Top 7 Open-Source Active Directory Security Tools

Most privilege escalation in Active Directory is not a missing patch. It is configuration: a group that grants more than anyone realized, a service account holding delegation rights, nested membership nobody intended, or a certificate template that lets an ordinary user request a certificate as anyone. Vulnerability scanners do not see any of this, which is why a specialized open-source tooling ecosystem grew up around it.

These tools are dual-use by nature: the same graph that shows a defender the shortest path to Domain Admin shows an attacker the same thing. Run them against your own estate, with authorization, and treat the findings as a work queue. Licensing in this category deserves attention because several widely recommended tools are free but not open source, or source-available under terms that restrict commercial use, and this guide states each one. For the commercial detection layer see ITDR vendors and what is ITDR.

Evaluation Criteria

We assessed each tool against the following dimensions:

• What it finds, attack paths, misconfigurations, delegation, or exposed credentials
• License, OSI-approved open source versus source-available or free proprietary
• Output usability, whether findings are prioritized and actionable
• Coverage, on-premises AD, AD CS, and Entra ID
• Safety, read-only collection versus active testing
• Maintenance, project health and update cadence

The Top 7 Open-Source Active Directory Security Tools

1. BloodHound Community Edition

Best For: Finding the specific escalation paths from an ordinary user to Domain Admin.

Overview

BloodHound Community Edition, maintained by SpecterOps, models Active Directory and Entra ID relationships as a graph and computes attack paths through them. Its value is that it answers the question no spreadsheet can: given this compromised account, what is the shortest route to domain compromise, and which single change breaks the most paths. Collection is read-only through SharpHound or AzureHound, and the CE release moved to a modern web interface with an API.

Key Features

• Graph-based attack path analysis across AD and Entra ID
• Pre-built queries for common escalation patterns
• Read-only collection via SharpHound and AzureHound
• Web UI with API access for automation
• Path-cutting analysis to prioritize remediation

License Apache 2.0.

Pros

• Turns an unreadable permission graph into a prioritized work queue
• Covers Entra ID as well as on-premises AD, which matters because attackers pivot between them
• The single highest-value tool in this list for most estates

Cons

• Collection at scale takes planning and generates noticeable load
• Findings can overwhelm without a triage approach
• Requires enough AD knowledge to interpret the paths

---

2. PingCastle

Best For: A fast, scored health check that produces a report leadership will read.

Overview

PingCastle produces an Active Directory health check with a Technical Score, Maturity Score, and Risk Level in a single run, covering trust relationships, obsolete protocols, privileged account hygiene, and escalation paths. It is now maintained under Netwrix. Its licensing changed: the open edition is under the Non-Profit Open Software License 3.0, which permits internal use including in for-profit companies but prohibits monetizing it or offering it as a paid service, and is not OSI-approved.

Key Features

• Scored health check report generated in a single pass
• Trust relationship and forest-wide analysis
• Obsolete protocol and legacy configuration detection
• Privileged account and delegation review
• Reports designed to be shared with non-specialists

License Non-Profit Open Software License 3.0 for the open edition (source-available, not OSI-approved). Commercial editions available from Netwrix.

Pros

• Fastest route to a defensible overall picture of AD health
• Output is genuinely readable by management, which drives remediation budget
• Broad coverage in one run

Cons

• Licence terms restrict commercial and service use, so read them before building a practice on it
• Less depth on specific attack paths than BloodHound
• Scoring can create a false sense of completeness

---

3. Certipy

Best For: Finding and demonstrating Active Directory Certificate Services misconfigurations.

Overview

Certipy is the tool for the highest-impact and most commonly misconfigured component in modern AD estates. Active Directory Certificate Services templates frequently allow ordinary users to enrol for certificates that authenticate as anyone, which is a direct path to domain compromise, and the ESC family of techniques catalogues those patterns. Certipy enumerates templates, identifies vulnerable configurations, and can demonstrate the abuse for validation.

Key Features

• Enumerates certificate templates and flags vulnerable configurations
• Covers the ESC misconfiguration classes
• Certificate request, authentication, and forging capabilities for validation
• Works against AD CS from Linux
• Clear reporting of which template creates which risk

License MIT.

Pros

• Targets the most under-audited high-impact area in AD today
• Findings are usually decisive: a vulnerable template is a domain compromise path
• Actively maintained as new ESC techniques are published

Cons

• Offensive capability means it needs authorization and care in use
• Requires AD CS knowledge to interpret and remediate correctly
• Not a general AD assessment tool

---

4. ADeleg

Best For: Reviewing delegated permissions across the directory, which nobody does until it hurts.

Overview

ADeleg maps delegations in Active Directory: who has been granted rights over which objects and organizational units, including the accumulated grants from years of "just give them access to this OU" decisions. Delegation is one of the least visible escalation paths because the permissions look mundane individually and only become dangerous in combination.

Key Features

• Full delegation inventory across OUs and objects
• Highlights non-default and potentially dangerous delegations
• Distinguishes expected from unexpected grants
• Read-only analysis
• Output suited to a remediation backlog

License Open source (MIT).

Pros

• Covers a blind spot that most assessments skip entirely
• Read-only and safe to run in production
• Output maps directly to specific fixes

Cons

• Narrow scope by design
• Requires directory knowledge to separate intended from accidental delegation
• Smaller community than the headline tools

---

5. Impacket

Best For: Protocol-level testing of Kerberos, SMB, and LDAP behaviour.

Overview

Impacket is the Python library and toolkit that most Active Directory testing is built on, implementing the network protocols directly so you can exercise Kerberos, SMB, LDAP, and MSRPC behaviour rather than relying on Windows tooling. For defenders it is how you validate whether a control actually works, whether SMB signing is enforced, whether Kerberoasting is viable, whether relay paths exist.

Key Features

• Direct implementations of SMB, MSRPC, LDAP, and Kerberos
• Scripts for common techniques including Kerberoasting and relay testing
• Cross-platform, runs from Linux against Windows estates
• Foundation library that most other tooling depends on
• Extensive script collection for specific checks

License Apache-modified license (open source), maintained by Fortra.

Pros

• The reference implementation for AD protocol behaviour
• Lets you verify controls empirically rather than trusting configuration
• Underpins most of the ecosystem, so knowledge transfers

Cons

• A toolkit rather than an assessment product: no reports, no prioritization
• Powerful offensive capability requiring authorization and care
• Steep learning curve without protocol knowledge

---

6. adalanche

Best For: Graph analysis of AD permissions with fast, local exploration.

Overview

adalanche collects Active Directory objects and permissions and builds a queryable graph you can explore in a browser, without the collection and database infrastructure BloodHound requires. It is a lighter-weight alternative for teams that want permission graph analysis quickly, and it is particularly good at showing who can do what to a specific object.

Key Features

• Single binary collection and analysis
• Interactive graph exploration in the browser
• Queries oriented around object-level permission questions
• No external database required
• Fast on small to medium estates

License AGPL-3.0.

Pros

• Very low setup cost compared with a full BloodHound deployment
• Object-centric questions are easy to answer
• Genuinely open licence

Cons

• Smaller query library and community than BloodHound
• Less mature Entra ID coverage
• Performance falls off on very large estates

---

7. Snaffler

Best For: Finding the credentials sitting in plain text on file shares.

Overview

Snaffler crawls accessible network shares looking for files likely to contain credentials: scripts with embedded passwords, configuration files, private keys, and connection strings. It exists because the fastest escalation in many environments is not a clever technique, it is a deploy.ps1 on a share that anyone can read, containing a service account password that has not changed in four years.

Key Features

• Automated share enumeration and content classification
• Rules tuned to credential-bearing file types and content patterns
• Prioritized output rather than a raw file list
• Runs from a domain-joined context
• Configurable rules for organization-specific patterns

License Open source (GPL-3.0).

Pros

• Finds a class of exposure that no permission graph will show
• Findings are unambiguous and immediately actionable
• Fast to run and easy to interpret

Cons

• Generates significant share traffic, so coordinate before running
• Rule tuning needed to control false positives in large estates
• Narrow scope

---

How to run an assessment

A sequence that works, in order:

1. PingCastle for a scored overall picture, in an afternoon, that leadership will read.
2. BloodHound Community Edition to find the specific escalation paths, and use path-cutting analysis to identify which single fixes break the most routes.
3. Certipy against Active Directory Certificate Services. Fix these findings first: a vulnerable certificate template is usually a direct, silent path to domain compromise, and issued certificates survive password resets.
4. ADeleg for the delegation backlog, and Snaffler for credentials on shares.
5. Impacket to verify that specific controls, SMB signing and channel binding in particular, are actually enforced rather than merely configured.

Two things worth adding. Run Purple Knight from Semperis alongside these: it is free with no feature caps and genuinely useful, but it is proprietary, not open source, which is why it is not in the list above. And remember that assessment is preventive posture, not detection. Finding an attack path does not tell you whether someone is currently walking it, which is what ITDR tooling is for. See also Silverfort vs Semperis for the runtime protection versus directory resilience split.

Related reading

• Top 5 identity threat detection platforms
• What is ITDR and ISPM
• Identity CVE catalog for the Kerberos and AD CS vulnerability record
• Best ITDR for Active Directory

The open-source identity landscape

This is one of a series covering open-source tooling across every identity category:

• Open-source IAM solutions
• Open-source CIAM platforms
• Open-source IGA tools
• Open-source PAM solutions
• Open-source MFA and passwordless tools
• Open-source authorization tools
• Open-source secrets management
• Open-source password managers
• Open-source zero trust and ZTNA tools
• Open-source machine and workload identity
• Open-source PKI and certificate management
• Open-source directory services and LDAP servers
• Open-source decentralized identity tools
• Open-source cloud entitlement and CIEM tools
• Open-source secrets scanning and NHI tools