Free — read-only
Download SysFlint AD
Audit Active Directory from inside your own network. Read-only, and free forever. A single Windows installer, no agents on your domain controllers.
SysFlint AD 0.0.8-beta
BetaReleased August 11, 2026This is a beta release. It is still being validated in real environments — expect rougher edges than a stable release, and please report anything that looks wrong.
Windows
Download for Windows- Size
- 18.2 MB
- SHA-256
- dcd50b76062364aec54695b7473f5f70b89af5985948eba62eae1bd624dd0b92
Need a different version? See every past release.
System requirements
- Operating system
- Windows Server 2016+ or Windows 10/11 (amd64)
- Directory
- Active Directory Domain Services (any functional level 2008 R2+)
- Permissions
- A read-only domain account for reporting — no Domain Admin rights required. Applying a diff back to AD (a separate, licensed, opt-in action) needs a write-capable account instead.
- Network
- LDAP/LDAPS reachability to at least one domain controller
- Domain controllers
- No agent, no software, and no schema change on any DC
- Internet access
- Not required — the tool runs fully offline
Installing it
Pick a machine
A Windows machine domain-joined to your AD, with LDAP/LDAPS network reachability to a domain controller. Not a domain controller itself — nothing needs to be installed on one.
Run the installer
One setup file, installed like any other Windows app. It never extends the AD schema, registers anything on a domain controller, or requires internet access to install.
Supply a read-only account
Point it at your domain with a standard read-only domain account. Domain Admin rights are not required, and the tool never requests write access to the directory.
Run your first report
Start with privileged group membership and stale accounts — those two answer the questions an auditor or an insurer is most likely to ask first.
What it will and will not touch
- Runs entirely on hardware you control — there is no SysFlint cloud service to sign up for.
- No directory data, account names, or report contents are transmitted to SysFlint.
- Read-only for every report and every diff: nothing is written to your directory just by looking at one. The one exception is deliberate — restoring a snapshot back to AD — and it only ever runs on changes you explicitly select and confirm, never automatically.
- No agents and no schema extensions on domain controllers.
- Works in air-gapped and disconnected environments.
Frequently asked questions
- Do I need to register or request a license key?
- No. There is no registration wall and no email required to download it, and everything works immediately — every report, every domain, on-demand exports, and viewing any diff. A free evaluation key is only needed later if you want scheduled exports or to apply a diff back to AD.
- Can I install it on a domain controller?
- You should not, and you do not need to. It is designed to run from a separate domain-joined or network-reachable machine and read the directory over LDAP/LDAPS.
- Does the installer need internet access?
- No. Both installation and normal operation work fully offline, which is what makes it usable in air-gapped and segmented environments.
- How do I verify the download?
- Each release publishes a SHA-256 checksum on this page. Compare it against Get-FileHash on the downloaded installer before running it.
- I need an older version — where do I get it?
- Every past release stays available on the archive page, each with its own checksums.
- How do I update to a new version?
- Download the latest installer and run it. It detects the existing install, stops the running app, replaces it in place, and starts it back up — your database and saved reports are untouched. There's no need to uninstall first, and no separate auto-update process running in the background.
Not sure it is the right tool yet? See what it reports on, or read how it compares with the scripts you are probably already running.