Identity360 · Part of StreamSoft360

Clean up Active Directory before an attacker uses it

Identity360 reads your Active Directory every day and finds what attackers look for first - stale and never-used accounts, admins with old passwords, Kerberoastable service accounts, risky delegation, a weak password policy - each with the reason and the fix. It never reads passwords or hashes.

Start a free trial Watch how it works See the pricing Sign in to StreamSoft360

Identity360 is one of the fourteen components of StreamSoft360 - one sign-in, one workspace, one bill.

ReadCheckGradeFixRe-check

How it worksAn example: one domain, read overnight

Read the directoryThe agent on a domain-joined machine reads users, computers and admin groups

Check every accountSixteen checks, from stale accounts to delegation

svc-sql is KerberoastableCritical: it's a Domain Admin
With the reason, and the fix step by step

Your team fixes itIn Active Directory, the way you always do

ResolvedThe next read confirms it and the grade goes up

Never passwords or hashes Descriptions stay on your network - only whether they mention a password A grade per directory, tracked over time

What's included

What attackers look for, found first

Stale and never-used accounts

Enabled accounts nobody has signed in with for 90 days, and accounts never used at all.

Privileged groups

Who is in Domain Admins and the other admin groups, nested members included - and when there are too many.

Kerberoastable and AS-REP roastable

Accounts whose passwords an attacker can try to crack offline - critical when they're admins.

Risky delegation

Unconstrained delegation outside the domain controllers, and delegation with protocol transition.

Password hygiene

Passwords that never expire, passwords not required, and admin passwords older than a year.

Passwords in descriptions

Accounts whose description mentions a password - without the description ever leaving your network.

Domain settings

The krbtgt password's age, the built-in Administrator, RC4-only Kerberos, and the password length and lockout policy.

Disabled admins

Disabled accounts still sitting in admin groups.

A grade per directory

One score from A to F, so you know where you stand and can watch it improve.

Accounts and findings

Every account with its last logon, password age and groups; every finding with the reason and the fix.

Feeds Risk360 and Insight360

Findings suggest risks and show on your security posture, tagged with ISO 27001, NIST CSF and CIS references.

Your own private workspace

Your data in a database of its own, roles, compulsory two-step sign-in and a full audit trail.

What it checks

Sixteen checks, each with the fix

Microsoft Entra ID checks are next on the list.

Stale accounts Accounts never used Kerberoastable accounts AS-REP roastable accounts Unconstrained delegation Delegation with protocol transition Passwords that never expire Password not required Old passwords on admin accounts Disabled accounts in admin groups Passwords in descriptions RC4-only Kerberos Built-in Administrator enabled Old krbtgt password Weak password policy Too many Domain Admins