Configuring the Active Directory connector for on-premises audits

Cloud identity is only half the picture. Most organisations still run on-premises Active Directory, and it concentrates some of the most sensitive access in the environment. The AD connector lets EntraGUARD audit your domain configuration read-only, alongside your cloud referentials.

What the AD connector audits

The Active Directory connector reads your domain configuration to evaluate controls around privileged groups (Domain Admins, Enterprise Admins), password and lockout policy, Kerberos settings, delegation, stale accounts, and the overall structure of your directory. Like every EntraGUARD connector, it operates strictly read-only.

Prerequisites

• The machine running EntraGUARD must reach a domain controller over LDAP (389) or LDAPS (636).
• A domain account for read access (a dedicated service account is recommended).
• Network line of sight to the DC — if you audit from outside the domain network, ensure the relevant ports are open.

Configuring the connection

On the Connectors screen, open the Active Directory card and provide the Domain (fully qualified, e.g. corp.contoso.com), an LDAP host (a reachable domain controller, or auto-discover via the domain), the port and security (636 with LDAPS is strongly recommended), and the credentials of the read account in DOMAIN\user or UPN form.

Why LDAPS matters

Plain LDAP on port 389 transmits the bind credentials and query results without encryption. For an audit tool that reads sensitive directory data, always prefer LDAPS on 636. If your domain controllers do not yet have a certificate for LDAPS, that itself is a finding worth raising.

Using a dedicated service account

Rather than a personal admin account, create a dedicated read-only service account for audits. It gives clear traceability (reads are attributable to one identity), no elevation (the account holds no privileged group membership), and easy rotation (you can reset or disable it without affecting a person).

Validating the connection

After saving, use the Test action on the AD card. A successful test binds to the directory and reads a handful of objects. Once it succeeds, the card shows a Configured badge and AD controls will be included in your next audit.

Common issues

• Cannot bind — wrong credentials or the account is locked/disabled. Confirm the account can sign in normally.
• Server unreachable — firewall or DNS. Verify you can resolve the domain and reach 389/636 from the audit machine.
• LDAPS handshake fails — the DC has no valid certificate, or it is untrusted by the audit machine. Install a proper LDAPS certificate on the DC.

Auditing AD and Entra ID together

The real value comes from auditing on-premises AD and cloud Entra ID side by side. Hybrid environments often have gaps at the seam — synced privileged accounts, legacy delegation, inconsistent MFA coverage. Configuring both connectors gives you one unified compliance score across your whole identity estate.