Identity Security Audits for
Active Directory and Entra ID
Run fact-based audits for on-prem and cloud identity from the same workflow.
500+ security checks, one edition, everything included. Keep data local in standalone mode, or connect a SaaS daemon for centralized follow-up.
See the platform in action
Critical Open
Unresolved critical findings
↓ 6 since last audit
MFA Coverage
462 of 592 users enrolled
recommended ≥ 95%
Privileged Admins
Tier-0 admin accounts
recommended ≤ 20
Compliance
7 frameworks below threshold
avg across 9 frameworks
Last Audit
Most recent collector run
+8vs previous
31 accounts with CRITICAL risk scores (50+). Immediate action required.
wilson.olivia8719 issuesluo.lan8417 issuesjackson.john8216 issuesshimizu.hana7815 issuesthompson.naomi7614 issuesTout utilisateur du domaine peut joindre jusqu'à 50 machines - passer ms-DS-MachineAccountQuota à 0.
Rotation à effectuer tous les 90-180 jours pour mitiger les Golden Ticket.
Reconnaissance LDAP non-authentifiée possible - désactiver.
Groupe legacy qui donne un accès lecture étendu à tous les utilisateurs authentifiés.
L'Active Directory devrait être sauvegardé régulièrement.
Category Breakdown
No signup. No connector to install. Click, explore.
Read-only audits for Active Directory and Entra ID with structured output, repeatable workflows, and deployment modes that match local-only or centrally managed teams.
Why teams use EtcSec
Audit what exists today, keep the collector close to the environment, and make the results usable for remediation and follow-up.
Read-only by design
Collect from Active Directory over LDAP/LDAPS and SYSVOL, and from Entra ID over Microsoft Graph, without deploying an agent on domain controllers.
Fast, repeatable runs
Benchmark runs complete in seconds, which makes recurring audits practical after every remediation or privilege change.
MITRE ATT&CK context
Map findings to attacker techniques so teams can explain why a control matters, not just that it failed.
Structured remediation workflow
Move from raw detections to prioritized fixes, exports, and follow-up reviews without rebuilding the audit from scratch.
How It Works
A repeatable workflow for AD and Entra ID audits
Deploy the Collector
Install ETC Collector on Linux, macOS, Windows or Docker with the published installer or package guides, then configure the Active Directory and Entra ID providers.
Run the Audit
Run the audit in standalone mode or through the SaaS daemon. The engine checks named detections across AD and Entra ID.
Get Actionable Report
Review prioritized findings, MITRE ATT&CK mapping, exports and remediation guidance from the same workflow.
For isolated networks, keep the standalone server local or export JSON results for downstream review without exposing the collector to the public internet.
ETC CollectorStandalone or SaaS daemon
A cross-platform Go collector for Active Directory and Entra ID. A single edition covers 500+ security checks, Active Directory checks across 14 categories and Microsoft Entra ID checks across 9 categories, including ADCS ESC1-ESC11 and attack path analysis.
VERSION=3.2.0 && curl -LO https://github.com/etcsec-com/etc-collector-com/releases/download/v${VERSION}/etc-collector-${VERSION}-linux-amd64.tar.gz && tar -xzf etc-collector-${VERSION}-linux-amd64.tar.gz && sudo install -m 0755 etc-collector-${VERSION}-linux-amd64/etc-collector /usr/local/bin/etc-collector && sudo etc-collector install --mode serverWhat the platform looks for in AD and Entra ID
From password exposure and Kerberos abuse to Conditional Access drift, PIM, app permissions and guest exposure, the detections stay tied to named findings.
Password and credential exposure
Weak password policy, reversible encryption, password-not-required flags and cleartext attributes.
Kerberos and delegation abuse
AS-REP roasting, Kerberoasting, unconstrained delegation and protocol transition risk.
ADCS and certificate services
ADCS ESC paths, weak certificate mapping and web enrollment exposure.
Dangerous ACLs and DCSync
GenericAll, WriteDACL, AdminSDHolder backdoors, replication rights and RBCD paths.
Conditional Access gaps
Missing MFA, legacy auth drift and policy exclusions that weaken tenant protection.
Privileged access drift
PIM configuration, excessive admin roles, foreign principals and stale privileged accounts.
Apps and external identities
Service principal permissions, stale credentials, multi-tenant apps and guest user exposure.
Explore the full detection catalogue
Browse the public catalogue and the detailed AD and Entra coverage pages.
Read-only collector, standalone mode, SaaS daemon workflow, and detailed coverage pages linked below.
MITRE ATT&CKCoverage Built-In
Mapped to 49 MITRE ATT&CK techniques across Credential Access, Persistence, Defense Evasion, Lateral Movement and Discovery.
Sample Findings with ATT&CK Mapping
Click technique IDs to view details on MITRE ATT&CK
Published methods, results, and full side-by-side detail
Review the documented coverage, runtime, and test conditions for PingCastle and Purple Knight on the dedicated comparison pages.
PingCastle alternative
ETC Collector covered most PingCastle rules on the same AD test domain while adding ADCS, attack paths and Entra ID coverage.
- 59 of the 61 published PingCastle risk rules covered in the documented run
- 876/896 PingCastle risk points mapped
- 6.58s vs ~41s with network probes
Purple Knight alternative
ETC Collector matched the failing Purple Knight signals that mattered and finished much faster, while staying cross-platform and CLI-friendly.
- 115/119 indicators covered
- 49/49 FAIL indicators covered
- 7.99s vs ~3 min on the same domain
Benchmark notes
- Both comparisons were run on the same 546-user, 100-computer AD test domain in February 2026.
- ETC Collector was executed with network probes enabled when the methodology required it.
- Detailed caveats, uncovered edge cases and screenshots stay on the dedicated comparison pages.
- The dedicated comparison pages include the full rule breakdown, screenshots, and remaining gaps from the documented runs.
Available today
Today the live audit providers are Active Directory and Microsoft Entra ID. Both run through the same collector workflow, local GUI/API, and recurring audit model.
Active Directory
On-premises identity
- Tier 0, password policy and privileged group review
- Kerberos, delegation and DCSync exposure
- ACL abuse, AdminSDHolder and RBCD paths
- ADCS findings and certificate template analysis
- Named remediation priorities and exports
Microsoft Entra ID
Cloud identity
- Conditional Access, MFA and legacy auth review
- PIM role configuration and privileged access drift
- App permissions, credentials and multi-tenant exposure
- Guest user visibility and external identity risk
- Named remediation workflow and exports
Current live audit scope: Active Directory and Microsoft Entra ID.
Choose Your Plan
Start with our free collector. Upgrade when you need advanced features like scheduling, compliance reports, and SIEM integration.
Free
- Free forever, no asset limit, fully local
- 500+ Active Directory and Entra ID checks, attack paths, AD CS
- 9 frameworks scored: ANSSI, HDS, NIS 2, CIS, NIST, GDPR
- Local web interface, REST API, JSON export
- Free online account up to 750 assets, 30-day history
Premium
- Everything in Free, plus: 1,250 assets, 90-day history
- PDF export in EtcSec format
- Audit-to-audit comparison, changes highlighted
- Coming soonAudit scheduling and email alerts
- Coming soonGoogle Workspace, Intune and Exchange Online connectors, roles and permissions
Elite
- Everything in Premium, plus: 5,000 assets, 4 audits/day, 1-year history
- Coming soonAll 9 compliance reports per framework included
- Coming soonPlatform API and webhooks
- Priority support in French included
- Coming soonOptional dedicated instance
Enterprise
- Everything in Elite, plus: 12,500 assets, on-demand audits, 2-year history
- Coming soonSSO and SAML
- Coming soonSIEM connector (Splunk, Sentinel)
- 24/7 support included
- Coming soonYour cloud or on-premises, annual commitment
Partner
- €129 per managed client per month, decreasing from the 11th, minimum 5 clients
- 1,250 pooled assets per managed client
- Coming soonMulti-tenant console, white-label, client portal
- Auditing your clients authorized under the FSL-1.1-ALv2 license
- Resale: your price, your invoice, your margin
Need Custom Add-ons?
Use our pricing calculator to add extra users, sites, collectors, compliance packs, and more.
Open Pricing CalculatorExplore the identity security pages that support this topic
Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.
Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.
See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.
Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.
Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.
Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.
Ready to secure youridentity infrastructure?
Run a read-only audit for Active Directory or Entra ID, then choose the local or SaaS workflow that fits your team.
Latest research
Attack chains, compliance mapping and AD/Entra hardening guides
New posts from the EtcSec security team - every finding backed by MITRE ATT&CK and ANSSI mapping.
Browse all articles →