ANSSI-FR/AD-control-paths

Free

Active Directory Control Paths auditing and graphing tools

FreeFree tier

Type

Open Source

Company

ANSSI-FR (French National Cybersecurity Agency)

Visit Website GitHub (38 stars)

About ANSSI-FR/AD-control-paths

Active Directory Control Paths auditing and graphing tools by ANSSI-FR. It aggregates control relations between Active Directory entities (users, computers, groups, GPOs, containers) to answer security questions like 'Who can gain Domain Admins privileges?' or 'Who can read the CEO's emails?'. The tool supports dumping data from LDAP, SYSVOL, and Exchange Web Services, importing into a Neo4j graph database, and querying/visualizing control paths. It can handle large Active Directories with over 1 million objects and 150 million ACEs using less than 1GB RAM. Features include Kerberos delegation, SCCM, Exchange permissions, RODC, and LAPS control paths. Note: the repository is archived and read-only as of January 2024.

Key Features

Aggregates control relations between AD entities (users, computers, groups, GPOs, containers)

Answers security questions like 'Who can get Domain Admins privileges?' and 'Who can read the CEO's emails?'

Dumps data from LDAP directory, SYSVOL, and Exchange Web Services (EWS)

Imports control relations into Neo4j graph database

Supports Cypher querying via Neo4j REST API

Provides graph visualization of control paths

Handles large Active Directories (1M+ objects, 150M+ ACEs) with low RAM usage (<1GB)

Includes control paths for Kerberos delegation, SCCM, Exchange permissions, RODC, and LAPS

Automates Neo4j setup and import

Runs dump step on Windows; import, query, visualize on Windows or Linux

Pros & Cons

Pros

Open source and free to use
Efficient processing of very large Active Directories
Comprehensive control path analysis including Exchange, Kerberos, SCCM, LAPS, RODC
Visual graph output aids understanding of complex relationships
Automated setup for Neo4j integration

Cons

Repository archived and no longer maintained (as of Jan 2024)
Dump step requires Windows operating system
Setup requires manual installation of dependencies (JDK, Neo4j, EWS Managed API)
Not beginner-friendly; requires familiarity with Active Directory and Neo4j

Best For

Auditing Active Directory privilege escalation pathsIdentifying who can access sensitive resources (e.g., CEO's emails)Security assessment and penetration testing of Active Directory environmentsMapping control relationships for compliance and governance

FAQ

What does AD-control-paths do?

It aggregates control relations between Active Directory entities to answer security questions like who can gain Domain Admins privileges or read sensitive emails.

What are the prerequisites?

Dump step requires Windows with Zulu JDK 8 and Neo4j 3.4.1. For Exchange permissions, EWS Managed API is needed. Import and query steps can run on Windows or Linux with Java and Neo4j.

Is this tool still maintained?

The repository was archived by the owner on January 8, 2024, and is now read-only.

Can it handle large Active Directories?

Yes, it has processed domains with over 1M objects and 150M ACEs in a few hours on a laptop with under 1GB RAM.