Skip to main content
Bulwark

​
Bulwark — Active Directory Health Check Engine

Bulwark is a standalone Active Directory health check and compliance auditing engine written in Go. It collects data from AD environments via LDAP and ADWS, evaluates over 100 built-in security rules, scores the domain on a 0–100 scale, and exports findings as JSON, XML, YAML, or interactive HTML reports. Bulwark ships as a single binary with both a TUI (terminal UI) and a full CLI. No installation, no database, no dependencies — just point it at a domain controller and run.

​
What Bulwark Does

CapabilityDescription
Health CheckComprehensive AD security assessment with 100+ built-in rules
ScoringGlobal health score (0–100) with category sub-scores
Maturity LevelMaturity rating derived from the global score
Supplemental RulesUser-defined rules in YAML, JSON, or XML with LDAP fallback queries
Multi-ProtocolLDAP, LDAPS, StartTLS, and ADWS scanning
ExportJSON, XML, YAML, HTML, or all formats simultaneously
TUIInteractive terminal UI for guided operation
CLIFull command-line interface for automation and scripting
Entra IDAzure AD / Microsoft Entra ID tenant assessment
CartographyAD object relationship mapping
VisualizationAD trust and topology visualization

​
Quick Start

​
CLI

# Basic health check
bulwark healthcheck -u admin@corp.example.com -p 'P@ssw0rd' -d corp.example.com -t dc01.corp.example.com

# Export as HTML report
bulwark healthcheck -u admin@corp.example.com -p 'P@ssw0rd' -d corp.example.com -t dc01.corp.example.com --export html

# Export all formats
bulwark healthcheck -u admin@corp.example.com -p 'P@ssw0rd' -d corp.example.com -t dc01.corp.example.com --export all

# With supplemental rules
bulwark healthcheck -u admin@corp.example.com -p 'P@ssw0rd' -d corp.example.com -t dc01.corp.example.com --rules /path/to/rules/

# TLS options
bulwark healthcheck -u admin@corp.example.com -p 'P@ssw0rd' -d corp.example.com -t dc01.corp.example.com --ldaps
bulwark healthcheck -u admin@corp.example.com -p 'P@ssw0rd' -d corp.example.com -t dc01.corp.example.com --starttls

​
TUI

# Launch interactive terminal UI
bulwark
The TUI provides guided menus for configuration, scan execution, rule management, and result viewing.

​
Scan Modes

ModeCommandDescription
Health CheckhealthcheckFull AD security assessment with rule evaluation and scoring
ScannerscannerData collection only (no rule evaluation)
CartographercartoAD object relationship mapping
VisualizervisualizeTrust and topology visualization
ExporterexportRe-export previously collected data in different formats
Entra IDentraidAzure AD / Microsoft Entra ID tenant assessment

​
Scoring

Bulwark calculates a global health score (0–100) from four weighted category scores:
CategoryDescription
Stale ObjectsInactive accounts, expired passwords, legacy encryption, functional level
Privileged AccountsAdmin group hygiene, service accounts in admin groups, delegation risks
Trust RelationshipsCross-domain trusts, SID filtering, trust configuration
AnomaliesMisconfigurations, missing security features, exposed services

​
Maturity Level

The maturity level is derived from the global score and indicates the overall AD security posture.

​
Authentication

OptionDescription
-u / --userUsername in UPN format (user@domain.com)
-p / --passwordPassword
-d / --domainDomain FQDN
-t / --targetDomain controller IP or hostname

​
TLS Options

FlagDescription
--ldapsUse LDAPS (port 636)
--starttlsUse StartTLS on standard LDAP (port 389)
--insecureSkip TLS certificate verification

​
Protocol Selection

ModeBehavior
LDAP then ADWS (default)Try LDAP first, fall back to ADWS if it fails
ADWS then LDAPTry ADWS first, fall back to LDAP
LDAP onlyOnly use LDAP
ADWS onlyOnly use ADWS

​
Export Formats

FormatFlagDescription
JSON--export jsonMachine-readable JSON with all collected data and findings
XML--export xmlXML export
YAML--export yamlYAML export
HTML--export htmlInteractive HTML report with charts, tables, and drill-down
All--export allExport to every format simultaneously
Output is written to ./bulwark.out/ by default, or a custom path via --output.

​
Data Collection

Bulwark collects comprehensive AD state data including:
CategoryData Points
DomainFQDN, NetBIOS, SID, creation date, functional levels, schema version
UsersTotal, enabled, disabled, active, inactive, locked, password flags (never expires, not required, reversible encryption, DES, no pre-auth), SID history, delegation, LAPS
ComputersSame metrics as users, plus OS distribution and LAPS coverage
GroupsPrivileged group membership, service accounts, nested membership
TrustsTrust relationships, types, SID filtering, transitivity
Domain ControllersFSMO roles, OS versions, reachability, SMB/Kerberos settings
GPOsAudit policies, LSA settings, WSUS, Defender ASR, screen saver, firewall rules, hardened paths
PKICertificate authorities, templates, enrollment services, trusted certificates
ExchangeInstall date, schema version, privilege escalation risks
DNSAD-integrated DNS zones
Azure ADSSO account, AD Connect, tenant info, Kerberos trust
Password DistributionAge distribution histograms for passwords and LAPS
Control PathsACL-based attack paths and dangerous permissions
DelegationUnconstrained, constrained, and protocol transition delegation