KiloClawPowered by OpenClaw
Back to Cookbook
OpenClaw recipe

PingCastle Active Directory Scan Runbook

aka “PingCastle AD Health Check Runbook”

Preflight connectivity, reduce false positives, handle AV flags

PingCastle AD assessments commonly fail or mislead due to DNS/DC discovery issues, missing SMB connectivity for GPO retrieval, absent ADWS (slow scans), and AV/EDR false positives. This runbook makes those failure modes explicit and gives a repeatable preflight-to-report workflow.

House RecipeWork12 min
Try in KiloClawFree 7-day trial

PROMPT

Create a skill called "PingCastle Runbook". Inputs I will provide: - Domain FQDN and (optionally) known DC hostnames/IPs - Where I'm running from (domain-joined host vs jump host) - Any errors or warnings from PingCastle output - Whether SMB/445 is allowed from my host to DCs Task: 1) Generate a preflight checklist (DNS + port reachability). 2) Provide the right PingCastle commands for the situation. 3) If warnings indicate missing SMB/GPO access, explain which parts of the report are unreliable and what to do. 4) Include an AV/EDR handling note consistent with vendor guidance.

What this fixes

Common symptoms:

  • "Domain not found" / DNS discovery failures
  • "The server is not operational" (often stale DC references)
  • False positives/incomplete results when SMB (445) is blocked
  • Very slow runs when ADWS isn't available
  • Tool flagged by AV/EDR as suspicious

Prerequisites

  • Authorization to assess the directory environment
  • A domain-joined assessment host (preferred) or routable access to DCs
  • Network access to required services:
  • LDAP (389), ADWS (9389), SMB (445)
  • PingCastle downloaded from official sources; store hash/signature info

Steps and commands

  1. Preflight — verify name resolution and DC reachability:
  • Resolve the domain:

`nslookup `

  • Quick port checks to a DC:

`nc -vz 389 445 9389`

  1. Run baseline Healthcheck:

`PingCastle.exe --healthcheck --server `

  1. Watch for warnings during the run:
  • If PingCastle warns it cannot download GPOs (SMB blocked), treat results as incomplete.
  • Fix by enabling SMB access from the assessment host, or rerun from a host in the same security zone.
  1. Performance tuning:
  • If ADWS is available on DCs, scans are significantly faster.
  • If scans are slow, validate ADWS presence and connectivity on port 9389.
  1. AV/EDR false positives:
  • Follow vendor guidance: use a controlled allowlist for authorized assessment hosts/users.
  • Prefer running on dedicated assessment hosts; avoid placing PingCastle on general endpoints.
  1. Capture outputs and evidence:
  • Save HTML reports and run log alongside:
  • date/time, host used, PingCastle version, connectivity notes

Expected outputs

  • PingCastle HTML report(s) with a score and prioritized remediation guidance
  • A run log showing which DCs/services were used and any warnings

Common errors and troubleshooting

  • Domain not found / no DNS entries
  • Check DNS settings and DC reachability.
  • Confirm you are using the correct domain FQDN.
  • "The server is not operational"
  • Often indicates DC discovery returned a decommissioned/stale DC.
  • Validate AD Sites & Services and DNS SRV records.
  • Incomplete results when SMB is blocked
  • PingCastle requires SMB to retrieve GPO data; without it, some rules misfire.
  • Fix connectivity or rerun from within the security zone.
  • AV/EDR flags
  • Treat as operational risk; use official releases and documented allowlisting only.

References

  • https://www.pingcastle.com/documentation/
  • https://docs.netwrix.com/docs/pingcastle/3_5
  • https://github.com/netwrix/pingcastle/issues/255
  • https://github.com/netwrix/pingcastle/issues/253
  • https://github.com/netwrix/pingcastle/issues/302

Example inputs

  • ``: corp.example.local
  • ``: 10.0.0.10
Tags:#pentesting#active-directory#pingcastle#troubleshooting#reporting

Related Recipes

AWS Cloud Audit with Prowler (Auth + AccessDenied Triage)

Stop permissions and credential errors from killing cloud assessments

Prowler scans fail or produce noisy logs because of missing read-only permissions, expired session tokens, or credentials not mounted into containers. This recipe standardizes authentication, documents required policies, and provides a repeatable triage flow for AccessDenied and InvalidClientTokenId.

Work15 min

Rootless (or Almost) Network Scans in Containers

Fix raw-socket "Operation not permitted" without --privileged

Least-privilege setup for running Nmap, MASSCAN, or ZMap inside Docker/Podman/Kubernetes. Solves "requires root privileges" and "Operation not permitted" failures without reaching for --privileged. Includes fallbacks when raw sockets are unavailable.

Work10 min

Render Hang Triage

A playbook for "stops at the same frame" and "freeze mid-render" failures

Renders freeze at a consistent percentage or frame — often caused by a bad clip, a heavy effect, a Fusion comp issue, or "stop render on error" settings. This recipe classifies the failure pattern and gives you a structured triage plan instead of blind re-exports.

Creative3 min

Audio Input Lag Fixer

Fix a common Premiere playback-lag issue caused by audio input device settings

Severe playback lag and stutter in Premiere Pro that looks like a codec performance problem but is actually caused by audio hardware input settings. This recipe provides a quick decision tree to test and fix the issue — often resolved in under a minute by switching the default input to "No Input."

Creative3 min