Audits Active Directory without touching it.
Over read-only LDAP it finds account and group anomalies, and runs ownership attestation and periodic access reviews.
Press "Scan" to run 8 sample accounts through the rules; findings and a category score appear.
Main screenOver read-only LDAP it finds account and group anomalies, and runs ownership attestation and periodic access reviews.
The problem
As a directory grows, old passwords, inactive accounts, over-privileged service accounts and groups that belong to nobody pile up. When the auditor asks "who uses this account, and why", there is no answer.
What I built
Kale scans the directory read-only and scores known attack surfaces (Kerberoasting, AS-REP roasting, certificate-template weaknesses and the like) and hygiene issues rule by rule. Every account gets an owner who confirms it; in periodic access-review campaigns reviewers go through their lists. Findings become tickets.
Technical notes
- LDAP reads only; nothing is ever written to the directory
- Large directory syncs raise the memory limit themselves and tidy up on shutdown
- A separate read-only right for governance
Highlights
- Over a hundred rules; category scores with critical, high, medium and low severity
- Ownership attestation: auto-approve mode, groups, reminders
- Periodic access reviews: reviewer groups, observers, target-scoped reviews
- Application and database entitlement checks: external-system accounts via CSV
- Verified on a Samba-based test directory; memory-safe scanning of large directories