The agent delivers facts, the assessment happens on the server
In most organisations Active Directory is the system whose compromise decides everything else, and the BSI module APP.2.2 requires in A23 the regular analysis of permissions and the attack paths that follow from them. The module checks five areas of a domain for that: what is readable in the directory, via LDAP with an ordinary read account; what is only visible on the domain controllers themselves, the certificate authority, the access control lists and the group policies, via the probe of the isidaten agent. The agent delivers states, never passwords, and the check rules live on the server so that a new rule needs no agent release.
Coverage is not a traffic light but a map per family: basic, partial, complete. Risk score and maturity exist only from "partial" upwards, and no aggregate is formed across directories with mixed coverage. A green rating on half a basis would be more dangerous than none at all.
Active Directory caps every search server-side at 1000 objects and silently returns nothing beyond that. The module therefore always reads page by page, and a run that did not read to the end writes new findings but closes none. An attribute the read account may not see counts as not assessable, never as passed.
Three hundred accounts without password expiry are not three hundred times as dangerous as one. Every open check rule counts once with its points, in four areas capped at 100, and the overall score is the maximum, not the sum. If the probe reports a gap the report also knows, it counts once.
Evidence for APP.2.2 A23 that says what was checked and what was not, instead of a grade that blurs the two.
Schedule a no-obligation demo – we will show you the module with your own use cases.
