Because the Active Directory security lies in the process and not in expensive tools, our solution is simple: download PingCastle and apply its methodology.