Find the misconfigurations attackers actually exploit - Kerberoastable and AS-REP-roastable accounts, dangerous delegation, DCSync rights outside Tier 0, and ACL-based escalation paths to Domain Admins - risk-scored and prioritized, before someone else finds them first.
Active Directory Info and Active Directory Permission Reporter show you what the directory looks like right now; Active Directory Change Auditor shows you what changed. Active Directory Security Posture answers a different question: are any of those facts actually exploitable? It scans for the concrete weaknesses attackers use to go from a single foothold to Domain Admin - Kerberoastable and AS-REP-roastable accounts, unconstrained and constrained delegation, DCSync rights held outside Tier 0, privileged-group hygiene gaps, ACL-based privilege-escalation paths to Domain Admins, and trust misconfigurations - and rolls every finding into one Domain Risk Score (0-100, graded A-F) so you can see at a glance whether things are getting better or worse. Every finding - regardless of type - lands in one unified list with built-in queries for severity, finding type, and privileged accounts, plus custom queries and a search by specified principal. Export to CSV, Excel, HTML, XML, or the clipboard, and schedule any of it to run - and email itself to you - unattended.
The real app. Click to zoom in, hover the markers to see what each part does.
Hover a marker for details, or click the screenshot to zoom in.
Every finding rolls up into one 0-100 score, graded A-F, with a diminishing-returns weighting so one Critical finding matters more than a pile of Low-severity noise - track whether your domain is getting safer or worse over time.
Finds service accounts with an SPN set (and flags weak RC4-only encryption specifically) and accounts with Kerberos preauthentication disabled - the two most common offline password-cracking footholds in AD.
Unconstrained delegation, constrained delegation with protocol transition, and DCSync rights (Replicating Directory Changes / All) held by anyone outside Domain Controllers, Domain Admins, or Enterprise Admins.
Finds dangerous ACEs (Full Control, Write DACL, Write Owner, Reset Password, and more) held on Domain Admins, Enterprise Admins, Schema Admins, Administrators, or their direct members - the actual attack paths, not just a permissions dump.
Disabled accounts still sitting in a privileged group, stale adminCount=1 flags left over from a past membership, and external/forest trusts without SID filtering enabled.
Save any query as a recurring report via Windows Task Scheduler, with the result optionally emailed to you afterward - or drive it yourself from scripts with ActiveDirectorySecurityPosture.exe --run-report ... and --run-query ....
Pick how much automation you need, then choose once-off or monthly billing. Active Directory Security Posture licenses per machine, not by domain size.
One-time payment - yours to keep, no subscription.
For the quick wins.
Kerberoastable/AS-REP-roastable/delegation findings and the Domain Risk Score, on screen, free at every tier.
For account & trust hygiene.
Everything in Standard, plus privileged-group-hygiene and trust-misconfiguration findings, and CSV/Text export.
For the real attack paths.
Everything in Standard+, plus DCSync-rights and escalation-path findings, custom queries, and richer export formats.
For continuous monitoring.
Everything in Advanced, plus scheduled & emailed reports and a headless CLI - so you're alerted the moment a new finding appears.
All plans are billed in USD. Prices in other currencies are an approximate conversion for your reference, based on indicative exchange rates - your invoice will be issued in USD.
Standard covers the cheap, high-signal checks: Kerberoastable and AS-REP-roastable accounts, unconstrained/constrained delegation, and the overall Domain Risk Score - all on screen. No privileged-group/trust findings or export at this tier, by design.
Best for: A fast first answer to "how exposed are we, right now?"
Standard+ adds privileged-group-hygiene and trust-misconfiguration findings, plus CSV/Text report export. Everything from Standard is included.
Best for: Regular hygiene reviews of who's actually still privileged.
Advanced adds DCSync-rights and ACL-based escalation-path findings (the heavier ACL-reading checks), custom queries with Manage Custom Attributes, and the richer export formats. Everything from Standard+ is included.
Best for: Security teams mapping real attack paths to Domain Admins, not just symptoms.
Professional adds scheduled reports via Windows Task Scheduler with optional email delivery, and a headless CLI (ActiveDirectorySecurityPosture.exe --run-report, --run-query, --run-custom-query). Everything from Advanced is included.
Best for: Organizations that want to know the moment a new escalation path or DCSync grant appears, not at the next annual audit.
Prices shown are a suggested starting point, not final quotes - contact us to confirm your plan.
Contact us for current pricing and licensing options.
Contact us