest version.
Update-Module ADOpsKit

# Check available versions on PowerShell Gallery.
Find-Module ADOpsKit -AllVersions

# Remove the module.
Uninstall-Module ADOpsKit

Quick Reference

Function	What It Does	Useful Parameter
`Get-ADReplicationTopologyDiagram`	Builds an HTML/SVG topology diagram of DC replication.	`-OutputPath`
`Get-ADForestHealth`	Creates a forest-wide Domain Controller health report.	`-OutputFolder`
`Test-DCPortHealth`	Tests AD-related TCP ports across Domain Controllers.	`-TimeoutSeconds`, `-ExportPath`
`Get-AccountLockoutReport`	Reports locked accounts and likely lockout source computers.	`-SharedPath`, `-LookbackMilliseconds`
`Get-InsecureLDAPBinds`	Finds clients using unsigned or simple LDAP binds.	`-Hours`, `-OutputPath`
`Get-GPOInventory`	Reports GPO metadata, links, permissions, and WMI filters.	`-DomainName`, `-OutputPath`
`Get-GPOInventoryWithSettings`	Reports GPO inventory including configured settings.	`-DomainName`, `-OutputPath`
`Get-ADArchitectureAssessment`	Builds a broad AD inventory and assessment report.	`-DomainName`, `-OutputFolder`
`Enable-DCPerformanceBaseline`	Deploys a performance baseline collector to Domain Controllers.	Auto-discovers DCs.
`Get-EntraConnectSyncStatus`	Reports Entra Connect health and connector statistics.	`-ComputerName`, `-ExportPath`

Source & Module

The module is published on the PowerShell Gallery, and the source lives in GitHub. Review the code before production use, test in a lab, and adjust execution permissions according to your environment.