Security

Few rights. Few paths. Nothing secret.

A management tool for Active Directory is itself a target. That is why DirectoryOps has as little as possible: no rights of its own, no server, no phoning home.

READ ONLY in Release 1Writing features so far run only in the test lab.
0 service accountsDirectoryOps works with the signed-in account.
0 bytes of telemetryUsage counters exist only locally and only if you switch them on.

Security model

Six commitments

Each commitment is backed by tests in the code and checked in the lab against real domain controllers.

Reading is the normal case

Release 1 does not write to the directory. Later writing features show every change beforehand and need your explicit click, with an audit log and undo.

No service accounts, no servers

No account with full access that someone could steal. DirectoryOps uses the rights of the signed-in admin; the DC decides what they may see and change.

Secrets are never read

DirectoryOps does not even request password, LAPS, BitLocker, gMSA and trust key attributes, or anything the schema marks as confidential. What is not loaded can be neither displayed nor exported nor logged.

Encrypted to the DC

LDAP with Kerberos, signed and sealed, or LDAPS. No silent switch of the domain controller, no referral chasing into other domains.

Signed updates

Version file signed with ECDSA, package checked via SHA-256, publisher via Authenticode. Older versions are refused. Installation only after a click.

Logs without content

The local operations log contains no attribute values, no search texts and no DNs. It helps with support without mirroring your directory.

What goes where

Connections, complete

This table is the complete list. For firewall rules and the data protection impact assessment.

Destination	Purpose	Protocol	Can be switched off
Your domain controllers	Read the directory	LDAP 389 (Kerberos, signiert + verschlüsselt) / LDAPS 636, Global Catalog 3268/3269	no (purpose of the application)
`directoryops.tomoris.com`	Update check: version file and signature	HTTPS 443	yes, via settings or GPO
TOMORIS download storage (Azure, West Europe)	Download the update package, only after a click	HTTPS 443	yes, together with the update check
Licence	Checking the licence file	no connection, offline	–
Telemetry	does not exist	–	–

The update check uses the system proxy with Windows sign-in. Without internet: internal share or offline package, see Download.

Update chain

What is checked before every installation

The version file and signature are loaded; the ECDSA signature (P-256, SHA-256) is verified before the content is read.
Product, channel and age of the version file must match; a version lower than the highest ever seen is refused.
The package is downloaded and checked against size and SHA-256 from the signed version file.
If the application is signed, the package must carry the same Authenticode publisher.
Only then does DirectoryOps offer the installation. You decide when.

The private signing key lives in an Azure Key Vault with purge protection and leaves it only to sign a release. The application knows only public keys; without a key it checks no updates.

Antivirus and SmartScreen

For customers we publish only packages with the code signature of TOMORIS GmbH. No packers, no scripts loaded at runtime, no hidden services.

Found a vulnerability?

Please report it confidentially to contact@tomoris.com, subject “DirectoryOps security”. We reply within two business days.