Home

Active Directory permissions auditing tools

This toolkit is comprised of two major components:

• esent_dump: a Microsoft Windows command-line tool to dump Active Directory (ESE) databases to tabulated text files;
• dbbrowser: a web frontend designed to enable for efficient browsing and filtering of database tables.

dbbrowser may be used for browsing any MySQL table, but the developped helpers have been aimed specifically at easing repetitive auditing tasks: decoding AD-specific fields, easy result filtering and session replay.

For now, dbbrowser comes with generic import parsers for tabulated files (provided they give the column names on the first line) and specific scripts for handling and precomputing AD-related data and tables.

See paper (in french): https://www.sstic.org/2012/presentation/audit_ace_active_directory/

Please follow updates of the repository itself or from its contributors, as the ANSSI-FR account will not push changes.

2012-07-06

• All tools (with source code) shown at the 2012 SSTIC conference have been pushed to the repository, with sample data