Skip to main content
AD Security Audit is a comprehensive auditing platform that performs deep security analysis of your Active Directory environment. It identifies privilege escalation paths, Kerberos delegation issues, ADCS vulnerabilities, and infrastructure misconfigurations.

​
Key Capabilities

Privilege Analysis

Detect DA equivalence, DCSync rights, Shadow Credentials, and SID History abuse.

ADCS Vulnerabilities

Full ESC1-8 coverage including certificate template abuse detection.

Kerberos Delegation

Analyze unconstrained, constrained, and resource-based constrained delegation.

Risk Scoring

Domain and user risk scores with compliance reporting.

​
Security Audits

The tool performs eight categories of security analysis:

​
Attack Detection

The platform identifies common attack vectors: Credential Theft
  • DCSync attack paths
  • LAPS password exposure
  • gMSA password access
  • AS-REP roastable accounts
Privilege Escalation
  • WriteSPN (Kerberoasting setup)
  • Shadow Credentials abuse
  • RBCD write access
  • Certificate template abuse
Persistence & Lateral Movement
  • SID History injection paths
  • Delegation abuse opportunities
  • Trust relationship weaknesses

​
Risk Scoring

​
Domain Risk Score

The tool calculates a 0-100 aggregate risk score for your domain:

​
Severity Weights

​
Installation

​
Prerequisites

  • Rust 1.78 or later
  • Node.js 18 or later
  • Windows SDK (for GSSAPI/SSPI support)
  • Domain-joined machine (optional, for Kerberos authentication)

​
Build from Source

The compiled binary appears in src-tauri/target/release/.

​
Development Mode

​
Authentication

The tool supports multiple authentication methods: Uses Windows integrated authentication via SSPI. No password storage required.
GSSAPI is the most secure option as credentials are handled by Windows and never stored by the application.

​
Simple Bind

Username and password authentication. Requires LDAPS (port 636) for secure transmission.

​
Auto Mode

Automatically selects the best available authentication method based on your environment.

​
Required Permissions

The service account needs read-only access to:
  • User, computer, and group objects
  • userAccountControl attribute
  • servicePrincipalName attribute
  • msDS-KeyCredentialLink attribute
  • nTSecurityDescriptor (for ACL analysis)
  • Certificate Templates (for ADCS audit)
  • Group Policy Objects
No write permissions are required. The tool performs read-only analysis.

​
Compliance Reporting

Generate reports mapped to compliance frameworks:
  • SOX - Segregation of duties, privileged access controls
  • HIPAA - Access controls, audit logging requirements
  • PCI-DSS - Privileged account management, access restrictions
  • NIST - Identity and access management controls

​
Export Formats

  • JSON - Full findings data for integration with other tools
  • PDF - Executive summaries for management reporting
  • CSV - Spreadsheet-compatible for detailed analysis

​
Security Considerations

The tool implements several security measures:
  • Credentials stored with zeroized memory protection
  • GSSAPI eliminates password storage entirely
  • LDAPS (TLS 1.2+) recommended for Simple Bind
  • All operations logged with timestamps and principals
  • No plaintext credential storage or logging