Active Directory Control Paths
A tool for auditing and visualizing control paths in Active Directory to identify privilege escalation and resource access risks.
What is Active Directory Control Paths?
Active Directory Control Paths is a security auditing tool that maps and visualizes control relationships within Active Directory environments. It analyzes LDAP, SYSVOL, and Exchange permissions to identify potential privilege escalation paths and resource access risks, answering questions like "Who can gain Domain Admins privileges?" or "Who can read the CEO's emails?"
Security professionals, penetration testers, and system administrators responsible for auditing and securing Active Directory environments, particularly those needing to identify privilege escalation risks or compliance gaps.
It provides a scalable, graph-based approach to AD security auditing that handles large environments efficiently, supports offline analysis, and offers unique Exchange permission auditing capabilities not found in many generic AD tools.
Overview
Active Directory Control Paths auditing and graphing tools
Use Cases
Best For
- Identifying privilege escalation paths to sensitive groups like Domain Admins
- Auditing Exchange permissions to see who can access specific mailboxes
- Forensic analysis of Active Directory using offline ntds.dit files
- Visualizing complex control relationships in large AD environments
- Assessing security risks from Kerberos delegation or SCCM configurations
- Compliance auditing for access control and permission reviews
Not Ideal For
- Organizations needing real-time, continuous monitoring of Active Directory changes.
- Teams looking for a simple, all-in-one GUI tool for quick security assessments.
- Environments without the resources or expertise to manage a Neo4j graph database instance.
- Projects that require full cross-platform compatibility for the entire auditing process.
Pros & Cons
Pros
Can process Active Directories with over 1 million objects and 150 million ACEs efficiently, using less than 1GB of RAM on a laptop, as explicitly stated in the README's CHANGES section.
Uniquely extracts and analyzes permissions from Exchange components, including RBAC and MAPI folders, to answer specific questions like 'Who can read the CEO's emails?', a feature highlighted in the v1.3 release notes.
Supports working with offline copies of ntds.dit and SYSVOL using tools like dsamain and robocopy, enabling security audits without live domain access, which is crucial for forensic investigations.
Integrates with Neo4j for storing control relationships, allowing customizable Cypher queries to explore complex attack paths, with performance improvements via the Neo4j REST API as noted in the CHANGES.
Cons
The initial data dump step must be performed on a Windows machine (tested on Windows 7+), as stated in the Prerequisites, limiting its use in purely Linux or mixed environments.
Requires specific software versions like Zulu JDK 8 and Neo4j 3.4.1, along with EWS Managed API for Exchange auditing, making installation and configuration non-trivial and error-prone.
Relies on the separate OVALI frontend for graph visualization and manual Neo4j interaction, rather than offering an integrated GUI, which adds steps and potential friction for users.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.