01
Privilege escalation paths
Graph every route from an unprivileged user to Domain Admin — nested groups, ACL misuse, shadow admins, and forgotten delegations.
Active Directory Security
Your Active Directory Is Still Your Biggest Blast Radius.
Native AD scanning finds privilege escalation paths, stale accounts, weak GPOs, and Kerberos misconfigurations before attackers do.
Attack surface
What the AD scanner finds
02
Stale & orphaned accounts
Surface dormant users, disabled-but-enabled service accounts and orphaned SIDs that keep sitting inside privileged groups.
03
Weak GPO configurations
Detect insecure logon rights, unsigned scripts, permissive password policies and GPOs writable by non-admin principals.
04
Kerberos misconfigurations
Identify Kerberoasting exposure, unconstrained delegation, RC4-enabled accounts and AS-REP roastable identities.
Collector
Least-privilege collector, on your terms.
The AD collector agent runs read-only LDAP and SYSVOL queries with a scoped service account, supports scheduled credential rotation, and never stores plaintext credentials. Data stays within the customer's chosen deployment boundary — hosted cloud, self-managed on-premises, or fully air-gapped install. No domain writes, no replication rights, no shadow copies.
Dashboard
Privilege escalation detection at a glance
app.alexocloud.ai / tenants / contoso / active-directory
Attack path graph
17 paths to Domain Admin · shortest: 3 hops
Open findings · 6
| Severity | Finding | Scope |
|---|---|---|
| CRITICAL | Path from Domain Users to Domain Admin | 5-hop ACL chain |
| CRITICAL | Unconstrained delegation on member server | SRV-APP-07 |
| HIGH | Kerberoastable service account in Domain Admins | svc-sql-prod |
| HIGH | GPO writable by authenticated users | Default Domain Policy |
| MEDIUM | 142 stale accounts in privileged groups | Enterprise Admins, Backup Operators |
| MEDIUM | RC4 encryption enabled on user accounts | 38 identities |