https://github.com/vletoux/pingcastle
Free, but if you want to use it for commercial purposes, you have to pay.
Health check
PingCaslte.exe --healthcheckRun an audit and create a report "ad-hc_mydoamin.local.html".
PingCaslte will generate a "Domain Risk Level".
This score is based on the worst score between the difrrents categories: Stale Object, Trusts, Privileged Accounts and Anomalies.
The goal is to have the lowest possible score.