Most lists of free Active Directory tools are lists of free tiers, because a free tool with a company behind it is usually there to introduce you to the paid one.
The honest starting point is that the tools for almost every routine task ship with Windows and are already on the domain controller: the management consoles, the PowerShell module and a set of diagnostic binaries.
Beyond those, four jobs genuinely need something extra, and their terms differ more than the lists suggest. PingCastle in particular is free only for as long as you derive no revenue from it, which is exactly the case an MSP is in.
- The consoles and the PowerShell module are free and already installed
- RSAT puts the same consoles on a workstation, Pro or Enterprise only
- AD Explorer compares two snapshots to show what changed
- BloodHound Community Edition is Apache 2.0, from SpecterOps
- PingCastle is not free if you derive revenue from running it
On this page
Already installedMost of the list is already on the domain controller
Before downloading anything, it is worth knowing what is present on a domain controller. Almost every task people go looking for a free tool to do, from managing user accounts and groups to password resets, reports and permissions, has a built in answer.
Microsoft's own Active Directory management tools are the baseline every other tool on this page is measured against.
| Tool | What it is for | Where it comes from |
|---|---|---|
| Active Directory Users and Computers | The day to day management console: users, groups, computers, organizational units | Installed with the role, and with RSAT |
| Active Directory Administrative Center | The newer management console, and the only place several features have an interface | Installed with the role, and with RSAT |
| Group Policy Management Console | Creating, linking, and reporting on policy | Installed with the role, and with RSAT |
| The ActiveDirectory PowerShell module | Everything the consoles do, across every user and group at once | Installed with the role, and with RSAT |
| ldp.exe, dsquery, repadmin, dcdiag | Raw directory queries, replication and domain controller health | Built into Windows Server |
The Administrative Center is the management console most often skipped, and Microsoft documents three features in it worth knowing about: the Active Directory Recycle Bin, which is the supported way to restore a deleted user or group; fine grained password policies, which is where different password rules apply to different groups of users; and the Windows PowerShell History Viewer, which shows the PowerShell command behind whatever you just did in the interface.
That last one is the most useful free tool on this page. Do the task once by clicking, read the command it generated, and you have the script for the next two hundred.
RSAT is how those Active Directory management tools get onto an administrator's own machine rather than being used by signing in to a domain controller. On current Windows it installs from Settings, under Optional features, by adding the features whose names begin with Remote. Microsoft states one limitation plainly: RSAT installs only on Professional or Enterprise editions, not on Home.
The four gapsThe four jobs that need something extra
Four things the built in Active Directory tools do not do well, and the free option for each. All four are real downloads with real publishers, and the features and terms differ. These are the free Active Directory tools worth having, as opposed to the ones worth knowing you already own.
| Tool | Publisher | What it does | Terms |
|---|---|---|---|
| AD Explorer | Microsoft, as part of Sysinternals | Browse and edit Active Directory, including permissions, and save snapshots to compare later | Free |
| BloodHound Community Edition | SpecterOps | Maps attack paths across Active Directory and Azure | Apache 2.0, open source |
| PingCastle | Now hosted by Netwrix | Scores the security posture of a domain and produces a report on it | Free only if you derive no revenue from it |
| Purple Knight | Semperis | Security assessment finding indicators of exposure and compromise | Free community edition, registration required |
AD Explorer is the tool most people have never used and would use weekly. Microsoft describes it as an advanced Active Directory viewer and editor that can edit permissions and run saved searches.
It also saves snapshots of the Active Directory database for offline viewing, a saved snapshot navigates exactly like a live one, and two snapshots can be compared to see which objects and attributes changed. That is free change reporting for anybody willing to take a snapshot on a schedule.
BloodHound Community Edition answers a security question the management consoles cannot express: not which users are administrators, but which chain of group memberships and permissions gives an ordinary user account access to one. SpecterOps publishes it under Apache 2.0, and it is fed by collectors that gather the data from Active Directory rather than reading it live.
PingCastle produces a scored report on the security posture of a domain, which is why it appears on every list. Its licensing is covered below and is the reason it should not be on a list without a note.
Purple Knight is the free Semperis security assessment for Active Directory, Entra ID and Okta, reporting indicators of exposure and indicators of compromise. It is a community edition of a commercial product line, which is the pattern two sections below.
By jobWhich free tool for which job
The lists are organized by tool. The work of IT teams is organized by job, so here is the same set of Active Directory management tools the other way round.
| The job | What to use | Why that one |
|---|---|---|
| Create, move or disable a user account | Users and Computers, or the PowerShell module | Both do it; the module does two hundred of them |
| Let the help desk reset passwords | Delegation in Active Directory itself | Free, logged, and it needs no extra management tool |
| Report on group membership | The PowerShell module | The same output every time, and it exports |
| Find inactive users and computers | The PowerShell module | Last sign on is an attribute, and stale accounts are an incomplete deprovisioning |
| See the permissions on an organizational unit | Users and Computers, or AD Explorer for the raw access entries | The console summarizes; AD Explorer shows what is really stored |
| Restore a deleted user | The Recycle Bin in the Administrative Center | The supported route, and it keeps group membership |
| Find out what changed since last month | AD Explorer, comparing two snapshots | The only free way to get change reporting without a log pipeline |
| See which accounts can reach a domain administrator | BloodHound Community Edition | It is a graph question, and no console can express it |
| Get a security posture report | PingCastle, or Purple Knight | Both produce findings; read the PingCastle terms first |
| Diagnose replication between domain controllers | repadmin and dcdiag | Built in, and what support will ask you to run anyway |
Seven of these ten are answered by Active Directory tools that are already installed and already licensed. That is the real finding on any list of free Active Directory tools, and it is the one a page selling something cannot comfortably lead with.
Single purpose toolsSingle purpose free tools for accounts, passwords and reports
The long lists of free AD tools are mostly small utilities that each do one task. Many duplicate a few lines of PowerShell, but some save real time, and several come from Microsoft. These are the ones whose publishers describe them plainly enough to check.
| Tool | Publisher | The task | Terms |
|---|---|---|---|
| Account Lockout and Management Tools | Microsoft | Troubleshooting account lockouts | Free download |
| AdRestore | Microsoft, as part of Sysinternals | Restoring deleted objects from the command line | Free |
| AdInsight | Microsoft, as part of Sysinternals | Tracing the LDAP calls an application makes to Active Directory | Free |
| Netwrix Auditor for Active Directory Community Edition | Netwrix | A daily email of changes to users, groups and policies | Free edition of a paid product |
| Netwrix Account Lockout Examiner | Netwrix | Finding the cause of an account lockout | Listed by Netwrix among its free tools |
| ManageEngine free Active Directory tools | ManageEngine | Small utilities for queries, CSV exports, last logon and password policies | Free, beside the paid ADManager Plus |
Account lockouts. Microsoft's download page describes LockoutStatus.exe as finding every domain controller involved in the lockout of a user, so the right logs get gathered. Netwrix describes its Account Lockout Examiner as tracing a lockout to its cause: a mapped drive, a service running under stale credentials, or an old password cached on a phone.
Deleted objects. Microsoft describes AdRestore as a command line utility that enumerates the deleted objects in a domain and offers to restore each one. The Recycle Bin remains the better route where it is enabled, because an object restored from a tombstone comes back without most of its attributes, group membership included.
Change reports. Netwrix describes Auditor Community Edition as tracking logons and changes to users, groups and policies, then emailing a daily summary, with no expiration date. It is equally plain about the limits: the free edition reports what changed and when, not which account made the change, with no alerting or long term storage.
Small utilities. ManageEngine publishes a set of free Active Directory tools beside its paid ADManager Plus, including a query tool, a CSV generator, a last logon reporter, an empty password reporter and a password policy manager. Each does something the PowerShell module also does, with an interface for administrators who prefer one.
The licensingWhat free means here, and what it costs
This is the part the lists leave out, and for a managed service provider it is the part that matters.
PingCastle states its terms directly: under the default license the program can be run for free as long as you do not derive any revenue from it, and it gives the example that a for profit organization may use it to audit its own systems. Including PingCastle in a commercial package or service requires a purchased license.
Read that against what an MSP actually does. Running it against your own domain is free. Running it against a client's domain as part of a paid security assessment is a commercial service, and that is the case the sentence is describing.
The download is also now hosted on the Netwrix website, which is worth knowing before wondering why a search leads somewhere unexpected.
The wider pattern is worth naming rather than complaining about. A free tool published by a company that sells Active Directory management software is a good tool and it is also the top of a funnel.
Free tiers are usually limited by the number of users or objects, by how far back the history goes, by whether anything can be scheduled, or by whether the reports can be exported.
Netwrix, itself a vendor, lists three meanings of free: free forever, capped by object count, or a trial that expires. None of that makes them bad. It makes the free tier a trial with no clock on it, which is a fine thing to accept knowingly and a poor thing to build a process on.
The two categories that do not have this shape are the Microsoft tools, which are free because they are part of the product you already licensed, and the open source ones such as BloodHound, whose license is published and does not change when a sales quarter ends.
PitfallsWhere people go wrong
Downloading a tool for a job PowerShell already does. Finding inactive user accounts that have not signed in for ninety days, reports on group membership and password expiry, or bulk disabling leavers are a few lines each. The module is installed and it produces the same answer every time.
Ignoring the PowerShell History Viewer. It converts the console into a script generator, and it is the fastest way for somebody who clicks to start scripting.
Putting a free tool into a paid service without reading its license. PingCastle is the clear example, and the sentence is one line on their download page.
Treating a free security scanner's score as the assessment. These Active Directory tools report security findings. Deciding which of them matter in this environment is the work, and the score is the input to it.
Running a security tool against a client without saying so. An attack path collection or a posture scan looks like reconnaissance in a log, because that is what it is. Tell somebody first.
Building a process on a free tier. The tier is a commercial decision that can change. The built in tools and the open source ones are the ones a process can safely depend on.
ComparisonBuilt in, a free tier, and a paid product, side by side
| Criterion | Built in and free | Free tier of a product | Paid product |
|---|---|---|---|
| Cost | Nothing, already licensed | Nothing, with limits | Per user or per object |
| Scheduling and alerting | Only what you script | Usually not | Yes |
| History and change reporting | Only what you capture | Usually a short window | Yes, retained |
| Delegating user tasks to a help desk | Through Active Directory permissions themselves | Rarely | Yes, and this is often the real reason |
| Terms can change | No | Yes | Contractual |
| Works with no internet | Yes | Varies | Varies |
The row that decides most purchases is the fourth. Organizations rarely buy Active Directory management software for a capability the built in tools lack. They buy it so that help desk teams who should not have access to the management console can still reset a user password or unlock user accounts, and so that the action is logged.
FAQFrequently asked questions
What are the best free Active Directory tools?
For most management tasks, the ones already installed: Active Directory Users and Computers, the Administrative Center, the Group Policy Management Console and the PowerShell module. Beyond those, AD Explorer, BloodHound Community Edition, PingCastle and Purple Knight cover exploring, permissions, attack paths and security posture.
Is there a free Active Directory management tool from Microsoft?
Yes, and it is the standard one. The management consoles and the PowerShell module come with the role, and RSAT installs the same tools on an administrator's workstation at no cost.
What is RSAT?
Remote Server Administration Tools, the package that puts the server management consoles on a client version of Windows. It installs from Settings, under Optional features, and Microsoft states it works only on Professional or Enterprise editions, not Home.
Is AD Explorer free?
Yes. It is part of Sysinternals, published by Microsoft, and it can save snapshots of the directory and compare two of them to show what changed.
Is PingCastle free for commercial use?
Not by default. PingCastle states that the program runs free as long as you do not derive revenue from it, giving the example of a company auditing its own systems, and that including it in a commercial package or service requires a purchased license.
Is BloodHound free?
BloodHound Community Edition is published by SpecterOps under the Apache 2.0 license. There is also a commercial BloodHound Enterprise, which is a different product.
What is Purple Knight?
A free security assessment tool from Semperis for Active Directory, Entra ID and Okta. It reports indicators of exposure and indicators of compromise, and the community edition requires registration to download.
Can I audit Active Directory changes for free?
Partly. There is no free retained audit trail, but AD Explorer snapshots taken on a schedule and compared give a usable record of what changed between them, and the event logs hold the rest if they are collected.
What can free tools not do?
Scheduling, alerting, retained history and safe delegation of access to people who should not have the console. Those are the capabilities most paid Active Directory management products are actually sold on.
Do I need a tool to find inactive accounts?
No. The PowerShell module reports on the last sign on of every user directly, and that reporting is the same every time it runs, which a one time export from a free tier is not.
Why do so many free AD tools come from software vendors?
Because a useful free tool is an effective introduction to a paid one. That is a reasonable trade as long as you know which one you are accepting, and as long as nothing important depends on terms somebody else can change.
Is there a free alternative to Active Directory itself?
That is a different question from tooling. Samba can act as a domain controller and there are directory services that are not Active Directory, but replacing the directory is a much larger decision than choosing a tool to manage it.
Are there free Active Directory reporting tools and audit tools?
Yes. PowerShell with the ActiveDirectory module is the most capable of the free Active Directory reporting tools, and it can export users, groups, stale accounts and password settings. For security review, free Active Directory audit tools such as PingCastle and Purple Knight score a domain against known weaknesses.
Keep readingRelated concepts
Read next · Directory and identity Active Directory Explained What these tools are managing, and the structure that decides which of them answers a given question. Open this next15 min- Operations · 10 min Provisioning Creating and removing the accounts these tools manage, and why the removing half is the one that leaves things behind.
- Directory and identity · 13 min Group Policy Explained The other console in the same package, and the one whose reporting people most often go looking for a product to replace.