Most Active Directory audits end up as a PDF report that collects dust for six months before anyone looks at it again. PingCastle takes a different approach: an automatically calculated risk score, reproducible on demand, that turns a one-time snapshot into a trackable metric. For security teams managing production Windows environments, that distinction matters a great deal.
What the PingCastle score actually measures
PingCastle produces a global risk score out of 100. The higher the score, the greater the risk — which is the opposite of a grade, and a common source of confusion the first time you present results to management. The score aggregates four major categories, each evaluated independently, making it straightforward to pinpoint exactly where your security debt is concentrated.
The tool queries the directory over LDAP without requiring agents or elevated privileges in most cases. A standard domain user account is typically enough to generate a complete report — which makes it a natural candidate for regular or even automated runs.
The four risk categories you need to understand
Stale Objects: the ghost accounts no one cleaned up
Stale Objects cover every AD object that has outlived its purpose: user accounts inactive for months, computer accounts with no domain contact for over 45 days, empty groups, groups with no identifiable owner. In an aging or poorly maintained domain, this category alone can push the risk score up significantly.
The threat is tangible. An inactive account remains a valid account until someone explicitly disables it. If its credentials were ever compromised — through phishing, a database leak, or a past breach — the attacker retains access indefinitely, with no automatic revocation to stop them.
Privileged Accounts: mapping your attack surface at the top
This category assesses how privileged accounts are managed: how many Domain Admins exist, whether service accounts carry excessive rights, whether Kerberoastable accounts are present, whether admin passwords have gone unchanged for years. PingCastle also flags accounts that are privileged through abnormal nested group membership — a configuration that manual reviews consistently miss.
In the environments you typically encounter, the Domain Admins group quietly accumulates a dozen members when two or three would cover all legitimate needs. Every extra account is unnecessary attack surface, and unnecessary attack surface tends to get exploited sooner or later.
Trusts: the approval relationships nobody remembers
Active Directory trusts allow users in one domain to access resources in another. That's perfectly legitimate in multi-domain architectures or post-merger environments. The problem arises when those relationships outlive their purpose, when they're bidirectional where one-way would suffice, or when the trusted domain itself has poor security hygiene.
PingCastle maps these trusts and flags risky configurations. A trust pointing to an uncontrolled external domain can provide a lateral movement path that stays completely invisible to teams who never look there.
Anomalies: configurations that simply shouldn't exist
The fourth category catches everything that deviates from a secure baseline: legacy authentication protocols still enabled (NTLMv1, RC4 for Kerberos), missing protections such as Protected Users or Credential Guard, unconstrained Kerberos delegation, and overly permissive password policies. These configuration anomalies don't trigger daily alerts, but they create the conditions that make attacks like Pass-the-Hash or DCSync possible in the first place.
Moving from one-off audits to continuous tracking
A single PingCastle report is useful. Run monthly and compared to the previous period, it becomes a management tool. PingCastle natively generates timestamped HTML reports and supports multi-domain consolidation through its consolidated healthcheck module. The trend of the score over time often tells you more than the score at any single point.
In practice, you can integrate execution into a scheduled script, archive HTML reports in a versioned directory, and push key metrics to a SIEM dashboard or a shared tracking spreadsheet. The core principle is simple: don't let the report be a static document that gets forgotten the day after it's generated.
Building PingCastle into a continuous improvement process
Scoring only has value when it drives action. A solid approach is to define a target threshold per category — for instance, aiming to bring the Privileged Accounts risk score below 25 within a quarter — and to assign each category to a named technical owner. Without ownership, metrics never translate into fixes.
For teams working against frameworks like ISO 27001 or preparing for a certification audit, PingCastle outputs align naturally with access management controls (A.9) and operations security (A.12). It's not a compliance tool per se, but its findings feed directly into the kind of evidence auditors ask for.
PingCastle is available in a free community edition that covers the needs of most SMEs and public sector organizations for auditing and ongoing tracking. The professional edition adds multi-forest consolidation and extended rule sets, which becomes relevant in more complex enterprise environments.
Frequently asked questions
Does PingCastle require administrative rights to run?
In the vast majority of cases, a standard domain user account is sufficient to run a complete healthcheck. Some advanced checks may require additional permissions, but the bulk of the report is accessible without elevated privileges.
How often should PingCastle be run for meaningful tracking?
A monthly cadence strikes a good balance between data freshness and operational overhead. In fast-changing environments or following major infrastructure changes, a bi-weekly or even weekly schedule can be justified.
Does a high PingCastle score mean the domain has been compromised?
No — a high score reflects potential risk, not an active breach. It highlights configurations that make attacks easier if and when they occur. Think of it as a preventive indicator, not an incident alert.
How do you prioritize remediation when multiple categories are in the red?
Start with Privileged Accounts and configuration Anomalies: these are typically the escalation vectors most actively exploited in real-world attacks. Stale Objects, while important, tend to represent a more passive risk and can be addressed in a second phase through a planned cleanup campaign.