Free, forever

Download SysFlint AD

Audit Active Directory from inside your own network. Free, forever. A single Windows installer, no agents on your domain controllers.

SysFlint AD 0.0.3-beta

BetaReleased August 9, 2026

This is a beta release. It is still being validated in real environments — expect rougher edges than a stable release, and please report anything that looks wrong.

Windows

Download for Windows
Size
18.1 MB
SHA-256
5088c5362ac526221ddfd4d4900fb08bc6f1d2cf5e7dc3bb65cb06ad0c50e0cf

Need a different version? See every past release.

System requirements

Operating system
Windows Server 2016+ or Windows 10/11 (amd64)
Directory
Active Directory Domain Services (any functional level 2008 R2+)
Permissions
A read-only domain account — no Domain Admin rights required
Network
LDAP/LDAPS reachability to at least one domain controller
Domain controllers
No agent, no software, and no schema change on any DC
Internet access
Not required — the tool runs fully offline

Installing it

  1. Pick a machine

    A Windows machine domain-joined to your AD, with LDAP/LDAPS network reachability to a domain controller. Not a domain controller itself — nothing needs to be installed on one.

  2. Run the installer

    One setup file, installed like any other Windows app. It never extends the AD schema, registers anything on a domain controller, or requires internet access to install.

  3. Supply a read-only account

    Point it at your domain with a standard read-only domain account. Domain Admin rights are not required, and the tool never requests write access to the directory.

  4. Run your first report

    Start with privileged group membership and stale accounts — those two answer the questions an auditor or an insurer is most likely to ask first.

What it will and will not touch

  • Runs entirely on hardware you control — there is no SysFlint cloud service to sign up for.
  • No directory data, account names, or report contents are transmitted to SysFlint.
  • Read-only by design: the tool never writes to, disables, or deletes an object in your directory.
  • No agents and no schema extensions on domain controllers.
  • Works in air-gapped and disconnected environments.

Frequently asked questions

Do I need to register or request a license key?
No. There is no registration wall, no key to request, and no email required to download it. The product is free forever.
Can I install it on a domain controller?
You should not, and you do not need to. It is designed to run from a separate domain-joined or network-reachable machine and read the directory over LDAP/LDAPS.
Does the installer need internet access?
No. Both installation and normal operation work fully offline, which is what makes it usable in air-gapped and segmented environments.
How do I verify the download?
Each release publishes a SHA-256 checksum on this page. Compare it against Get-FileHash on the downloaded installer before running it.
I need an older version — where do I get it?
Every past release stays available on the archive page, each with its own checksums.
How do I update to a new version?
Download the latest installer and run it. It detects the existing install, stops the running app, replaces it in place, and starts it back up — your database and saved reports are untouched. There's no need to uninstall first, and no separate auto-update process running in the background.

Not sure it is the right tool yet? See what it reports on, or read how it compares with the scripts you are probably already running.