ADOutline - Active Directory Documentation Tool

Introducing ADOutline: Active Directory Documentation for the Hybrid Identity Era

 

ADOutline answers a simple but important question: What is actually configured in Active Directory right now? It is designed to document the current state, not to score, grade, or remediate the environment.

 

I originally published Active Directory documentation utilities and guidance through portal.sivarajan.com. ADOutline is the relaunch and modernization of that work for today’s identity environment. The goal is still simple: make Active Directory documentation easier, repeatable, and useful. But the environment around AD has changed. The new ADOutline therefore extends the documentation beyond traditional on-premises Active Directory and can surface signals associated with Microsoft Entra Connect, Okta, Ping, SailPoint, JumpCloud, Duo, Google Cloud Identity, and AD FS when evidence is present.

Download ADOutline

ADOutline is open source and available on GitHub.
https://github.com/SanthoshSivarajan/ADOutline

Direct ZIP download:
https://github.com/SanthoshSivarajan/ADOutline/archive/refs/heads/main.zip

Figure 1 - ADOutline landing page and report navigation. The report is a self-contained HTML document with a structured left-side index.

Why Active Directory Documentation Still Matters

Active Directory remains foundational to authentication, authorization, server access, application dependencies, Group Policy, DNS, PKI, and many hybrid identity designs. Yet the configuration is often distributed across years of changes, migrations, mergers, administrator turnover, and infrastructure refreshes.

The operational problem is rarely that no one knows anything about the directory. The problem is that knowledge is fragmented. A domain administrator may know the domain controllers, another engineer may know the trusts, a cloud team may know Microsoft Entra Connect, and a security team may know the privileged-access model. What is usually missing is one repeatable, point-in-time document that brings those facts together.

ADOutline is intended to fill that gap by collecting the configured state and rendering it into a readable report that can be archived, handed to another team, attached to a ticket, used during a migration, or retained as a baseline.

What ADOutline Is - and What It Is Not

ADOutline is	ADOutline is not
Current-state documentation	A security assessment
Read-only data collection	A remediation engine
A single self-contained HTML report	A cloud-hosted reporting service
A point-in-time record of configuration	A scorecard or maturity rating
A documentation and handover aid	A replacement for engineering judgment

 

The distinction is deliberate: ADOutline records the facts. If you want a visual map, ADAtlas is intended to help you see the environment; if you want health analysis, ADCanvas is intended to help you understand the environment.

 

A Relaunch for the Hybrid Identity Era

This project is not a disconnected new utility. It is the next generation of the Active Directory documentation work I previously shared through portal.sivarajan.com. The original focus was the on-premises directory. That remains the foundation, but modern identity architecture now includes synchronization, federation, SaaS identity providers, MFA platforms, identity governance, and other services connected to AD.

That is why the relaunched ADOutline broadens the documentation model. When directory evidence is available, the report can surface signals associated with Microsoft Entra Connect, Okta, Ping, SailPoint, JumpCloud, Duo, Google Cloud Identity, and AD FS. The objective is not to claim complete configuration knowledge of every external product; it is to document the identity ecosystem that Active Directory appears to participate in.

Figure 2 - Forest and Domain Map showing Microsoft Entra ID / cloud-directory synchronization as part of the hybrid identity picture.

Figure 3 - Example of identity-platform detection in the Forest and Domain Map, here showing Okta alongside the AD forest.

What the Tool Documents

The current ADOutline project describes 47 report sections and 11 interactive diagrams. The exact information available depends on the environment and the collection rights, but the coverage can be grouped into several major areas.

1. Forest, Domains, and Core Directory Configuration

·         Forest and domain structure, including domain functional levels and naming contexts.

·         Domain controller inventory and controller capabilities.

·         FSMO role placement.

·         Trust relationships and decoded trust attributes.

·         Application partitions and selected forest-level settings.

·         Directory settings such as schema version, tombstone lifetime, and AD Recycle Bin state.

Figure 4 - Core directory documentation: forest settings, domains, domain controllers, functional levels, capability status, and naming contexts.

2. Topology and Architecture Diagrams

Documentation is much more useful when engineers can see relationships rather than only read tables. ADOutline therefore generates interactive SVG-based diagrams for major architectural elements.

·         Forest and Domain Map

·         Trust Map

·         Replication Topology

·         FSMO Placement

·         Site Topology

·         Certification Authority hierarchy

·         DNS architecture

·         Exchange architecture

·         Time hierarchy

·         OU hierarchy

·         Other supporting relationship diagrams exposed by the collected state

Figure 5 - Replication Topology and FSMO Placement diagrams. These views provide a fast architectural summary without requiring separate diagramming software.

3. Object Population and Operational Baselines

The report records population-level information rather than attempting to retain every directory object. This keeps the report readable and helps collection scale to larger environments.

·         Enabled and disabled user-account counts.

·         Locked accounts and password-state indicators.

·         Password-never-expires and pre-authentication-related account states.

·         Administrative-account indicators such as adminCount.

·         Inactive account counts across multiple age bands.

·         Computer-account population and operating-system distribution.

·         Group population and group-scope distribution.

Figure 6 - Object Population and Operating Systems. ADOutline presents directory populations as charts and counts rather than dumping every object into the report.

4. Identity Platforms and Hybrid Identity Signals

One of the most important improvements in the relaunched version is the recognition that AD documentation must include identity technologies connected to the directory. ADOutline can use directory objects, published service connection points, and selected software/agent evidence on domain controllers to identify identity-platform signals.

·         Microsoft Entra Connect / Microsoft Entra ID synchronization-related signals

·         Okta

·         Ping

·         SailPoint

·         JumpCloud

·         Duo

·         Google Cloud Identity

·         AD FS

This is especially valuable during consulting engagements, migrations, acquisitions, and troubleshooting because it helps answer not only 'What is in AD?' but also 'What appears to be connected to AD?'

5. Lineage, Upgrade, and Migration History

A directory contains historical evidence. ADOutline uses several forms of metadata and well-known artifacts to help document how the environment evolved over time.

·         ADPREP operation clusters that can help date upgrade activity.

·         Creation dates of milestone containers associated with specific Windows Server generations.

·         Schema-extension timelines that can reveal when products such as Exchange, Configuration Manager, or legacy LAPS extended the schema.

·         Migration artifacts such as ADMT-related groups and sIDHistory.

·         Functional-level change history where replication metadata provides usable evidence.

·         FRS remnants alongside DFSR and other indicators of older directory configurations.

6. Security-Relevant Configuration - Documented, Not Scored

Although ADOutline is not a security assessment, good documentation must include security-relevant configuration. The tool records these items as facts or observations rather than converting them into pass/fail findings.

·         Legacy Microsoft LAPS and Windows LAPS indicators.

·         Password policies and Fine-Grained Password Policies.

·         Kerberos-related configuration and KRBTGT age.

·         AdminSDHolder-related information.

·         dMSA migration state and superseded-account linkage where available.

·         Time-source and hierarchy information.

·         Custom password filters and LSA packages.

·         Selected backup-state evidence and domain-controller configuration details.

7. Supporting Infrastructure

·         DNS architecture and zone replication behavior.

·         PKI / Certification Authority hierarchy.

·         Exchange-related architecture signals.

·         NTP / time hierarchy.

·         OU hierarchy.

·         DHCP authorization.

·         AD FS farm information where visible.

·         Domain-controller software inventory and detected product patterns.

Figure 7 - Software detected on domain controllers, including security and backup products. ADOutline clearly labels pattern-based detection as indicative rather than proof of product configuration or active use.

How ADOutline Collects Data

A major design goal is to reduce prerequisites. ADOutline communicates with Active Directory using System.DirectoryServices.Protocols rather than relying on the ActiveDirectory PowerShell module. That means RSAT is not required, and the tool can be used from a Windows system that has network line of sight to the target domain controllers.

Collection Tiers

Tier	Method	Typical rights	What it adds
A	LDAP	Domain User	Most directory-based sections
B	SMB to SYSVOL	Domain User	GPO templates and Kerberos-policy material
C	CIM / DCOM to DCs	Local Administrator on the DC	Hardware, services, hotfixes, registry, and event-log summaries

The tiers degrade independently. If a higher-privilege collection path is unavailable, the lower-tier data can still be collected, and the report includes a permissions-by-section view so that 'not readable' is not confused with 'not configured.'

Running ADOutline

For a domain-joined machine with suitable network access, the basic execution is intentionally simple:

.\ADOutline.ps1

From a non-domain-joined Windows system, alternate credentials and a target server can be supplied:

$cred = Get-Credential
.\ADOutline.ps1 -Server dc01.contoso.com -Credential $cred

To collect directory-focused data while skipping Tier C:

.\ADOutline.ps1 -SkipTierC

To re-render an earlier collection without reconnecting to the directory:

.\ADOutline.ps1 -FromState '.\ADOutline_contoso_com_20260802_143915.state.json'

Key Parameters Worth Knowing

Parameter	Purpose
-Server	Target a specific domain controller or domain; especially useful from a non-domain-joined machine.
-Credential	Use alternate credentials.
-OutputPath	Choose where the HTML report, state file, and log are created.
-FromState	Re-render a saved state file without directory access.
-SkipTierC	Skip CIM/DCOM collection from domain controllers.
-ExcludeDC	Exclude one or more domain controllers from collection.
-NoProbe	Skip the startup capability probe.
-NoHtml	Collect state without creating the HTML report.
-NoState	Create the report without keeping a state JSON file.
-ShowDetail	Increase console detail during execution.
-SkipHotfixScan	Skip hotfix enumeration.
-SkipSoftwareScan	Skip installed-software enumeration.

What the Tool Produces

A normal collection creates three artifacts:

1.  A self-contained HTML report. No CDN or external web assets are required.

2.  A JSON state file containing the collected data before rendering.

3.  A timestamped collection log.

The state file is strategically important. It separates collection from presentation: an existing collection can be re-rendered later without returning to the customer environment or touching the directory again. It also creates a foundation for comparing point-in-time states.

Where ADOutline Fits in the Documentation Lifecycle

ADOutline is most useful when it is treated as a documentation baseline rather than a once-only utility. Run it before a major project, retain the report and state file, and repeat the collection after significant changes.

Scenario	How ADOutline helps
Mergers & acquisitions	Document each forest before consolidation, separation, or trust redesign.
AD modernization	Capture the existing topology and dependencies before functional-level, DC, DNS, or replication changes.
Cloud / hybrid identity	Show the on-premises foundation and visible identity-platform integration signals in one report.
Audit preparation	Provide a repeatable factual record instead of relying on tribal knowledge.
MSP or team handover	Give the receiving team a readable current-state baseline.
Disaster recovery	Archive a known-good architectural reference for use during recovery planning and validation.
Consulting discovery	Reduce the time spent manually assembling domain, trust, topology, and supporting-service facts.
Change validation	Run before and after major changes to create two point-in-time records.

Why the Single-Script Model Matters

ADOutline is deliberately delivered as a single PowerShell script rather than a traditional module. For consulting, discovery, and customer environments, this can materially simplify the security-review conversation: there is one artifact to inspect, no module installation, no PSGallery dependency, and no persistent software footprint.

The packaging supports the tool's trust model: read-only collection, no agents, no installation, and no requirement to send environment data to an external service.

 

ADOutline, ADAtlas, and ADCanvas

These tools are complementary rather than interchangeable. A useful way to explain the family is:

Tool	Primary purpose	Question answered
ADOutline	Documentation	What is configured right now?
ADAtlas	Visualization	What does the environment look like?
ADCanvas	Analysis	What does the environment mean from a health/security perspective?
ADLens	Change tracking	How has the environment changed over time?

A Practical Documentation Workflow

1.  Run ADOutline from a suitable Windows system with network access to the directory.

2.  Review the Collection Rights / permissions section first to understand which data sources were available.

3.  Review the forest, domain, DC, trust, and topology sections to establish the architectural baseline.

4.  Review the identity-platform section to understand visible hybrid identity dependencies.

5.  Review object populations, supporting services, and domain-controller configuration.

6.  Save the HTML, state JSON, and log together as a dated evidence package.

7.  Repeat the collection after material architecture changes and retain both snapshots.

Why I Built ADOutline as a Documentation Tool

I do not position ADOutline as another AD scanner or a security scorecard. It is an automated current-state documentation engine for Active Directory and its surrounding identity infrastructure. The value is straightforward: turn live directory configuration into a consistent, portable, point-in-time document with diagrams, tables, population summaries, and hybrid-identity context.

ADOutline turns Active Directory configuration into documentation: one PowerShell script, one collection, one self-contained report.

 

Important Usage Notes

·         Treat identity-platform and installed-software detection as evidence-based indicators. Pattern detection does not prove that a product is licensed, configured, or actively used.

·         A missing section can reflect missing permissions or connectivity rather than an absent feature; review the report's collection-rights information.

·         ADOutline is documentation, so it should not be presented as a substitute for a security assessment or formal architecture review.

·         Protect generated reports and state files appropriately because they may contain sensitive infrastructure metadata.

Conclusion

Good Active Directory documentation should not depend on a person remembering how the forest evolved. It should be repeatable, current, readable, and easy to archive. ADOutline is designed around that goal.

The relaunched version extends the original documentation concept into the hybrid identity era: it still records the foundational AD configuration, but it also brings Microsoft Entra Connect and other connected identity-platform signals into the same documentation story. That makes the output useful not only for AD administrators, but also for identity architects, security teams, auditors, consultants, migration teams, and anyone who needs to understand the current shape of an Active Directory environment.

#ActiveDirectory #ADDocumentation #PowerShell #IdentitySecurity #HybridIdentity #MicrosoftEntra #EntraID #MicrosoftEntraConnect #IAM #IdentityManagement #CyberSecurity #WindowsServer #MicrosoftSecurity #Okta #ADSecurity #ZeroTrust #ITDocumentation #ActiveDirectorySecurity #DirectoryServices

Posted in: