AttestryAttestry
What it checks

Three read-only checks, one plan.

Each check reads what it needs, scores what it finds and writes a report with fixes. The full list of checks is below.

AD Exit Planner

Everything that still depends on on-premises Active Directory

Reads the directory and, optionally, the domain controllers' event logs, then scores readiness in three phases: harden now, replace dependencies, cut over and retire.

  • Kerberos RC4 use and accounts likely missing AES keys
  • NTLM and NTLMv1 use, by source
  • Unsigned and simple LDAP binds
  • Domain controllers past or near end of support, and single-DC domains
  • Service accounts with old passwords or SPNs
  • Stale users and computers
  • Every computer's Windows version and support end date (localized edition names included)
  • Active Directory Certificate Services, NPS/RADIUS, print servers
  • Group Policy inventory and trusts
  • Exchange servers registered in AD
  • Entra Connect presence
  • A three-phase plan with effort estimates
Entra move readiness

What breaks on the first sync to Microsoft Entra ID

Reads user accounts from AD and, optionally, a staff list and the Microsoft 365 tenant, then predicts what the first Entra Connect sync will do to each person.

  • Sign-in names on internal domains (.local, .lan, .corp) Microsoft 365 can't use
  • Sign-in names on domains not verified in the tenant
  • Characters and lengths Entra rejects
  • Accounts with no sign-in name at all
  • The same address on more than one account
  • Email aliases Entra will reject
  • A staff list (CSV from HR or a spreadsheet) matched to AD accounts, with nicknames, typos and swapped columns flagged for review
  • Accounts that would link to a cloud admin account (Microsoft blocks this)
  • Accounts that would take over someone else's mailbox through a reused address
  • People who would end up with two cloud accounts
  • Service, stale and admin accounts to keep out of sync
Microsoft 365 check

Every Microsoft 365 retirement date, mapped to your users

Signs in with read-only permissions and reads users, MFA methods, admin roles, apps, mailboxes and sync status.

  • Users whose only MFA method is SMS or voice (retired February 1, 2027)
  • Users who can't reset their own password after November 7, 2026
  • Admins with no MFA, and how many Global Administrators there are
  • Security defaults and Conditional Access
  • Entra Connect Sync sign-in method and version
  • Mailboxes and apps using SMTP AUTH
  • Apps with Exchange Web Services permissions and recent EWS sign-ins
  • Legacy protocol sign-ins (IMAP, POP, ActiveSync)
  • External mail forwarding and whether policy blocks it
  • Disabled accounts still holding licences, and idle users
Requirements

Runs on what you already have

  • Windows 10, Windows 11 or Windows Server 2016 to 2025
  • Windows PowerShell 5.1 or PowerShell 7.2 and later
  • Domain controllers from 2008 R2 onward
  • Any Windows regional setting, including localized Windows names
  • Microsoft 365 commercial, GCC, GCC High, DoD and China tenants
  • Tenants with or without Entra ID P1
  • A double-click launcher that checks prerequisites first
  • Exit codes and a run summary for RMM tools

See where you stand before the next deadline.

Early access is open for MSPs, businesses and government IT teams. Tell us what you run and we'll email you. We won't call.

Get early access