ADOpsKit
1.5.0
Active Directory and Entra ID operations toolkit - inventory, health checks, audit reports, and replication topology diagrams. No ADWS dependency for core functions; uses LDAP and repadmin.
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) 2026 K Shankar R Karanth. All rights reserved.
Package Details
Author(s)
- K Shankar R Karanth
Tags
ActiveDirectory AD EntraID AzureAD GPO Replication HealthCheck Audit Inventory DomainController LDAP HTML Report repadmin
Functions
Get-AccountLockoutReport Get-InsecureLDAPBinds Enable-DCPerformanceBaseline Get-ADForestHealth Test-DCPortHealth Get-ADArchitectureAssessment Get-ADReplicationTopologyDiagram Get-GPOInventoryWithSettings Get-EntraConnectSyncStatus Register-ADOpsKitScheduledTasks Test-ADDCDiagHealth Register-ADDCDiagHealthMonitor Invoke-ADRealtimeHeartbeat Get-DCDecommissionReadiness
Dependencies
This module has no dependencies.
Release Notes
v1.5.0 - Security and reliability release. Fixed Get-EntraConnectSyncStatus reading four properties that do not exist on the real ADSync object types, so its sync-error detection never actually worked (always silently reported clean); it now reads the correct schema and correctly surfaces real sync errors. Removed the hidden WinRM/Invoke-Command dependency in Get-ADForestHealth, which failed outright in WinRM-blocked environments despite documentation claiming otherwise. Fixed Get-DCDecommissionReadiness crashing under strict variable checking when a query failed, and silently reporting "OK" on the pre-decommission checklist for checks that had actually failed to run. Added HTML-encoding of AD-sourced values in Get-DCDecommissionReadiness, Get-ADReplicationTopologyDiagram, and Get-ADForestHealth report output (stored-injection risk in reports opened by administrators). Fixed XPath injection in Get-AccountLockoutReport via usernames containing a single quote. Rewrote Enable-DCPerformanceBaseline, whose logman deployment command could not actually execute as intended over WMI and never checked a real exit code. Fixed a leaked credential handle and a non-fatal ACL-hardening failure on a secrets folder in Register-ADDCDiagHealthMonitor. Fixed Register-ADOpsKitScheduledTasks performing a live AD authentication attempt (risking real account lockout) under -WhatIf. Added atomic state-file writes and self-healing on corrupt state to Invoke-ADRealtimeHeartbeat and Test-ADDCDiagHealth, plus per-notification send isolation so one failed alert no longer skips saving state for the run. Added Set-StrictMode -Version Latest and consistent -LiteralPath usage across every script, which surfaced and fixed further latent bugs in Get-GPOInventoryWithSettings and Test-DCPortHealth. Deduplicated a runspace timeout helper that had been copy-pasted between two scripts.
FileList
- ADOpsKit.nuspec
- ADOpsKit.psd1
- ADOpsKit.psm1
- Private\Helpers.ps1
- Public\Enable-DCPerformanceBaseline.ps1
- Public\Get-ADArchitectureAssessment.ps1
- Public\Get-ADForestHealth.ps1
- Public\Get-ADReplicationTopologyDiagram.ps1
- Public\Get-AccountLockoutReport.ps1
- Public\Get-DCDecommissionReadiness.ps1
- Public\Get-EntraConnectSyncStatus.ps1
- Public\Get-GPOInventoryWithSettings.ps1
- Public\Get-InsecureLDAPBinds.ps1
- Public\Invoke-ADRealtimeHeartbeat.ps1
- Public\Register-ADDCDiagHealthMonitor.ps1
- Public\Register-ADOpsKitScheduledTasks.ps1
- Public\Test-ADDCDiagHealth.ps1
- Public\Test-DCPortHealth.ps1
- en-US\about_ADOpsKit.help.txt
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 1.5.0 (current version) | 14 | 7/21/2026 |