canix1/ADACLScanner

Health v2 · maintenance only

Adoption not part of the score

1180 stars · 184 forks observed · 2026-10-09

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A PowerShell script (ADACLScan.ps1) with both CLI and GUI interfaces for reporting on discretionary and system access control lists (DACLs/SACLs) in Active Directory. It supports filtering by permission, object type, and property, recursive group expansion, and CSV output for comparisons.

Use cases

• audit who has access to LAPS passwords in Active Directory
• find who can reset user passwords in an OU
• report GenericAll permissions on computer accounts including nested groups
• scan risky AD CS certificate templates from the CLI
• export AD ACLs to CSV for comparison
• investigate AD ACLs during security forensics

When to choose

• you need to audit or report Active Directory permissions without installing heavy tooling
• you want a PowerShell-native tool runnable from non-domain-joined machines with credentials
• you need recursive security principal expansion for ACL analysis

When to avoid

• you need cross-platform tooling (it is Windows/PowerShell and AD specific)
• you need continuous permission monitoring rather than on-demand scans
• your environment does not use Active Directory

Facets

cli-tool · maturity active

security cli gui security windows developer-tools windows cli active-directory acl powershell permissions-audit laps ad-security reporting

Member repositories

For agents

markdown · JSON · MCP: product_card(name="canix1/ADACLScanner")