Getting started
- Install: run the MSI from the download page once with administrator rights, or via software deployment.
- Start: with your normal domain account. DirectoryOps needs no administrator rights on the workstation for daily work.
- Connect: choose the domain, then the domain controller from the list. Classify the connection as production or test; from then on the banner shows it in colour.
- Search: type a name (ANR) or open an OU in the tree on the left. A click on a result shows its attributes.
- Keep: save searches, mark objects as favourites, export results as CSV.
Keyboard shortcuts: Ctrl+F search, Ctrl+1 to Ctrl+8 areas, F5 reload, F1 overview of all shortcuts.
Required rights
DirectoryOps uses only the rights of the signed-in account. For Release 1 a normal domain account is enough:
| Feature | Needs |
|---|---|
| Search, tree, attributes | Read access to the directory (default for “Authenticated Users”) |
| Delegation overview | Reading the OU's permissions (DACL); audit entries (SACL) are not read |
| Design check, risk assessment | Read access to the whole domain; where it is missing, the check reports “not checkable” instead of a wrong result |
| Counting the licence tier | Read access to all user accounts; otherwise the note says “count not possible”, without a lock-out |
| Editing, roles, remediation (in progress) | the respective write rights in AD; DirectoryOps asks the DC beforehand whether you may |
Never needed: Domain Admin, a service account, local admin rights for daily work, or software on the domain controllers.
Network and ports
- To the domain controllers: LDAP 389 (Kerberos, signed and sealed) or LDAPS 636, Global Catalog 3268 or 3269, Kerberos 88, DNS 53.
- Outbound, only for updates: HTTPS 443 to
directoryops.tomoris.comand to the TOMORIS download storage (address on the download page). Can be switched off.
Updates
By default DirectoryOps checks at start, at most once a day, and offers new versions. It installs only after a click. You control this via settings or Group Policy, see update policy; ways without internet are described under internal share and offline package.
Files on the workstation
| Location | Content |
|---|---|
C:\Program Files\TOMORIS\DirectoryOps | Program, signed |
%APPDATA%\TOMORIS\DirectoryOps\einstellungen.json | Settings, saved searches, favourites |
%LOCALAPPDATA%\TOMORIS\DirectoryOps\logs | Operations log without attribute values, search texts or DNs |
%LOCALAPPDATA%\TOMORIS\DirectoryOps\updates | downloaded, verified update packages |
%LOCALAPPDATA%\TOMORIS\DirectoryOps\nutzung.json | Usage counters, only if switched on, only local |
Defender and EDR
The risk assessment reads a lot from the directory. Microsoft Defender for Endpoint, Defender for Identity or another EDR may report this as reconnaissance. Inform your security team beforehand; DirectoryOps provides a ready-made text for that.
Guide for your SOC: Defender and EDR
Frequently asked questions
Do I need Domain Admin rights?
No. DirectoryOps works with the rights of the signed-in account. The domain controller decides what you may see and change, and the console shows you.
Can I keep using ADUC in parallel?
Yes. DirectoryOps changes nothing in ADUC or the RSAT tools and does not need them.
Why can't I see LAPS passwords?
On purpose. Secret attributes are never requested, so they can end up neither on screen nor in an export or the log. For LAPS, use Microsoft's tools with their own permissions.
The search reports “incomplete”. What does that mean?
The search reached the configured limit or was cancelled. Narrow the search base or filter; DirectoryOps never truncates results silently.
The update check fails. What now?
Usually the proxy blocks the destination. Allow the two addresses from “Network and ports” or use an internal share or the offline package. DirectoryOps always rejects an invalid signature; please report that to us.
Does it work without internet access?
Yes. The licence is checked offline via a file, and updates can come from an internal share or as a file.
How do I get support?
By email to contact@tomoris.com. Feel free to attach the operations log; it contains no directory data.