PrivLens is a free Active Directory security scanner and AD assessment tool that finds misconfigurations attackers exploit — and delivers a client-ready PDF report in seconds. Run local Active Directory checks and hardening scans with no install, no internet, and no agents.
For IT admins, security teams, consultants, and MSPs — anyone responsible for Active Directory security, compliance, and hardening. Built for fast AD checks with clear, actionable results.
Double-click the binary. It uses your current credentials, reads the directory read-only, and writes a report. That's the whole workflow.
No internet calls, no telemetry, no data upload. Everything stays on the machine it runs on. Safe to run in the most sensitive environments.
A clean PDF report ready to hand to your team, your boss, or your clients — no explanation needed, no manual rewriting.
A curated set of high-impact checks that rarely misfire — chosen so you never have to apologize to a client for a false positive.
PrivLens is built for teams that need reliable Active Directory security scanning without enterprise complexity. Run a focused set of Active Directory checks against proven security rules, assess compliance gaps, and prioritize hardening — all from a single Windows binary that never sends AD data off-premises.
High-impact AD checks for privileged access, delegation, Kerberos exposure, stale accounts, and other common attack paths — designed to surface real risk, not noise.
A curated catalog of Active Directory security rules mapped to severity and remediation — from Community essentials to Professional and Enterprise coverage on the pricing page.
Document identity and access posture for audits, client engagements, and internal reviews. Every finding includes context and a remediation step for faster Active Directory compliance follow-up.
Turn scan results into a hardening backlog: fix excessive Domain Admins, close delegation gaps, rotate stale credentials, and reduce Kerberoastable exposure before attackers find them.
A self-contained PDF: a clear coverage summary, every issue grouped by severity, and a remediation step for each finding.
Excessive privileged membership widens the attack surface. Several appear to be standard user or service accounts rather than dedicated admin identities.
Inactive but enabled privileged accounts are prime targets — nobody notices when they're abused.
Service accounts in privileged groups expand the blast radius of any credential compromise.
Minimum length is below baseline and account lockout is not enforced, weakening every account in the domain.
Static passwords on privileged accounts never rotate, making long-term compromise harder to detect.
↑ The v1 PDF report. Self-contained, shareable, client-ready.
New checks, Pro features, and release news. Share feedback if you like — no spam, occasional updates only.