13 free and open source Active Directory management tools

Updated: November 2026

If a client runs Windows Server, Active Directory handles their logins, file shares and Group Policy, and the consoles that manage it rarely get a budget line. Here are 13 free and open source Active Directory management tools, sorted by the job each one does, with the license, the OS it runs on and who it fits. One catch for MSPs sits in the security audit section, so read that one before you run anything on a client's domain.

TL;DR

• Short answer. Open source AD tools cover browsing, LDAP editing, security audits and even the domain controller itself, but daily admin still runs on Microsoft's free RSAT and PowerShell.
• Browse and diff. AD Explorer, OpenRSAT and Apache Directory Studio.
• Audit. PingCastle, BloodHound CE, Purple Knight and ADACLScanner.
• Replace the DC. Samba AD on Linux.
• The catch. PingCastle's free edition only covers your own environment.

Start with what Windows already gives you

Before you download anything, the free baseline is already on the box. Remote Server Administration Tools (RSAT) bundles Active Directory Users and Computers (ADUC), the Active Directory Administrative Center (ADAC), Group Policy Management and the PowerShell module. Since Windows 10 version 1809 they ship as optional features, not a separate download, per Microsoft's RSAT documentation.

ADUC is the console everyone learned on. ADAC is the newer one, and it's the friendlier way into the AD Recycle Bin and fine-grained password policies. It also shows the PowerShell behind each click in its history pane, which is a cheap way to learn the cmdlets.

The PowerShell AD module is where the free tooling earns its keep. One line finds every user who hasn't signed in for 90 days: Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly. Pipe it to Export-Csv and you have the quarterly stale-account report a client asks for.

Getting RSAT installed is where people stall. In this August 2026 r/sysadmin thread, an admin hits error 0x80240438 on Windows 11. The top reply is the one-liner Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online, and the next ones explain the cause: the PC is pointed at WSUS and can't reach Windows Update for the feature files.

If you hit the same wall with the ADUC console on Windows 11, our ADUC install guide walks through the WSUS and offline Features on Demand fixes.

Free tools for browsing and editing the directory

These don't replace ADUC. They do the things ADUC is bad at: seeing raw attributes fast, comparing states, and working from a machine that isn't Windows.

AD Explorer

AD Explorer is a free Sysinternals tool from Microsoft. It opens the directory like a file tree and shows every attribute of every object, including the ones ADUC hides behind the Advanced Features toggle. Its best trick is snapshots. Take one before a change, take another after, and Compare Snapshot shows which objects, attributes and permissions moved. It won't tell you who made the change, and a snapshot is not a backup.

OpenRSAT

OpenRSAT comes from Tranquil IT, the French team known for Samba AD work. It's a GPL-3.0 rebuild of the RSAT consoles that runs on Windows, macOS and Linux without admin rights. It covers users, groups and computers, DNS zones and records, and Sites and Services, and it works against both Microsoft AD and Samba AD. Releases are still in the 0.4 range, so test it in a lab before you trust it with a client's OU tree.

Apache Directory Studio

Apache Directory Studio is a general LDAP client under the Apache 2.0 license. It runs anywhere Java 11 runs. Point it at a domain controller and you get an attribute editor, LDIF import and export, and a schema browser. It isn't AD-aware, so there's no "reset password" button. The last milestone release, 2.0.0-M17, shipped in July 2021, so expect a stable tool rather than new features.

LDAP account manager and LDAP admin

LDAP Account Manager (LAM) is a GPL web app for managing users and groups. It suits a Samba domain on Linux, or a help desk that needs a browser page instead of RSAT on every PC. A paid Pro edition adds self-service and more account types.

LDAP Admin is a small GPLv2 Windows editor that still turns up in older guides. The last stable release, 1.8.3, dates from 2017, so treat it as legacy.

Free tools for auditing AD security

This is where free tools beat a lot of paid consoles. AD is the first place attackers go after a phish, and these tools show what they'd find.

PingCastle

PingCastle runs a health check against a domain and produces an HTML report with a risk score, grouped into stale objects, privileged accounts, trusts and anomalies. It needs only a normal domain account to run. A first report on an untouched domain usually reads like a to-do list for the next quarter.

Here's the catch for MSPs. Netwrix, which now owns PingCastle, says on its edition comparison page that the free Community Edition is for auditing your own environment, and using it to audit other organizations needs a commercial license. The source code is public under the Non-Profit Open Software License 3.0, but the license to run the tool is what decides client work. In-house IT can run it free. An MSP running it on client domains should price in the Service Providers license.

This February 2026 walkthrough runs PingCastle against a domain and pipes the findings into Wazuh, so the scan becomes alerts your team can track instead of a report nobody opens twice.

If you don't run Wazuh yet, our Wazuh deployment guide for MSPs covers the multi-client setup.

BloodHound Community Edition

BloodHound CE, from SpecterOps, maps relationships between users, groups, computers and permissions as a graph. Then it answers one question: what's the shortest path from this ordinary user to Domain Admin? Nested groups and forgotten delegations show up as lines you can click. It's Apache 2.0, runs in Docker, and collects data with SharpHound on Windows or a Python collector on Linux. Attackers use the same tool, which is the best argument for running it first. Get written sign-off before you run it on a client's network, because EDR tools often flag the collector.

Purple Knight and ADACLScanner

Purple Knight from Semperis is free but closed source. It scans AD and Entra ID for indicators of exposure and grades each category. Run it next to PingCastle. The two overlap, and where they disagree is worth a look.

ADACLScanner is a PowerShell script under the MS-PL license that reports who holds which permissions on which OUs. It answers the question every delegation review starts with: who can reset passwords on the Finance OU, and why?

The free edition of a paid console

ADManager Plus from ManageEngine has a Free Edition that never expires. It gives you the Standard edition's web console, bulk user creation and reports, but only for 100 objects in one domain. That fits a 20-person office with room to spare. It's freeware, not open source, and the limit means you'll outgrow it the day a client hires.

Samba AD, the open source domain controller

Every tool above manages a Microsoft domain. Samba replaces the domain controller itself. Since version 4, Samba can run as an Active Directory domain controller on Linux under GPLv3. Windows PCs join it like any other domain, and you manage it with the same RSAT consoles.

It's maintained and moving. Samba 4.25.0 shipped on 24 September 2026, and its Kerberos changes now default to AES encryption in domains at functional level 2008 or higher, per Linuxiac's release coverage. The 4.24 release in March fixed a related flaw, CVE-2026-20833, according to Help Net Security.

It fits a small office that wants logins, file shares and Group Policy without Windows Server licenses and CALs. It fits less well if you need features newer than Samba supports, or a vendor that only certifies its software against Windows DCs. Run two Samba DCs, not one, for the same reason you'd run two Windows ones. For the rest of a self-hosted stack around it, see our open source MSP stack.

Running these checks across every client

Free tools solve one domain at a time. With 15 clients, the stale-account report and the security scan become 15 manual jobs a month, and they slide.

That's a scheduling problem, not an AD one. OpenFrame, the open, AI-native infrastructure for IT and security that Flamingo builds, has a script library with parameters and timeouts, plus scheduled scripts that target devices or groups and run when a device comes online. Put the Search-ADAccount report in the library, target every client's domain controller, and the output lands in each run's history. OpenFrame doesn't edit AD objects for you. It runs the PowerShell you already trust on a schedule. Pricing is $1 per device per month, or $0.80 billed yearly.

Pick by job, not by feature list

The free toolbox for AD is better than its reputation. RSAT and PowerShell handle the daily work, AD Explorer and OpenRSAT fill the gaps, and Samba can carry a small domain on its own.

Start with the audit. Run PingCastle and BloodHound CE on a domain you own this week, fix the top three findings, then decide what you'd pay for. Just license PingCastle before it touches a client.