AD ACL Scanner

A GUI tool to scan and report access control lists (DACLs) in Active Directory, so delegated rights granted years ago do not stay invisible.

Read-only Domain or single OU Permission filters CSV export

Included in AD Pro Toolkit, with 40+ tools in one console.

Find misconfigured delegated permissions

Delegation accumulates. Someone grants a helpdesk group password reset rights on an OU, and years later nobody knows it is there. This finds it.

Delegated permission reports. Scan the whole domain or point it at one OU and see who holds rights like password reset or object deletion.

DACL and SACL analysis. Report on discretionary and system access control lists, including full control, write, password, and inherited rights.

Built-in permission filters. One click for Full Control, Read, Delete, Create, Write, and Password rights.

Filter any column. Narrow by permission, account, or permission type from the filter icon on any column.

Search by user or group. Find exactly where an account holds permissions across the directory.

CSV export. Export any view with filters preserved, ready for Excel or an auditor.

Three steps from opening the tool to handing an auditor a CSV.

01

Open the tool

In AD Pro Toolkit, go to Security > AD ACL Scanner.
02

Choose the scope

Click Browse OU to select the whole domain or a specific OU. Scanning a single OU is usually faster and produces a report an auditor can actually read.
03

Report and export

Click Run Report, then review the results, apply the permission filters and export to CSV with those filters preserved.

Try the ACL Scanner free as part of AD Pro Toolkit. Fifteen days, every tool unlocked.