The World's Only Accurate Active Directory Effective Permissions Tool

Folks,

Hope your 2017's off to a great start. As I had indicated a few days ago, starting January 26th I'll be sharing some valuable insights on Active Directory Security; until then just wanted to get some very basic stuff out of the way; this one being the 7th.

Active Directory Effective Permissions Audits - A Mission-Critical Need

Today every organization that operates on Microsoft's Active Directory has a mission-critical cyber security need to be able to accurately audit effective permissions in their foundational Active Directory deployments, to protect the entirety of their organizational IT resources. A few examples of such essential Active Directory effective permissions audits include -

1. Who has sufficient effective permissions to be able to replicate secrets from Active Directory? (Implications & details.)
2. Who has what sufficient effective permissions to be able to control every Active Directory administrative account?
3. Who has sufficient effective permissions to be able to control every Active Directory administrative group?
4. Who has sufficient effective permissions to be able to manage all executive accounts (i.e. those of the CEO, CIO etc.)?
5. Who has sufficient effective permissions to be able to manage all vital Active Directory domain user accounts, domain computer accounts, domain security groups, Organizational Units, etc. (and there could be 1000s of such objects)?

If you truly know Active Directory Security, then you know that it is not "Who has what permissions" but "Who has what effective permissions" that matters, ; the difference is colossal and could very well be the difference between security and compromise.

Most organizations do not even seem to know that they need to be able to determine effective permissions in Active Directory, and do so accurately, to maintain a sound cyber security posture. At those who do know, IT personnel struggle to fulfill this mission-critical need - they try writing advanced in-house LDAP/ PowerShell scripts, using free MS tools like dsacls, acldiag, LDP, the Effective Permissions Tab, etc., or relying on this free 3rd party audit tool which is dangerously inaccurate.

To begin with, the expertise required to write a script that can accurately determine effective permissions in Active Directory is so rare that most IT personnel may not even know where to begin. That said, many may still proceed to write and use substantially inaccurate scripts to do so.

Further, assuming they could write an accurate script to do so, here are 4 issues/challenges that they will most likely run into -

1. In-house scripts are prone to human-error, need to be maintained and could be maliciously modified by someone.
2. The use of PowerShell, and/or utilities like LDP requires a certain level of technical Active Directory expertise
3. The Microsoft Effective Permissions Tab is not only self-admittedly inaccurate, it is woefully inadequate.
4. All free 3rd party tools that claim to do Active Directory effective permissions are substantially inaccurate.

It is unequivocally clear to use that what organizations need is an accurate, reliable (tamper-proof) and above all a trustworthy Active Directory Effective Permissions Audit Tool that could help IT personnel worldwide easily & trustworthily fulfill this need.

So we built the world's best and only accurate Active Directory Effective Permissions Calculator / Audit Tool so it could help all IT admins, analysts, auditors and others easily and trustworthily fulfill their Active Directory effective permissions audit needs.



Gold Finger Active Directory Effective Permissions Calculator / Audit Tool

The Gold Finger Effective  Permissions Calculator is the world's only accurate Active Directory Effective Permissions Audit Tool:

Gold Finger Active Directory Effective Permissions Calculator / Audit Tool

If you can touch a button, you can now (for the first time ever) accurately and easily fulfill all your Active Directory effective permissions audit and compliance reporting needs. Click, done. It quite simply is as simple and as remarkable as that.

Capability Overview

Here's a quick overview of the tool's top 10 features/capabilities -

1. Accurate Analysis – Accurately determine effective permissions on any Active Directory object, taking all factors (e.g. precedence orders, memberships expansions, conflict resolution etc.) that influence effective access into account.
2. Real-Time Analysis – Instantly view & verify resulting change in effective permissions as soon as a permission changes.
3. Full Automation – Instantly determine effective permissions and effective access at the touch of a single button.
4. Full Coverage – Determine effective permissions on any Active Directory object in any Active Directory partition.
5. Intuitive Interface – Easily view all effective permissions, all users who have them, and their underlying permissions.
6. Permission-Centric Analysis – Instantly enumerate all users who are granted a specific effective permission / admin task.
7. Source Identification – Find out exactly which underlying permission is granting a user a specific effective permission.
8. Effective Access Insight – Find out both, who has what effective permissions and who has what effective access.
9. Analysis Exports – Export effective permissions for offline analysis, sharing, audit report submission and archival.
10. DC Specific Analysis and Alternate Credential Use – Target any Domain Controller, and use alternate credentials.

Design Goals

Here are the 6 main design goals we set and met for Gold Finger -

1. Accuracy - Accuracy is everything, and Gold Finger is the world's only accurate effective permissions calculator.
2. Complete Picture - It calculates and shows the complete set of effective permissions entitled on an Active Directory object, and it also shows the identities of all security principals for whom a specific effective permission is entitled.
3. Source-Identification - It pinpoints the underlying security permission that entitles a user to a specific effective permission
4. Data output - IT personnel can effortlessly export the raw data for archival, rich analysis etc.
5. Ease of use - It can be installed in 2 minutes on any machine* and requires no Active Directory knowledge to use.
6. Trustworthiness - When it comes to security, Gold Finger also sets the bar and gold standard for trustworthiness.

Example Reports

Here are 10 real-world examples of the kinds of Active Directory effective permissions audits you can perform with Gold Finger -

1. Find out exactly who has Extended Right - Get Replication Changes All effective permissions granted on domain root.
2. Find out exactly who has what effective permissions (e.g. Blanket Write-Property) granted on the Domain Admins group.
3. Determine exactly who has Write-Property - Member effective permissions on the Domain Admins security group.
4. Find out exactly who has Write Property - userAccountControl effective permissions on a DC's computer account.
5. Determine exactly who has Delete or Delete Tree effective permissions on the Corp OU containing 1000s of objects.
6. Find out exactly who has Extended Right - Reset Password effective permissions on the CEO's domain user account.
7. Determine exactly who has Extended Right - Send As effective permissions on the CFO's domain user account.
8. Find out exactly who has Modify Permissions effective permissions on the domain root object or on AdminSDHolder.
9. Determine exactly who has Extended Right - Apply Group Policy effective permissions on the Domain Controllers OU.
10. Determine exactly how John Doe has Write-Property - Member effective permissions on the Domain Admins group.

Trusted Worldwide

Today, our Gold Finger Active Directory Effective Permissions Calculator is used worldwide by the world's top organizations to easily fulfill the mission-critical cyber security need of being able to accurately audit Active Directory effective permissions.

For more info and free trials, please visit - http://www.paramountdefenses.com/active-directory-effective-permissions-tool.html

Best wishes,

Sanjay

The World's Best Active Directory Permissions Analyzer

Folks,

Hope your 2017's off to a great start. As I had indicated a few days ago, starting January 26th I'll be sharing some valuable insights on Active Directory Security; until then just wanted to get some very basic stuff out of the way; this one being the 6th.

Active Directory Permissions Audits - An Essential Need

It goes without saying that today virtually every organization that operates on Microsoft's Active Directory has an essential need to be able to audit Active Directory security permissions because Active Directory security permissions ultimately protect the entirety of the organizations IT resources. A few examples of such essential Active Directory permissions audits include -

1. Who has what security permissions/rights in Active Directory, which ones and where?
2. Who has what security permissions/rights on a specific Active Directory object and how?
3. What security permissions/rights does a specific user or security group have in Active Directory?
4. Where does a specific user or group have any kind of modify permissions/rights in Active Directory?
5. Who has what security permissions/rights on critical Active Directory objects such as the domain root object etc.?

Now, let me be the first to tell you that if you truly know Active Directory Security, then you know that it is not "Who has what permissions" but "Who has what effective permissions" that matters (and the difference is colossal and could be the difference between security and compromise), but for now let's just play along and assume that this is what organizations need to audit.

To fulfill these essential needs, IT admins worldwide use various means, such as writing advanced in-house LDAP/ PowerShell scripts, using free MS tools like dsacls, acldiag, LDP etc., or relying on some 3rd party audit tools many of which aren't reliable.

In doing so, here are some issues/challenges they could run into -

1. In-house scripts are prone to human-error, need to be maintained and could be maliciously modified by someone
2. The use of PowerShell, and/or utilities like LDP requires a certain level of technical Active Directory expertise
3. Many 3rd party tools, whilst inexpensive, may or may not always be sufficiently trustworthy (e.g. built in Russia etc.)

In our experience, we found that what is ideally needed is a dedicated and reliable (tamper-proof) permissions audit tool that can help all these IT personnel easily & trustworthily fulfill their essential Active Directory security permissions audit needs.

So we built possibly the world's best (most capable) Active Directory Permissions Analyzer that could help IT admins, analysts, auditors and other stakeholders easily and trustworthily fulfill their essential Active Directory security permissions audit needs.



Gold Finger Active Directory Permissions Analyzer

The Gold Finger Permissions Analyzer is the world's most capable and trustworthy Active Directory Permissions Audit Tool -

Gold Finger Active Directory Permissions Analyzer

If you can touch a button, you can now easily, comprehensively and above all, trustworthily fulfill all your Active Directory security permissions/rights audit and compliance reporting needs. Active Directory permissions audits could not be simpler.

Capability Overview

Here's a quick overview of the tool's top 5 features/capabilities -

1. Rapid Analysis and Enterprise Scalability – Analyze entire Active Directory domains within a matter of minutes.
2. Rich Analysis Criteria – Find permissions based on grant type (allow/deny), inheritance (explicit/inherited), permission type (e.g. Write Property), security principal (any user, security group or well-known security principal) and scope.
3. Group Membership Inclusion – Automatically include the impact of group memberships when analyzing permissions.
4. Real-time Schema Availability – Specify any class, attribute or extended right defined in your organization's AD Schema.
5. Complete Flexibility – Customize analysis scope via use of custom LDAP filters (e.g. (&(objectClass=user)(title=C*O)).)

Design Goals

Here are the 5 main design goals we set and met for Gold Finger -

1. Trustworthiness - When it comes to security, Gold Finger sets the bar and gold standard for trustworthiness.
2. Ease-of-use - It can be installed in 2 minutes on any machine* and requires no Active Directory knowledge to use.
3. Customization - Every report can be completely customized using LDAP filters as well as scope and depth control.
4. Complete Flexibility - IT personnel can search for any kind of Active Directory security permission, including specific permissions and extended rights, as well as permissions granted anywhere to a specific user/group etc. 
5. Data output - IT personnel can effortlessly export the raw data for archival, rich analysis etc.

Example Reports

Here are 10 real-world examples of the kinds of Active Directory security permissions audits you can perform with Gold Finger -

1. Identify all security principals that have any kind of modify permissions granted anywhere in the Corp domain.
2. Identify all security groups that have All Extended Rights granted anywhere in the Corp domain.
3. Identify all users that have the Reset Password Extended right granted on any domain accounts in the Executives OU.
4. Identify all security principals that have Delete permissions granted on any organizational unit (OU) in the Corp domain.
5. Find out if the Temporary Contractors group is granted any security permissions anywhere in the Corp domain.
6. Find out which security permissions, if any, are granted to John Doe anywhere in the Production OU.
7. Find out which users are explicitly granted the Create Child - User permission anywhere in the Headquarters OU.
8. Find out who has Deny permission granted anywhere in the Corp domain, and whether they are Explicit or Inherited.
9. Determine whether John Doe has Write Property - Member permissions on any administrative group in the Corp domain.
10. Determine who has Send As permissions granted on the CEO's mail-enabled domain user account.

Trusted Worldwide

Today, our Gold Finger Active Directory Permissions Analyzer is used worldwide by the world's top organizations to easily, efficiently and trustworthily fulfill the entirety of their essential Active Directory security permissions/rights audit needs.

For more info and free trials, please visit - http://www.paramountdefenses.com/active-directory-permissions-analyzer.html

Best wishes,

Sanjay

PS: This is about 1% of what we do, so this is as much as I'd like to say about it.

The World's Best Active Directory ACL / Security Permissions Audit Tool

Folks,

Hope your 2017's off to a great start. As I had indicated a few days ago, starting January 26th I'll be sharing some valuable insights on Active Directory Security; until then just wanted to get some very basic stuff out of the way; this one being the 5th.

Active Directory ACL / Security Permissions Audit - A Basic Need

Today virtually every organization that operates on Microsoft's Active Directory has a basic and essential need to be able to easily view, analyze and audit Active Directory ACLs (Access Control Lists) because Active Directory permissions ultimately protect virtually all of the organization's IT resources. A few examples of such basic Active Directory ACL audit needs include -

1. Who security permissions/rights does a specific user/group have in a specific Active Directory object's ACL?
2. Who has a specific Active Directory security permission allowed in the ACL of a specific Active Directory object?
3. Which ACEs (access control entries) grant a specific Active Directory security permission to various security principals?
4. Which ACEs explicitly deny a specific Active Directory security permission in an object's ACL?
5. Which ACEs explicitly grant a specific Active Directory security permission to a specific user or group in an object's ACL?

Now, let me be the first to tell you that if you truly know Active Directory Security, then you know that it is not "Who has what permissions" but "Who has what effective permissions" that matters (and the difference is colossal and could be the difference between security and compromise), but for now let's just play along and assume that this is what organizations need to audit.

To fulfill their ACL analysis needs, IT admins worldwide use numerous means, such as writing in-house LDAP/ PowerShell scripts, using free MS tools like dsacls, acldiag, LDP etc., or relying on some 3rd party audit tools many of which aren't reliable.

In doing so, here are some issues/challenges they could run into -

1. In-house scripts are prone to human-error, need to be maintained and could be maliciously modified by someone.
2. The use of PowerShell, and/or utilities like LDP requires a certain level of technical Active Directory expertise.
3. Many 3rd party tools, whilst inexpensive, may or may not always be sufficiently trustworthy (e.g. built in Russia etc.)

In our experience, we found that what is ideally needed is a dedicated and reliable (tamper-proof) Active Directory ACL analysis, viewing and dump tool that can help easily & trustworthily fulfill all Active Directory ACL/permissions audit needs.

So we built possibly the world's best (most advanced) Active Directory ACL Viewer and Exporter that could help IT admins, analysts, auditors and other stakeholders easily and trustworthily fulfill their basic Active Directory ACL/permissions audit needs.



Gold Finger Active Directory ACL / Security Permissions Audit and Dump Tool

The Gold Finger Active Directory ACL Viewer and Exporter is the world's most advanced and trustworthy Active Directory ACL/Permissions Audit Tool -

Gold Finger Active Directory ACL Audit Tool, Viewer and Exporter

If you can touch a button, you can now easily, comprehensively and above all, trustworthily view, analyze, audit as well as instantly export/dump Active Directory ACLs and security permissions/rights, both on a per-object and a domain-wide basis.

Capability Overview

Here's a quick overview of the tool's top 5 features/capabilities -

1. Complete View – Obtain a complete, fully sortable view of the ACL (both DACL & SACL) of any Active Directory object.
2. Detailed View – Obtain a detailed view wherein each ACL field is expanded into individually sortable columns.
3. ACL Exports – Export the complete ACL of an Active Directory object for analysis, comparison, archival and audit.
4. Tree-wide ACL Exports – Export/dump the ACLs of all Active Directory objects in any Active Directory tree (e.g. OU).
5. Advanced ACL Export Options – Export only those ACLs that are marked Protected or owned by a specific user/group.

Design Goals

Here are the 5 main design goals we set and met for Gold Finger -

1. Trustworthiness - When it comes to security, Gold Finger sets the bar and gold standard for trustworthiness.
2. Ease-of-use - It can be installed in 2 minutes on any machine* and requires no Active Directory knowledge to use.
3. Rich Analysis - IT personnel can easily analyze every aspect of the ACL, including sorting the ACL by individual Active Directory security permissions (e.g. Write Property, Extended Right etc.), inheritance fields etc.
4. Instant Export - IT personnel can easily export/dump the ACLs of any, some or all Active Directory objects. 
5. Data output - IT personnel can effortlessly export the raw data for archival, rich analysis etc.

Example Reports

Here are 10 real-world examples of the kinds of Active Directory ACL/permissions audits you can perform with Gold Finger -

1. Alphabetically sort the ACL on the AdminSDHolder object to list all security principals for whom access is specified.
2. Identify all permissions in the ACL of the Administrators group object that grant Write Property - Member permissions.
3. Export/dump the ACL on the Enterprise Admins group object to furnish it as evidence for a regulatory compliance report.
4. Identify every permission in the ACL on the Corporate OU object that grants a user or group Create Child permissions.
5. Enumerate the list of all security permissions in the ACL of the Help Desk Operators object that are Explicit in nature.
6. Instantly dump/export the security permissions/ACLs of all objects contained in any Active Directory domain/partition.
7. Easily dump/export the security permissions/ACLs protecting all executive (e.g. all C*O) and privileged user accounts.
8. Instantly dump/export Active Directory security permissions/ACLs protecting all Organizational Units in a domain.
9. Obtain a snapshot of all Active Directory permissions/ACLs protecting the Configuration, Schema and domain partitions.
10. Dump/export Active Directory security permissions/ACLs to a file to furnish evidence for a compliance/security audit.
    

Trusted Worldwide

Today, our Gold Finger Active Directory ACL Viewer and Exporter is used worldwide by the world's top organizations to easily, efficiently and trustworthily fulfill all their basic Active Directory ACL/security permissions/rights analysis and audit needs.

For more info and free trials, please visit - http://www.paramountdefenses.com/active-directory-acl-permissions-viewer.html

Best wishes,

Sanjay

PS: This is about 1% of what we do, so this is as much as I'd like to say about it.

The World's Only Professional Kerberos Token-Size Calculator

Folks,

Hope the New Year's off to a great start. As I had indicated a few days ago, starting January 26th I'll be sharing some valuable insights on Active Directory Security; until then just wanted to get some very basic stuff out of the way; this one being the 4th.

Kerberos Token Size Calculations - A Vital Need for Many Organizations

For many medium and large organizations that operate on Microsoft's Active Directory, the need to be able to calculate Kerberos token sizes for their domain user accounts has become vital, given the large number of Active Directory security groups their users likely belong to. A few examples of such basic Kerberos Token Size Calculation audits include -

1. Which domain accounts might be at a risk of being denied a logon due to a large number of SIDs in their access tokens?
2. Is a specific domain account at a risk of being denied a logon due to a large number of SIDs in his/her access token?
3. What are the token sizes of all domain user accounts in our Active Directory?
4. Are any executive/privileged accounts at a risk of being denied a logon due to the Windows Kerberos Token Bloat issue?

To make these determinations, IT admins at many organizations worldwide attempt various means, such as writing in-house LDAP/ PowerShell scripts, using free MS tools like Tokensz etc., or relying on 3rd party scripts most of which are inaccurate.

In doing so, here are some issues/challenges they could run into -

1. In-house scripts are prone to human-error, need to be maintained and could be maliciously modified by someone.
2. The use of PowerShell, and/or utilities like LDP requires a certain level of technical Active Directory expertise.
3. Most 3rd party scripts in this space seem to be rather inaccurate. (See point 4 in capability overview below.)

In our experience, we found that what is ideally needed is a purpose-specific and reliable (tamper-proof) Kerberos token size calculation tool that can help IT personnel easily & trustworthily audit and calculate the token sizes of multiple domain users.

So we built the world's first dedicated, professional-grade Kerberos token size calculator to help IT admins, analysts, auditors and other stakeholders easily and trustworthily calculate Kerberos token sizes and thus fulfill a vital organizational audit need.



Gold Finger Kerberos Token Size Calculator / Audit Tool

The Gold Finger Kerberos Token Size Calculator is quite simply the world's only professional fully-automated audit tool that can automatically calculate the Kerberos token sizes of any, some or all domain accounts in any Active Directory domain -

Gold Finger - Kerberos Token Size Calculator

If you can touch a button, you can now easily and automatically calculate the Kerberos token sizes of any, some or all domain accounts in any Active Directory domain, at once, based on Microsoft's recommended formula Token Size = 1200 + 40d + 8s.

Capability Overview

Here's a quick overview of the tool's top 5 features/capabilities -

1. Fully-automated multiple-account Kerberos Token Size Calculation – Calculate token sizes of multiple domain accounts.
2. Based on Microsoft Recommendations – Calculations based on Microsoft's formula: Token Size = 1200 + 40d + 8s.
3. Kerberos Token Size Exports – Generate and export Kerberos token sizes of any, some or all accounts in a domain.
4. Domain-specific Token Size Analysis – Calculate domain-specific access token sizes since Windows access tokens are always domain specific. This point is very important, yet most 3rd party scripts do not seem to take it into account.
5. Access Token Contents Analysis – Obtain the list of all security identifiers (SIDs) in any domain account's access token.

Design Goals

Here are the 5 main design goals we set and met for Gold Finger -

1. Automation- Automate Kerberos token-size calculation process for multiple domain accounts in a single assessment. 
2. Ease-of-use - It can be installed in 2 minutes on any machine* and requires no Active Directory knowledge to use.
3. Effortless Analysis - It can calculate the token sizes of multiple domain users accounts in a single assessment. 
4. Flexibility - It can use LDAP filters to specify a sub-set of domain accounts whose token-sizes are to be calculated.
5. Data output - IT personnel can effortlessly export the raw data for archival, rich analysis etc.

Example Reports

Here are 10 real-world examples of the kinds of Kerberos token-size audits you can perform with Gold Finger -

1. Calculate the Kerberos token sizes of all domain user accounts in the Corp domain.
2. Calculate the Kerberos token sizes of all administrative and executive domain user accounts in the Corp domain.
3. Identify all domain accounts in the HQ OU that might be at a risk of being denied a logon due to Kerberos token bloat.
4. See which security groups show up in the access token of JDoe's account when he logs on to Corp domain machine.
5. Find out if a specific security group Executive Committee Members shows up in CEO's user account's access token.
6. Identify all administrative accounts that might be at a risk of being denied a logon due to Kerberos token bloat issue.
7. Identify all computer accounts in Servers OU that might be at a risk of being denied a logon due to Kerberos token bloat.
8. Find out if the Builtin Admins security group shows up in the access token of a temporary admin's alternate user account.
9. Find out if Anonymous includes Everyone by being able to view the contents of any domain account's access token.
10. Generate a professional PDF audit report  that documents the token-sizes of all user accounts in the Corp domain.

Trusted Worldwide

Today, our unique Kerberos Token Size Calculator helps organizations worldwide automatically calculate token sizes of multiple domain user accounts and identify all accounts that might be at a risk of being denied a logon due to the token bloat issue.

For more info and free trials, visit - http://www.paramountdefenses.com/kerberos-token-size-calculator.html

Best wishes,

Sanjay

PS: This is about 1% of what we do, so this is as much as I'd like to say about it.

A Simple Active Directory Group Membership Audit/Reporting Tool

Folks,

Hope the New Year's off to a great start. As I had indicated a few days ago, starting January 26th I'll be sharing some valuable insights on Active Directory Security; until then just wanted to get some very basic stuff out of the way, this one being the 2nd.

Active Directory Group Membership Audit

For most organizations that operate on Microsoft's Active Directory, the need to be able to easily audit Active Directory group memberships is a basic cyber security need because virtually all IT resources in a Microsoft Windows network are secured and protected by Active Directory security groups. A few examples of such basic Active Directory group membership audits include -

1. Exactly who is a member of a specific Active Directory domain security group, directly or indirectly?
2. Exactly which security groups, if any, are nested within a specific Active Directory domain security group?
3. Exactly which Active Directory domain security groups is a specific user a member of ?

Now, let me be the first to tell you that it is equally and perhaps far more important to also know exactly who can control/change the membership of every Active Directory domain security group, and today we can uniquely help organizations do so as well.

To fulfill these simple needs, IT admins around the world attempt various means, such as writing in-house LDAP/ PowerShell scripts, using free MS tools like LDP etc., or relying on various 3rd party audit tools many of which aren't reliable.

In doing so, here are some issues/challenges they could run into -

1. In-house scripts are prone to human-error, need to be maintained and could be maliciously modified by someone.
2. The use of PowerShell, and/or utilities like LDP requires a certain level of technical Active Directory expertise.
3. Many 3rd party tools, whilst inexpensive, may or may not always be sufficiently trustworthy (e.g. built in Russia etc.)

In our experience, we found that what is ideally needed is a simple and reliable (tamper-proof) group membership audit tool that can help all IT personnel easily & trustworthily audit, analyze and document all their Active Directory group memberships.

So we built possibly the world's simplest Active Directory Group Membership tool that could help IT admins, analysts, auditors and other stakeholders easily and trustworthily fulfill their Active Directory group membership audit needs.



Gold Finger Active Directory Group Membership Audit/Reporting Tool

The Gold Finger Active Directory Group Membership Reporting Tool is quite simply the world's simplest and most trustworthy Active Directory Group Membership Audit Tool -

Active Directory Group Membership Audit/Reporting Tool

If you can touch a button, you can now easily and above all trustworthily fulfill all your Active Directory group membership audit and compliance reporting needs. All you have to do is touch a button; AD group memberships audits could not be simpler.

Capability Overview

Here's a quick overview of the tool's top 5 features/capabilities -

1. Group and User Membership Enumeration – Enumerate the complete, flattened membership of any Active Directory security group as well as the complete list of all Active Directory security groups to which a user belongs.
2. Circular Loop Detection and Infinite Loop Avoidance – Detect circularly-nested groups and avoid expansion infinite loops.
3. Direct and Nested Enumeration – Enumerate direct members & nested members of any Active Directory security group.
4. Source Nested Group Identification – Identify all nested groups via (membership in) which a user/group is a member.
5. Dynamic Well-Known Security Principal Inclusion – Dynamically evaluate the membership of any well-known security principal, such as Authenticated Users, Domain Users, Domain Computers, Everyone etc.

Design Goals

Here are the 5 main design goals we set and met for Gold Finger -

1. Trustworthiness - When it comes to security, Gold Finger sets the bar and gold standard for trustworthiness.
2. Ease-of-use - It can be installed in 2 minutes on any machine* and requires no Active Directory knowledge to use.
3. Instant Analysis - IT personnel can easily analyze group memberships, including group membership nesting etc. 
4. User and Group based Audit - IT personnel can audit not just the membership of a specific domain security group but also the membership of a specific domain user or computer. 
5. Data output - IT personnel can effortlessly export the raw data for archival, rich analysis etc.

Example Reports

Here are 10 real-world examples of the kinds of Active Directory group membership audits you can perform with Gold Finger -

1. Audit the direct or complete (nested) membership of any domain security group such as Domain Admins.
2. Generate an audit report documents all the groups to which a contractor's domain user account belongs.
3. Generate PDF reports documenting the complete membership of all privileged access groups in Active Directory.
4. Find out how the security group Temp Contractors is somehow a member of the All Employees security group.
5. Find out how user John Doe is a member of the System Admins domain security group.
6. Identify all security groups to which a Domain Admin's account belongs.
7. Identify all security groups to which the CEO's domain user's account belongs.
8. Identify all security groups nested within the All Employees domain security group.
9. Enumerate the complete (direct and indirect) membership of the Domain Admins security group.
10. Enumerate the direct membership of the Domain Admins security group.
    

Trusted Worldwide

Today, our simple Gold Finger Active Directory Group Membership Audit/Reporting Tool is used worldwide by the world's top organizations, including the U.S. Government and Fortune 10 companies, to easily and trustworthily fulfill their Active Directory security group membership audit and reporting needs.

For more info and free trials, visit - http://www.paramountdefenses.com/active-directory-group-membership-reporting-tool.html

Best wishes,

Sanjay

PS: This is about 0.1% of what we do, so this is as much as I'd like to say about it.

A Highly Trustworthy Active Directory Security Audit Tool

Folks,

Hope your New Year's off to a good start. As I had indicated yesterday, starting January 26th I'll be sharing some valuable insights on Active Directory Security; until then just wanted to get some very basic stuff out of the way, this being the 1st.

Trustworthy Active Directory Security Audits - A Basic Universal Need

Today most organizations that operate on Microsoft's Active Directory have a need to be able to perform basic Active Directory Security audits to maintain security and demonstrate compliance. Examples of such basic Active Directory audits include -

1. List of all domain user accounts in Active Directory, including their states, status, true last-logon time etc.
2. List of all domain user accounts and groups considered administrative in nature by Active Directory
3. List of all domain security groups in Active Directory, including their type, membership etc.
4. List of all domain computer accounts in Active Directory, and their various details
5. List of all organizational units, containers, service connection points, print queues, GPOs in Active Directory etc.

To fulfill these basic needs, IT admins usually employ various means, such as writing in-house LDAP/PowerShell scripts, using free MS utilities like LDP etc., or relying on basic 3rd party AD audit tools. However, there is usually a trade-off involved -

1. In-house scripts are prone to human-error, need to be maintained and could be maliciously modified by someone
2. The use of PowerShell, and/or utilities like LDP requires a certain level of technical Active Directory expertise
3. Many 3rd party tools, whilst inexpensive, may or may not always be sufficiently trustworthy (e.g. built in Russia etc.)

In our experience, we found that what is ideally needed is a simple, reliable (tamper-proof) and customizable audit tool that can help all IT personnel (AD admins, IT managers and others) easily & trustworthily fulfill their basic Active Directory audit needs.

So we built possibly the world's simplest and most trustworthy Active Directory Security Audit Tool that can help both advanced technical experts as well as IT managers and others, easily and trustworthily fulfill their basic Active Directory audit needs.



Gold Finger Active Directory Security Audit Tool

The Gold Finger Security Audit Tool is quite simply the world's most trustworthy basic Active Directory Security Audit Tool -

Gold Finger Active Directory Security Audit Tool

If you can touch a button, you can now trustworthily fulfill most of your basic Active Directory security audit and compliance reporting needs, including obtaining and furnishing evidence in terms of raw data and professional-grade (PDF) reports.

Capability Overview

Here's a quick overview of the tool's top 5 features/capabilities -

1. 100 Built-in Reports – Instantly generate 100+ essential ready-to-generate Active Directory security audit reports
2. Custom LDAP Filters – Customize any built-in report by specifying an LDAP filter of your choice (e.g. (title=C*O))
3. DC Specific Analysis and Alternate Credential Use – Target any Domain Controller, as well as use alternate credentials
4. Data Exports – Instantly export data from Active Directory (domain, OU etc.), including based on custom LDAP filters
5. Professional-grade PDF Report Generation – Generate customizable, ready-to-furnish professional-grade PDF reports

Design Goals

Here are the 5 main design goals we set and met for Gold Finger -

1. Trustworthiness - When it comes to security, Gold Finger sets the bar and gold standard for trustworthiness.
2. Ease-of-use - It can be installed in 2 minutes on any machine* and requires no Active Directory knowledge to use.
3. Customization - Every report can be completely customized using LDAP filters as well as scope and depth control.
4. Data output - Gold Finger retrieves the data, lets you analyze and easily export it, as well as generate PDF reports. 
5. Flexible Licensing - Gold Finger can be licensed on a weekly, monthly, quarterly and annual basis, starting at just $ 99*.

Example Reports

Here are 10 real-world examples of the kinds of reports you can generate with Gold Finger -

1. Identify all domain user accounts in Active Directory, including their state, status (active/stale) and last-logon times.
2. List all domain computer accounts in Active Directory, including their operating system, status and DNS name.
3. Enumerate all domain security groups in Active Directory, including their type and other details.
4. Enumerate the entire contents (accounts, groups etc.) of any Organizational Unit (OU) in Active Directory.
5. Identify all accounts and groups that are considered/marked as administrative by Active Directory.
6. Enumerate the list of all active and inactive domain user accounts (based on True Last Logon ).
7. Identify all computer accounts that are trusted for unconstrained delegation in Active Directory.
8. Identify all accounts based on a specific criteria such as a combined value of Title and a custom attribute Division.
9. View the details of the CEO's domain user account, export them to a CSV file, or generate a professional PDF report.
10. Generate an audit report in PDF format that lists all Active Directory user accounts, including their state and status.

A Free Version

We believe that everyone worldwide should be able to obtain basic Active Directory security insight trustworthily so we also offer a free version which can be downloaded here - http://www.paramountdefenses.com/free-active-directory-audit-tool.html

Trusted Worldwide

Today, our Gold Finger Active Directory Security Audit Tool is used worldwide by the world's top organizations including the United States Government and Fortune 10 companies to trustworthily fulfill their basic Active Directory security audit needs.

For more information and free trials, please visit - http://www.paramountdefenses.com/active-directory-security-audit-tool.html

Best wishes,

Sanjay

PS: This is about 0.01% of what we do, so this is as much as I'd like to say about it.

Wishing you a Happy New Year

Folks,

I hope this finds you all doing well. I just wanted to wish you all a very Happy New Year; may 2017 be your very best yet!

Its nice to start a new year on a helpful note, so starting January 26th, 2017, I'll be doing my bit to help the wonderful folks at Microsoft and across the world better understand the most vital aspect of organizational cyber security, Active Directory Security, right here on this blog.

Stay tuned!

Best wishes,
Sanjay

PS: Between now and Jan 20th, I'll get some very basic info out of the way, so we can focus on more vital stuff downstream.