Unlike EventLogCentral, which passively collects events as they occur, PowerShell Orchestrator actively queries your directory environment on a schedule — producing structured assessment reports that capture the current state of your AD and Entra ID configuration at a point in time.

Key capabilities include:

• Automated assessment of Active Directory configuration and security posture
• Automated assessment of Microsoft Entra ID (Azure AD) configuration
• Scheduled execution of PowerShell scripts across managed endpoints
• Forwarding of assessment results to LT Auditor ^MP via syslog
• Linking of scripts to alert rules for automated remediation responses
• Centralized execution history and script output logging

Common use cases:

• Regular vulnerability assessments of Active Directory user and group configurations
• Identifying accounts with excessive privileges or stale access
• Detecting misconfigured or dormant accounts across your directory
• Monitoring Entra ID role assignments and conditional access policies
• Producing assessment reports for NIST, HIPAA, GDPR, and other compliance frameworks
• Automating remediation actions in response to security alerts

How PowerShell Orchestrator fits into LT Auditor ^MP:

PowerShell Orchestrator acts as the active assessment layer for directory environments. While other modules like EventLogCentral and EntraConnector capture events as they happen, PowerShell Orchestrator periodically queries the state of your directory and reports what it finds. This gives LT Auditor ^MP a more complete picture — not just what happened, but what the current configuration looks like at any given time.

Assessment results flow into the LT Auditor ^MP server where they are available in the dashboard, View module, alerts, and compliance reports alongside event data from other modules.

Prerequisites for PowerShell Orchestrator:

• PowerShell 5.1 or PowerShell 7+
• WinRM enabled on target endpoints
• A service account with appropriate read permissions across Active Directory and Entra ID
• LT Auditor ^MP server installed and running

[Your administrator should confirm which Active Directory domains and Entra ID tenants are in scope for PowerShell Orchestrator assessments in your environment.]