PowerShell Orchestrator is an automation and assessment module for LT Auditor MP. It is designed to give IT administrators the ability to run PowerShell-based assessment scripts across Active Directory and Microsoft Entra ID (Azure AD), collecting configuration and security posture data and forwarding the results to LT Auditor MP for analysis, alerting, and compliance reporting.
Unlike EventLogCentral, which passively collects events as they occur, PowerShell Orchestrator actively queries your directory environment on a schedule — producing structured assessment reports that capture the current state of your AD and Entra ID configuration at a point in time.
Key capabilities include:
- Automated assessment of Active Directory configuration and security posture
- Automated assessment of Microsoft Entra ID (Azure AD) configuration
- Scheduled execution of PowerShell scripts across managed endpoints
- Forwarding of assessment results to LT Auditor MP via syslog
- Linking of scripts to alert rules for automated remediation responses
- Centralized execution history and script output logging
Common use cases:
- Regular vulnerability assessments of Active Directory user and group configurations
- Identifying accounts with excessive privileges or stale access
- Detecting misconfigured or dormant accounts across your directory
- Monitoring Entra ID role assignments and conditional access policies
- Producing assessment reports for NIST, HIPAA, GDPR, and other compliance frameworks
- Automating remediation actions in response to security alerts
How PowerShell Orchestrator fits into LT Auditor MP:
PowerShell Orchestrator acts as the active assessment layer for directory environments. While other modules like EventLogCentral and EntraConnector capture events as they happen, PowerShell Orchestrator periodically queries the state of your directory and reports what it finds. This gives LT Auditor MP a more complete picture — not just what happened, but what the current configuration looks like at any given time.
Assessment results flow into the LT Auditor MP server where they are available in the dashboard, View module, alerts, and compliance reports alongside event data from other modules.
Prerequisites for PowerShell Orchestrator:
- PowerShell 5.1 or PowerShell 7+
- WinRM enabled on target endpoints
- A service account with appropriate read permissions across Active Directory and Entra ID
- LT Auditor MP server installed and running
[Your administrator should confirm which Active Directory domains and Entra ID tenants are in scope for PowerShell Orchestrator assessments in your environment.]