Search/ GitHub

For identity and access engineers

Know who can control what.

You own the permissions, groups, delegation and certificates that decide who can become whom. Pathwarden shows where they have drifted from your tiering model, and how to bring them back in line, with a check before each change and a rollback after.

Start with Tier Zero Your focus areas

Illustration: a permission graph. A user's group membership and one stray permission, shown as a key on the link to Tier Zero, light up as the route to the Pathwarden crown, and a red ring marks it compromised. The permission is revoked: the key drops away, the route goes dark, and the ring turns green: protected.

Why it matters

Active Directory permissions accumulate. Delegations granted through the wizard, AdminSDHolder entries nobody remembers, certificate templates copied from a blog in 2014, an on-premises account synchronized to a Global Administrator. None of them shows up in a group membership review.

Pathwarden reads every security descriptor, template and delegation setting the collector sees, and reports each problem once, at the level the fix happens: one finding per account and object, per template or per CA, with the rights involved and the exact change to make.

Every guide includes

  • Before you change anything: how to find out why a right exists and who depends on it.
  • Fix options with console steps and PowerShell.
  • Verify: the command that proves the change took.
  • Rollback: how to restore the original security descriptor exactly.

Your focus areas

Tier Zero hygiene, delegation, permissions, AD CS and hybrid identity

  1. Define Tier Zero, and defend its edges

    Pathwarden seeds Tier Zero from the built-in privileged groups, domain controllers, AD CS trust anchors and the management planes* it can see. Add what only you know (PAM vaults, backup servers, hypervisors) with tier_zero = [...], and confirm or reject the management planes it found. Then keep Tier Zero accounts clean: no stale accounts, rotated passwords, Protected Users, no logons outside Tier Zero.

    PW-025 PW-028 PW-004 PW-008 PW-009 PW-010 PW-014 PW-023

  2. Clean up permissions (ACLs)

    Pathwarden flags anyone outside Tier Zero who controls a Tier Zero object, broad groups with a path to the domain, and replication rights in the wrong hands. Rights that SDProp copies onto every protected account are reported once, on AdminSDHolder, where you fix them.

    PW-003 PW-001 PW-002 PW-022 PW-027

  3. Tame Kerberos delegation and service accounts

    Pathwarden flags unconstrained delegation outside domain controllers, Kerberoastable accounts on a path to Tier Zero, and accounts with pre-authentication turned off. The fixes are well understood: constrained or resource-based delegation, group Managed Service Accounts, long random passwords and AES-only encryption.

    PW-005 PW-006 PW-007 PW-013 PW-011

  4. Lock down Certificate Services

    Pathwarden checks ESC1, ESC3, ESC4, ESC6, ESC8, ESC9, ESC10, ESC11 and ESC13. ESC11 needs the CA's InterfaceFlags, which the built-in collector* reads in a Full collection. It covers ESC2 through the ESC1 and ESC3 checks, and ESC5 and ESC7 through Tier Zero control. A CA only counts when domain controllers trust it for logon, so retired CAs don't produce noise.

    PW-015 PW-016 PW-017 PW-018 PW-019 PW-020 PW-021 PW-036 AD CS coverage

  5. Close the hybrid gap

    Add AzureHound data and Pathwarden's Entra ID support* follows paths across the boundary: an AD account synchronized to a Global Administrator, an Application Administrator who can add a secret to a privileged service principal, password writeback and Intune reaching back into on-premises Tier Zero.

    PW-031 PW-032 Entra ID and hybrid guide

  6. Extend the model with Privilege Zones

    Define Tier 1 servers, a finance application or any other set of systems as a zone. Each gets its own exposure, count of protected objects and findings. The app's Zones wizard previews what a zone resolves to before you save it.

    Privilege Zones explainedConfiguring zones

Entra ID and hybrid

Where on-premises and cloud identity meet

Cloud and on-premises identity are usually run by different teams, which is why the paths between them often go unreviewed. Add AzureHound data to your collection and Pathwarden follows them in both directions.

Entra ID support* covers the directory, not Azure resources. How it works and what it assumes

Configuration checks

Already running PingCastle?

PingCastle's health check covers hundreds of configuration settings that collector data can't show. Pass its ad_hc_<domain>.xml report alongside your collection and the import* turns each triggered rule into a PC- hygiene finding in the same backlog: with a finding ID, tracked run to run, open to accepting as a risk, and in tickets and exports.

PingCastle import

Certificate Services

The AD CS articles

AD CS is where many domains are most exposed and least reviewed. Each article explains the escalation in plain language and how to fix the template or CA.

Read next

Attack paths

Every relationship Pathwarden follows, and the two it deliberately doesn't.

The configuration file

Extra Tier Zero, zones, thresholds and accepted risks, annotated.

Beyond AD permissions

Scheduled tasks, SQL logins* and other systems, from OpenGraph collectors.

Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.

↑↓ to moveEnter to openEsc to close