TOMORISDirectoryOpsWINDOWS CONSOLE FOR ACTIVE DIRECTORY
Active Directory. Never flying blind.
DirectoryOps is a Windows console for Active Directory and an alternative to ADUC (dsa.msc). You always see which domain and which domain controller you are working on, find objects even in large directories and assess the security of your AD. No servers, no agents, no cloud requirement.
IN BRIEF
What DirectoryOps
does day to day.
- 01ADUC ALTERNATIVE
Always know your target
A banner shows the domain, domain controller, identity as reported by the DC and the production or test classification. Paged search even beyond 100,000 objects, readable attributes instead of raw values, delegation per OU in plain language. Password, LAPS and BitLocker attributes are never requested.
- 02RISK ASSESSMENT
130 rules, including AD CS
130 in-house rules in four categories: stale objects, privileged accounts, trusts and anomalies. They include ten rules on Certificate Services (AD CS) from ESC1 to ESC13 and tier 0 control paths. Every finding comes with an explanation, evidence, a mapping to MITRE ATT&CK, CIS and NIS2 and a remediation script with backup and undo.
- 03SCORING
TOMORIS Secure Score
One overall score from 0 to 100 (higher is better), plus a risk value per category, maturity level and coverage. The formula is published; exceptions with a justification never count as passed.
- 04QUIET READING
No attack patterns on the wire
The risk assessment reads the directory with general, paged searches and evaluates all rules locally. The targeted LDAP filters that Microsoft Defender recognises as reconnaissance no longer go to the DC. Behaviour-based detection may still report the reading; the console provides a notice text for your SOC.
- 05UPDATES
Signed, offline too
Updates arrive automatically, through an internal share or fully offline. They can be controlled by Group Policy, and the signature is checked before every installation.
- 06LICENCE
Per forest, not per admin
Licensing is per forest, with unlimited admins. The licence is a signed file and is checked offline. When the subscription ends, the console keeps working as Community.
Status of version 0.1.0 (signed MSI, stable channel): reading, search, attributes, delegation, risk assessment, TOMORIS Secure Score, remediation scripts and quiet reading have shipped. Still in progress: running remediation directly from the console (Release 2) and applying edits, roles per OU and OU templates.
EDITIONS
Start for free.
Try Pro for 30 days.
- Community: free with no time limit, including the risk assessment, remediation scripts, the ATT&CK, CIS and NIS2 mapping and reports without a watermark
- Pro: adds the TOMORIS Secure Score history and trend plus exceptions with a justification
- Try Pro free for 30 days, offline via licence file; afterwards it falls back to Community, without a lockout
- MSP and Consultant editions for service providers who use DirectoryOps at their customers
Pricing and the edition comparison are on directoryops.tomoris.com.
CLEAR ANSWERS
Frequently asked.
Do I need Domain Admin rights for DirectoryOps?
No. DirectoryOps works with the rights of the signed-in account. The domain controller decides what you may see and change, and the console shows it to you.
What do I need to install?
Only the console on the admin workstation. The package includes .NET, needs no administrator rights on the workstation to work and nothing on the domain controllers.
Which systems are supported?
Console: current versions of Windows 11 and Windows Server 2019 to 2025 (x64). Domain controllers: Windows Server 2016 to 2025.
Does DirectoryOps work without internet access?
Yes. The licence is checked offline from a file, and updates can come from an internal share or as a file if you prefer.
YOUR NEXT STEP
See DirectoryOps
for yourself.
Download the signed MSI from the product website, with no account and no form. For questions about rollout and licensing, contact us directly.