[Feature] Refine generated PowerShell templates to reduce unnecessary AD query scope

[Kjean13]

Problem or need

Summary

Some generated PowerShell verification / remediation templates are broader than necessary for large Active Directory environments.

This issue tracks improvements to make post-analysis scripts more scoped, safer, and more realistic for enterprise use, while keeping ADFT aligned with its intended workflow:

• analysis first
• targeted verification / remediation second

Context

ADFT-generated PowerShell scripts are not meant to be the core analysis engine.
They are post-analysis aids used to validate, scope, or remediate specific findings after correlation and investigation.

However, a few generated templates currently rely on AD queries that may be heavier than needed in real environments.

Affected templates

• HARD-001
• HARD-010
• HARD-012

Problems identified

HARD-001

• useful service-account / SPN review logic
• but could benefit from optional scoping and cleaner export support

HARD-010

• privileged group review currently risks being too expensive when recursive expansion is used by default
• recursive membership expansion should be explicit, not implicit

HARD-012

• broad user enumeration patterns are too costly for large domains
• recent-account review should rely on server-side filtering instead of global enumeration followed by local filtering

Proposed improvements

• add optional scope controls such as SearchBase where relevant
• keep outputs operator-friendly for reporting / review
• avoid unnecessary broad AD enumeration
• make recursive expansion opt-in for privileged group review
• prefer server-side LDAP filtering for time-based user review
• keep generated scripts clearly marked as candidate verification / remediation aids

Goal

Make generated PowerShell scripts:

• safer in large AD environments
• easier to review and adapt
• more consistent with ADFT’s analysis-first design
• less likely to be interpreted as bulk live collection tooling

Acceptance criteria

• HARD-001 supports cleaner scoped review
• HARD-010 does not recurse by default
• HARD-012 no longer relies on broad Get-ADUser -Filter * enumeration
• generated scripts remain readable and clearly operator-reviewed

Proposed change

Refine the generated PowerShell templates for HARD-001, HARD-010, and HARD-012 so they are more scoped and safer in real AD environments.

Planned changes:

• add optional scoping support where relevant
• avoid unnecessarily broad AD enumeration
• make privileged group recursion opt-in instead of default
• replace broad recent-user enumeration with server-side LDAP filtering
• keep outputs readable for operator review and reporting

Scope and impact

Affected areas:

• adft/harden/script_generator.py
• generated PowerShell templates for:
  • HARD-001
  • HARD-010
  • HARD-012

Impact:

• safer post-analysis scripts in large AD environments
• lower risk of unnecessary memory / query overhead
• clearer alignment with ADFT’s analysis-first workflow
• no change to the core correlation engine

Validation idea

No response

[Kjean13]

Implemented in the initial public version with a first refinement of HARD-001, HARD-010, and HARD-012.
Further improvements can continue here if additional field feedback comes in.

[Kjean13]

Implemented via PR #3.

The generated PowerShell templates for HARD-001, HARD-010, and HARD-012 were refined to reduce unnecessary AD query scope and improve safety in real AD environments.