Identities and access

    Active Directory monitoring: who has access to what and what is wrong in your domain

    FlowPro NG connects to your domain controllers over LDAPS, regularly reads users, computers, groups and organisational units and looks for risky accounts on its own. AD computers are linked to your asset inventory.
    Try it free for 14 daysOnline demo
    flowpro.local/assets
    Asset inventory in FlowPro NG

    Inside a network, attackers go for accounts first. Forgotten AD accounts make it easy.

    A former employee's account nobody disabled, a password that never expires, a service account open to Kerberoasting. These pile up in a domain over the years and nobody sees them in the AD management tools until an attacker uses them.

    Access control and account management are also part of the NIS2 requirements. FlowPro NG gives you a regular view of your domain's state next to logs, flows and vulnerabilities, on your own server and without installing anything on the domain controllers.

    What you get

    Active Directory monitoring in FlowPro NG

    Sync over LDAPS

    Connects to AD only over encrypted LDAPS (port 636) with a read-only account. Supports multiple domains, each connection has its own sync interval. The bind password is stored encrypted.

    Users, computers, groups and OUs

    A clear domain inventory: who last logged on and when, when the password was changed, which groups an account belongs to and which OU it sits in. Search and filters instead of clicking through the console.

    10 risk checks

    After every sync FlowPro NG checks for inactive accounts and computers, old passwords, passwords that never expire, accounts with no password required, reversible password encryption, kerberoastable accounts and inconsistencies in privileged groups.

    Privileged groups under watch

    Checks flag unexpected members of administrator groups, disabled accounts left inside them and accounts with the adminCount flag outside those groups.

    AD computers in the asset inventory

    Domain computers are linked to devices in FlowPro NG. For each device you then see its logs, flows, vulnerabilities and AD status in one place.

    Windows security events (beta)

    Windows event analysis is available as a beta: logons, account and group changes, privilege use and Kerberos. Detection templates cover for example brute force, Kerberoasting and a cleared audit log.

    • Active Directory
    • LDAPS
    • Kerberos
    • Kerberoasting
    • AS-REP Roasting
    • Windows Security Log
    • Elastic Agent
    • NIS2

    How it works

    Up and running in a few steps

    1. 01

      Prepare a read-only account

      A regular domain account with directory read access is enough. The domain controller must accept LDAPS on port 636 and be reachable from the FlowPro NG server.

    2. 02

      Add the connection

      In the Active Directory module, enter the domain controller, Bind DN, Base DN and password. Test the connection first, then set the sync interval.

    3. 03

      Review the findings

      After the first sync you see the domain inventory and check results sorted by severity. You fix things in AD as usual and FlowPro NG verifies them at the next sync.

    FAQ

    Frequently asked questions

    How do I find inactive accounts in AD?

    Manually, for example with PowerShell and the lastLogonTimestamp attribute. FlowPro NG does it automatically after every sync: enabled accounts that have not logged on for more than 90 days are reported as a finding. Computers are checked the same way.

    What is Kerberoasting?

    An attack in which any logged-on user requests a Kerberos service ticket for an account with an SPN and then cracks its password offline. Service accounts with weak passwords are most at risk. FlowPro NG finds such accounts in your domain.

    Do I need to install anything on the domain controllers?

    Not for the inventory and checks: FlowPro NG reads the directory over LDAPS. You only need the Elastic Agent if you also want to collect Windows security events.

    Does FlowPro NG change anything in Active Directory?

    No. The module only reads the directory and works with an account without administrator rights. You fix findings yourself in the AD management tools.

    Can FlowPro NG handle multiple domains?

    Yes. Add a separate connection with its own sync interval for each domain. Check results are shown per domain.

    Related solutions

    SIEM and log managementLogs from servers, workstations and network devices in one place. Search, detection rules and alerts on your own server.Vulnerability managementKnown vulnerabilities from NVD matched to your devices. Prioritised by the CISA KEV catalogue, EPSS and CVSS, not by the length of the list.Network anomaly detection17 detections over network flows every minute: port scans, floods, data exfiltration, beaconing, lateral movement, tunnels.
    How FlowPro NG compares to Wazuh, Elastic, Splunk and Flowmon

    Try it on your own network

    The 14-day Enterprise trial unlocks every module. You install it on your own server, no credit card needed.

    Start Free TrialOnline Demo