Maester Hardening Guide

Maester runs hundreds of security checks against your Microsoft 365, Entra ID, and Active Directory environment and hands you a wall of green and red. Then what? A pass/fail badge tells you a switch position — it doesn't tell you what the finding means, whether it's actually a problem in your tenant, or what to do about it.

This book is the missing other half. It walks all 676 Maester tests, one at a time, and for each one answers the three questions the badge leaves open:

• The risk — what this control actually protects against, in plain language.
• Run this first — the real, verified PowerShell (the actual Maester test function, not a paraphrase) to reproduce and inspect the finding yourself.
• The verdict & how to fix it — how to read the result, tell an expected finding from a real one, and the concrete step to remediate.

It's organized in two parts. Part I covers the 407 Microsoft 365 and Entra ID tests across twelve control domains — identity and privileged access, authentication and MFA, Conditional Access, applications and consent, devices, email security, collaboration and external sharing, data protection, and tenant configuration. Part II covers the 269 on-premises Active Directory tests from Maester's dedicated AD module — Kerberos and account exposure, delegation, privileged groups, GPOs, DACLs, trusts, replication, and more — across nineteen categories.

Woven through both parts are field notes from a real, multi-month remediation program (fully genericized — no company, domain, or account names), covering the traps that only show up in practice: a "failed" admin-MFA check that just means the account structurally can't register; a DCSync-capable account that turns out to be an orphaned permission from a user deleted years ago; a single pass/fail check hiding inconsistent configuration across a fleet.

One theme runs the whole way through, and it's the most important thing in the book: a green badge is not the same as a secure setting. Verified against Maester's own source code, dozens of AD tests — including core password-policy and Kerberos-exposure checks — set their pass/fail purely on whether a value could be read, not on what the value is. A four-character minimum password length, or hundreds of AS-REP-roastable accounts, can still report "Passed." This guide shows you where that happens and teaches you to read the reported value, not the badge.

The book also includes a section on AI-assisted custom audits — using Claude Code against your own Maester report to go beyond the shipped tests — so you can extend the approach to questions the standard suite doesn't cover.

Every command in the book is read-only and safe to run against production. Every test write-up is sourced from the real Maester project and its documentation, not invented.

Note: Maester's on-premises Active Directory module (Part II) is an official preview release. The book says so wherever it matters, and treats those tests accordingly.

Microsoft 365 and Entra administrators, Active Directory and identity engineers, security analysts, and consultants who run Maester (or are about to) and want to turn its output into action — not just a report they file away.