Release 1
You always see where you are
Domain, DC, connection type, identity per DC, functional levels and operations masters in one banner. Production and test have their own colours, so nobody works in the wrong forest.
DirectoryOps · The ADUC replacement for Windows
Active Directory. No guesswork.
Active Directory the way it should be in 2026: a modern Windows console that replaces ADUC (dsa.msc). You always see which domain and which DC you are working on, find objects even in large directories and read attributes the way humans read them. No servers, no agents, no cloud lock-in.
- Windows 11 · Server 2019 to 2025
- No Domain Admin required
- No telemetry
- 0Servers, agents, services
- 100,000+Objects, page by page
- 249ADUC functions openly assessed
- 0 ByteOutbound telemetry
In three steps
Target. Find. Understand.
Anyone who runs AD wants to know three things for sure: where they are working, where the object lives and what its values mean. That is exactly what Release 1 is built for.
-
Choose the target explicitly
You pick the domain and domain controller yourself, from the directory's DC list with site and operating system. The banner always shows where you are: production or test in its own colour, identity per DC, READ ONLY. No silent DC switch.
-
Find it, even among 100,000+ objects
Free text, search base, filters or your own LDAP filter. Large directories load page by page and can be cancelled, incomplete results are marked. Plus saved searches, favourites and CSV export.
-
Understand instead of decipher
One click on a result opens its attributes: times as dates, flags as words, SIDs readable, multi-valued attributes complete. Whether you may change an attribute is decided by the DC, not guessed by the console.
Proven, not promised
What Release 1 does today
Everything in this section runs in the current version against real domains. What is still in progress is listed further down, separately and clearly marked.
Release 1
Secrets are never even requested
The console never queries password, LAPS, BitLocker or any attribute the schema marks as confidential. What is never loaded cannot be shown, exported or logged.
- ms-Mcs-AdmPwdnot requested
- msLAPS-Passwordnot requested
- msFVE-RecoveryPasswordnot requested
Release 1
100,000+
Fast search, page by page
Paging, cancel and a result cap with a notice. Saved searches, favourites by objectGUID that survive moves, and CSV export.
Release 1
Values you can actually read
Straight from the search result, with schema hints and “writable for you” according to the DC.
RawlastLogonTimestamp: 13437551520000000027 Oct 2026, 06:12
RawuserAccountControl: 66048Enabled · password never expires
Release 1
Delegation in plain language
Per OU: who may do what, set directly or inherited. No dsacls, no puzzling over GUIDs.
Raw(OA;CI;CR;00299570-246d-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-21-…-1131)Helpdesk-Wien may reset user passwords
Release 1
AD design checks
Checks at the push of a button, with explanation, recommendation and test method per finding, in plain language.
Release 1
Signed updates
Automatic, from an internal share or fully offline. Controllable by Group Policy; the signature is verified before every installation.
Release 1
Your rights, no Domain Admin
DirectoryOps uses the rights of the signed-in account. No service account with full access, no server holding all the rights, no local admin rights on the workstation.
What it looks like
A console that is tidy
Light or dark, just like your Windows. Search on the left, attributes on the right, the target always on top.
What goes where
Everything stays in your network
DirectoryOps is a Windows application, not a service. LDAP runs between console and domain controller, signed and encrypted. Almost nothing goes outside, and that little can be switched off.
Stays in your network
- The console ↔ DC connection: LDAP with Kerberos, signed and encrypted, or LDAPS
- Settings, saved searches and favourites in the user profile
- The operations log, without attribute values, search terms or DNs
Goes outside
- Only the update check, which can be switched off and controlled by GPO. Updates also work from an internal share or offline.
- The licence is checked offline via a file, with no connection to us.
Does not exist
- Outbound telemetry. Usage counters, if you switch them on, stay local.
- Servers, agents or services on your domain controllers
In progress
What comes next
Honestly separated: these features are in progress. What belongs to Release 1 is marked as such. We announce dates once they are fixed.
- Release 1 · in progress
Risk assessment and TOMORIS Secure Score
An overall score for your AD, a score per category and every finding with its reasoning. Remediation straight from the console, with preview and undo. Learn more
- In progress
Editing with preview
Every change shows beforehand what changes where. Plus bulk changes with preview instead of scripts.
- In progress
Per-OU rights by role
Roles like “Helpdesk site Wien” instead of dsacls and the delegation wizard. The console shows the entries before they are set.
- In progress
OU templates for the tier model
Create new sites and tier structures from templates, with matching delegation included.
- In progress
Time-limited membership
Group memberships with an expiry time, for example admin rights that end on their own after an hour.
- In progress
gMSA wizard
Create group managed service accounts step by step, with prerequisite checks.
- Coming soon
PolicyOps
The second console: compare, version, search and report on Group Policy. More about PolicyOps
Who it is for
For people who really run AD
IT departments, helpdesks and service providers in the DACH region who work in Active Directory every day and never want to make a change in the wrong forest.
- IT admins
Less guesswork
No more guessing which DC is answering. And no attribute editor that writes LAPS passwords into your export.
- Helpdesk
Find fast, read safely
With READ ONLY and their own narrowly scoped rights. No Domain Admin account, no fear of the wrong click.
- MSPs
Many customers, one tool
The target banner shows in colour which customer you are working on. Licensed per tenant and month, reported offline.
Pricing
Fair, per forest
No price per admin, because good delegation should not cost extra. Community is free and stays free.
Community
Everything read-only plus a full risk assessment with remediation scripts, for your own organisation.
Freeforever, no time limit
- Target banner, explicit domain and DC choice, READ ONLY
- Paged search, saved searches, favourites, CSV export
- Attribute view with secrets filter, plain-language delegation
- Risk assessment with 130 rules (AD CS ESC1 to ESC13, tier 0 paths), TOMORIS Secure Score, maturity level, every finding explained
- Remediation script for every rule with -WhatIf, backup and undo
- Mapping to MITRE ATT&CK, CIS and NIS2, report as HTML and JSON without watermark
- Quiet read: no reconnaissance alert in Defender for Identity
- Signed updates, automatic or offline
For your own organisation only, no commercial use at customers. Lab licences for test and training forests are free as well.
Pro
RecommendedAnnual subscription, unlimited admins, tiered by enabled, non-expired user accounts.
On requestper forest and year · plus VAT
User accounts Tier per year Sup to 250 On request Mup to 1,000 On request Lup to 3,000 On request XLup to 10,000 On request XXLover 10,000 Quote - Everything in Community
- TOMORIS Secure Score history and trend, new and fixed since the last run
- Exceptions with justification per finding
- Email support (in German)
- Run remediation directly from the console, with audit log In progress
- Editing, per-OU permissions by role, applying OU templates, reports with your own logo In progress
Introductory price until general availability, locked in for 3 years. Try Pro free for 30 days, offline via licence file; afterwards you fall back to Community, with no lock-out and no data loss.
MSP
Pro scope for customer forests, billed monthly, from 5 tenants.
On requestper tenant and month · plus VAT
User accounts per tenant Tier per month Sup to 250 On request Mup to 1,000 On request Lup to 3,000 On request XLover 3,000 Quote - Full Pro scope per tenant, risk assessment included
- Cross-tenant overview In progress
- Minimum 5 tenants, billed monthly
- Reporting via a signed offline log, no phoning home
For service providers who use DirectoryOps as part of their service to customers. One tier per booking; tenants of different sizes on request.
Prices on request via Contact. All prices net, plus VAT. Pro and Consultant are annual subscriptions, MSP is monthly. Pro applies per forest, with all domains and unlimited admins; we count enabled, non-expired user accounts. Anything the overview does not list (Pro above 10,000 accounts, MSP above 3,000 accounts per tenant, tenants of different sizes, purchase instead of subscription, bundle with PolicyOps) is available on request.
All prices, consultant licence and comparison
Licence
Questions about pricing and licensing
Why per forest and not per admin?
Because good delegation should not be penalised. If you give your helpdesk its own narrowly scoped rights instead of sharing one admin account, you should not pay more for it. The licence is bound to the forest and checked offline.
What is the introductory price?
If you buy Pro before general availability, you pay the introductory price in every tier instead of the later list price. That price is locked in for three years. Current amounts are shown in the overview above.
Can I use Community at customers?
No, Community is for your own organisation. For assessments at customers there is the consultant licence or the Assessment Pass; for ongoing operations at customers, the MSP model.
Can I buy instead of subscribing?
Yes, on request with a separate quote: a perpetual right to use the purchased version with a maintenance contract. Without maintenance the purchased version keeps working, just without updates.
Can I pay by invoice?
Yes. Companies and public-sector customers get a quote on request and buy on invoice.
What happens when the subscription ends?
The console falls back to Community. Reading keeps working, nothing is locked, and saved searches and settings are kept.
Is there a bundle with PolicyOps?
Yes, as soon as PolicyOps is available we will also offer DirectoryOps and PolicyOps as a bundle. The bundle price is available on request.
Honestly
What you should know
What we do not claim
- No 100 % parity with ADUC in Release 1. We keep a parity matrix of 249 functions in the open and say for each one which release it comes in.
- Release 1 is read-only. Editing, roles and templates are in progress and marked as such above.
- DirectoryOps does not replace a backup or recovery tool for Active Directory.
- No Exchange tabs. You keep managing mailboxes in the Exchange admin center or with PowerShell.
- No change auditing and no self-service portal for end users. Specialised tools exist for that.
Do I need Domain Admin rights?
No. DirectoryOps works with the rights of the signed-in account. The domain controller decides what you may see and change, and the console shows you.
What do I need to install?
Only the console on the admin workstation. The package ships with .NET, needs no local administrator rights to work, and nothing on the domain controllers.
Which systems are supported?
Console: current versions of Windows 11 and Windows Server 2019 to 2025 (x64). Domain controllers: Windows Server 2016 to 2025.
Does it work without internet access?
Yes. The licence is checked offline via a file, and updates can come from an internal share or as a file.
What about Group Policy?
That is what PolicyOps is for: a dedicated console for GPOs, cheaper in a bundle with DirectoryOps. More about PolicyOps
Done with dsa.msc. See clearly from today.
Community is free with no time limit. Try Pro free for 30 days, offline via licence file.