v4.2.1
November 10, 2026
New
- Password reset, rebuilt for the help desk. Tools > Password Reset now opens on a start screen showing who is locked out right now (read live from the directory), whose password expires today or tomorrow or within 7 days, and how many resets you've done today. Pick someone from a list, or search by name, logon name, email or employee ID, to see their account and its lockout state on each domain controller. Unlock or reset from the panel beside it. After a reset, a results screen shows the password to read to the caller, spelled out letter by letter, and checks that each domain controller has the unlock.
- Password reset settings. A new Settings > Password reset page sets the rules for generated passwords: minimum length, which kinds of character are required, and whether the username is allowed. It also sets whether Unlock the account and Must change at next logon start switched on. A typed password has to meet the same rules.
- Microsoft 365 offboarding. Offboard users can sign the user out of every Microsoft 365 session, remove them from Microsoft 365 groups (distribution lists included), remove their licenses, and block sign-in.
- Microsoft 365 settings in user templates. A template can now create the cloud user too, with its usage location, licenses (including disabled apps) and Microsoft 365 groups. These are checked against the tenant when the template is applied.
Improved
- Bulk update preview. Every account is checked first, and each change is shown as the current value beside the new one. Values that already match show as No change and aren't written. A Member Of column adds users to groups, an OU column moves them, and
{clear}or{remove}empties a value, as in the desktop toolkit. A manager or group that can't be found shows as Not found instead of being skipped silently. - Bulk create check. A check pass previews every row, with errors that block a row and warnings that don't, before anything is created. Bulk create also adds
%username%in paths, home folder creation, and "User cannot change password". - Multi-value attributes. Proxy addresses, other telephone numbers and other mobile numbers separated by semicolons are now written as separate values, in bulk create and bulk update.
- Display names keep their capitals and spaces. A display name built from a name format keeps the names as typed, so First Name + Last Name gives "Matt Roberts" rather than "mattroberts". Logon names are unchanged.
- Groups menu. Tools > Groups now holds All groups, New group, and Update group members (formerly Bulk group membership). The All groups page has its actions in a toolbar across the top, the same as All users.
- Copy user groups. The copy group membership tool is renamed Copy user groups and moved to Tools > Users.
- Offboard page. Offboard and Saved records tabs, an Offboard bar that stays in view, a results popup for each account, and separate Active Directory and Microsoft 365 columns. Page settings are remembered for each admin and domain, and an Offboard button on All users hands over the selected accounts.
- Account browser search. The search box in the account browser searches the directory under the selected OU, or the whole domain when it opens.
- Connections page. The Microsoft 365 setup help is one card, and row actions are in a menu on both connection tables.
- Help links. Most tool and settings pages link to their page in the online documentation.
- Page names. User management and Group management are now All users and All groups.
Fixed
- Clearing an empty attribute. Clearing an attribute that's already empty no longer fails the whole change.
- Menu items follow roles. A tool inside a sidebar menu now only shows to people whose role can open it
v4.2.0
November 6, 2026
Upgrading from an earlier version with a Microsoft 365 connection: re-download and run the setup script from Settings > Connections > Microsoft 365 so the app gets the new permissions. Without it, the Microsoft 365 group features return an access error.
New
- Microsoft 365 group membership. The user panel's Microsoft 365 tab can now add and remove users from distribution lists and mail-enabled security groups, not just security and Microsoft 365 groups. These go through Exchange Online, which the setup script configures.
- Create Microsoft 365 users. The New user form can create a cloud account alongside the on-premises one - assigning licenses and apps and adding the user to Microsoft 365 groups. Security and Microsoft 365 groups are added immediately; distribution and mail-enabled security groups are added automatically once the new mailbox finishes provisioning.
- Notifications. A bell in the title bar surfaces background activity and alerts: when a new user's distribution-group membership finishes applying, and when a Microsoft 365 client secret is nearing or past its expiry.
- Client secret expiry warnings. A Microsoft 365 connection records when its client secret expires, and the app warns before it lapses - a lapsed secret silently breaks every 365 feature.
- Guided 365 setup. Settings > Connections > Microsoft 365 has a "How to connect a tenant" card with a downloadable PowerShell script that creates the app registration, grants every required permission, consents to them, assigns the Exchange role, and creates a client secret.
- Email addresses tab. The user panel gains an Email addresses tab to add, remove, and set the primary proxy address on an account.
Improved
- All subscriptions show in the license picker. The New user license list now includes subscriptions in their grace period (a trial or an expiring plan), so a license with usable seats no longer disappears from the list.
- User management right-click menu. The row menu is trimmed to the common actions and no longer scrolls.
v4.1.9
November 3, 2026
New
- Data standards. A new Settings > Data standards page defines the allowed values for a field, per domain. When a standard is on, the New user and Edit user forms offer those values as a dropdown instead of a free-text box.
- Update proxy addresses. A new tool under Tools > Users adds or rewrites proxy addresses across many accounts: select accounts by search or CSV, add an address from a name format or a custom template, or find and replace text inside existing addresses, with a before and after preview before anything is written.
- Import desktop user templates. Tools > Users > Templates can import the desktop AD Pro Toolkit's
user-templates.json, including proxy addresses and extension attributes. - Locked accounts check. The User management grid gains a Locked button that does a live check for accounts locked out right now and narrows the grid to them.
- Message on scheduled emails. A scheduled report can include a custom message in the body of its email.
- Longer scheduled report intervals. A monthly schedule can now repeat every few months - quarterly, every six months or yearly - on a chosen day.
Improved
- User management toolbar. The action bar is redesigned with the row actions mirrored into the top bar; anything that does not fit collapses into an overflow menu instead of wrapping. Columns, Export and Refresh moved into the grid toolbar, and add / remove groups is now one Modify groups action.
- Relative date filters. Date-field filters on reports now support relative comparisons - older than N days, or within the last or next N days.
- Password expiry is policy-correct. The password expiry date now comes from the directory's computed value, so accounts under a fine-grained password policy show the right date instead of the domain default.
- Show location. Right-clicking a user and choosing Show location now opens a readable folder-tree view of where the account lives, with the full distinguished name below it and a copy button.
- Cleaner tool pages. The tool pages show just their title instead of a breadcrumb.
Fixed
- Offboard page framing. The Offboard users steps no longer sit inside an extra card border, matching the other bulk tools.
v4.1.8
October 25, 2026
New
- Hybrid reports for Active Directory and Microsoft 365. Two new reports under Reports > Hybrid line up on-premises accounts with the cloud: User Last Logon shows each AD user's last logon beside their Entra sign-in, and Computer Last Logon shows each AD computer beside its Entra device.
- Details tab on the Users and Computers tools. The user and computer editors gain a read-only Details tab showing every synced property.
Improved
- Cleanup page. The per-group check cards are now a single dropdown, with the "Last updated" time and a Refresh control beside it, so the results below get the full page width.
- Computer group membership. Tools > Computers now manages groups with the same checkbox table and Add / Remove selected buttons as Tools > Users, including Scope and Type columns.
Fixed
- Custom attributes export correctly. Custom attribute columns added to a report are now included in the Excel and CSV export instead of coming out blank.
- Reports load once when opened. A report grid no longer fetches its data several times as the page opens, which removes the brief flicker on larger reports.
- Consistent "Groups" tab name. The computer editor's membership tab is now labelled "Groups", matching the user editor and the add-to-groups dialog.
v4.1.7
October 21, 2026
New
- Microsoft 365 connection. Connect the app to one or more Microsoft 365 / Entra tenants from Settings > Connections. You register an app in Entra, grant the Graph permissions shown on the page, and enter the directory id, client id and a client secret; a Test button confirms the connection before it is saved.
- Create Microsoft 365 users from the New User form. A Microsoft 365 tab on the New User form creates a cloud account alongside the on-premises one and assigns licenses. It uses the same user principal name as the on-prem account, so Entra Connect links the two instead of creating a duplicate, and it can block sign-in for an account staged ahead of a start date.
- Log forwarding to a SIEM. A new Settings > Auditing > Log forwarding page sends a copy of every audit event to an external SIEM, log collector or custom application, over Syslog (TCP, TLS or UDP) or an HTTPS webhook, formatted as CEF or JSON.
- Copy group membership tool. A new tool on Tools > Groups copies one account's group membership onto another. Source and target sit side by side, each showing its current groups, and the target table flags which groups will be added, which are already shared, and (optionally) which would be removed to make the two match. It replaces the old Compare membership dialog.
- Delete action for automations. An automation can now delete the matching accounts, behind a required confirmation that spells out that deletion is permanent.
- Certificate authorities on the dashboard. The Domain card on the overview now lists the forest's enterprise certificate authorities (their name and server) where AD CS is deployed.
Improved
- New User form. The user logon name now has an ADUC-style domain suffix dropdown, there is a dedicated name-format picker, and clicking Create shows a progress dialog with each step and, for a generated password, a copy button. Upfront validation catches a duplicate or unverified name before anything is created.
- "Is a member of" filter in custom reports. The user Member Of condition gains "is a member of" and "is not a member of" with a group picker, so you can report on exact group membership.
- Email only when there are matches. An automation can be set to send its email only on a run that actually matched something, instead of every run.
- Group members detail and layout. Adding or removing group members now records the member names in the audit log rather than just a count, and the Members tab gains "Add members" and "Current members" headings with the Add and Remove buttons always in view.
- Grant access and other forms open as dialogs. Granting access on Settings > Access, adding a log-forwarding destination, and adding an Active Directory domain now open in a popup dialog instead of expanding a form down the page.
- New app icon and logo. Refreshed branding throughout the app.
Fixed
- A second role no longer removes an OU limit. Previously, giving an OU-limited admin a second unscoped role (such as Reports) lifted their OU limit everywhere. An OU limit now applies per role, so a Group admin confined to one OU stays confined in the groups tool while a Reports grant on the same person can still cover the whole domain or other OUs.
- SSL Save button placement. On Settings > SSL certificate, "Save and apply" moved out of the title bar into the form, matching every other page.
- Application icon renders at full size. The Windows app and taskbar icon is rebuilt with all the standard sizes so it no longer appears small next to other icons.
v4.1.6
October 15, 2026
New
- Computer admin role. A new scoped role for people who manage computers only - it mirrors the User admin and Group admin roles, granting the Computers tools and reports without the rest.
- "GPOs With Disabled Links" report. A new Group Policy report listing every GPO that has one or more disabled links, so you can find policies that are linked but switched off.
- Add members to a new group, Entra-style. Creating a group now has a two-pane member picker: search the directory on the left and tick people, and they collect in a Selected list on the right - each with an avatar and a one-click remove.
Improved
- Safer bulk selection in the Tools pages. On Users, Groups and Computers, actions that only make sense for one object are now disabled while several are selected, and the Enable/Disable toggle is split into explicit Enable and Disable buttons so a mixed selection is never ambiguous.
- Bulk actions on groups and computers. Tools > Groups can now Delete or Move several groups at once (with a counting confirmation), and Tools > Computers gains bulk attribute editing, matching what Users already had.
- Bulk Edit Attributes moved. On Tools > Users, Bulk Edit Attributes now sits under the Account section instead of in its own group.
- Resizable, sortable columns on group members. The Tools > Groups members list uses the standard grid, so you can drag to resize or reorder columns and click to sort, and it adds Display name and Status columns.
- Group location and audit detail. The Tools > Groups General tab now shows which OU the group lives in, and Settings > Logs > Audit gains a Details column showing what changed - such as which member was added or removed.
- GPO reporting polish. GPO Status is now a sortable, filterable column; Unlinked GPOs no longer counts GPOs that are linked but disabled; and GPO Security Filtering resolves SIDs to readable account and group names.
- Longer group names, with spaces. The pre-Windows 2000 name for a new group now allows up to 256 characters and permits spaces, matching what Active Directory and ADUC accept.
- Group Members column renamed. The group reports "Members" column, which shows a count, is renamed "Member Count".
- Manual sync is administrator-only. "Sync now" and "Force full re-read" are now limited to administrator roles; a reports-only user can still see the sync status but can no longer trigger a read.
Fixed
- "Remove selected" groups was hard to spot. On the user detail panel, removing selected groups is now a proper button rather than a subtle control.
v4.1.5
October 9, 2026
New
- Schedule a custom report. Any report you build under Reports > Custom Reports can now be put on a schedule - emailed, saved to a folder, or both - the same as the built-in reports.
- Scope a custom report to an organizational unit. The custom report builder gains an OU picker, so a report can be limited to objects under one or more OUs (nested OUs included). The scope is saved with the report and applied wherever it runs, including on a schedule.
- Automation report emails include the matched accounts. A report-only automation now attaches a CSV of the accounts it would act on (with the change it would make); an active run attaches the same list with each account's result.
Improved
- Group members, everywhere. The members list on both the Groups report panel and the Tools > Groups editor now shows every member - however many thousands - in a fast, searchable table with Name and Type columns, instead of a capped, slow list. The Tools editor adds tick-boxes and a bulk Remove, and large groups open instantly.
- Redesigned Add/Remove to groups. The Tools > Users group-membership dialog is rebuilt: search the directory and tick several groups to add at once, filter the account's current groups, and remove any with one click. Changes apply immediately - no separate Apply step.
- Reorganized Settings menu. The Settings sidebar is grouped into General, Configuration, Security and Auditing for easier scanning.
- Topology subnets wrap. A site with dozens of subnets now wraps them onto several lines instead of forcing the table to scroll sideways.
Fixed
- Bulk actions on computers acted on only one. In Tools > Computers, selecting several computers and choosing Disable, Enable, Delete or Move now acts on all of them, not just one. The status column also updates straight away after the change instead of waiting for the next sync.
- Computer group members showed as "Unknown". A computer that is a member of a group is now correctly identified as a Computer, with its name, rather than an unknown member. (Reclassified on the next sync.)
- Group panel listed members twice. The Groups report detail panel no longer repeats the member list below the members card.
- Security assessment was visible to the reports-only role. It is now held one tier higher, so a reports-only user no longer sees it; the other dashboards are unchanged.
v4.1.4
October 6, 2026
New
- Save scheduled reports to disk. A scheduled report can now be emailed, saved to a folder on the server (a local path or a network share), or both. Pick the delivery method when you create or edit the schedule; each run is written with a timestamp so one run never overwrites the last.
- Find blank attributes. Automation conditions, and the reports advanced filter, gain "is empty" and "is not empty" - so you can match on whether a field is set, such as users with no Office, department or manager.
- Managed service account support. The Windows service can run as a domain Managed Service Account (sMSA or gMSA), which has no password to store. A new desktop setup wizard configures the service account and its permissions and connects the directory, and the Connections page then shows which account the app authenticates as.
Improved
- Computer edits apply immediately. Saving a change to a computer updates the grid right away - the same live re-read that users and groups already do - instead of waiting for the next sync.
- Connections page shows the service account. It now shows the Windows account the service runs as (Local System or a managed service account) and asks for a username and password only when one is actually needed.
Fixed
- DOMAIN\username logons were rejected. A correct down-level username (DOMAIN\user) with the right password could be refused when testing a connection or syncing; the credential is now passed correctly, so it binds as expected.
v4.1.3
September 30, 2026
New
- Custom report builder. Build, save and run your own reports over users, computers or groups: choose the object type, pick and reorder the columns, add a multi-condition filter, then run or export to Excel, CSV or PDF. Saved reports live under Reports > Custom Reports, split into My Reports and Shared with Me, and open as a normal report page with an Edit path back to the builder.
- Offboarding records. The offboard tool can save a record of each account first - its attributes, group memberships, direct reports and the groups it managed - captured before any step runs. Records are listed in a Saved records card on the offboard page and download as a single Excel workbook, so they are still there after the account is deleted.
- Organizational Unit column. User, computer and group reports can show the parent OU the object lives in, added from the Columns picker.
Improved
- Add group members in bulk. The Members tab in Tools > Groups searches the directory and lets you tick several people and add them all in one action, instead of one at a time.
- Topology. The Structure view lists every site with its subnets and controller count, including empty sites the diagram leaves out, and the Domain controllers table is wider and no longer wraps.
- Force full re-read runs now. Confirming a full re-read on the sync panel starts the pass straight away, rather than only arming the next run and making you press Sync now as a second step.
- The dashboard Changes card opens the Sync log.
- Section landing follows your role. Clicking a sidebar section goes to the first page your role can actually open, instead of an access-denied page - a Group admin clicking Tools lands on Groups.
Fixed
- Cleanup kept a stale selection after a move. The results grid now tracks rows by objectGUID and clears the selection after each action, so moving an account and then disabling it acts on exactly what you ticked instead of reading as two accounts.
- Create user errors are readable. A logon name that is already in use now says "That logon name is already in use" instead of the raw LDAP constraint error.
v4.1.2
September 29, 2026
New
- Custom attributes per object type. Extra LDAP attributes can be configured separately for users, computers and groups, and each shows only in that type's reports.
Improved
- Logs page tabs. Settings > Logs is split into an Audit log and a Sync log, so recent sync activity lives beside the audit trail.
- Scope Cleanup to OUs. Cleanup gains an OU picker, like the reports, so a check can be limited to part of the directory.
v4.1.1
September 29, 2026
New
- Multiple role grants per person. One account can hold more than one scoped role - a Group admin for one OU and a Password Reset holder, say - rather than a single role each.
Improved
- Faster pickers. The user and group search boxes use Ambiguous Name Resolution, an indexed directory lookup, instead of a slow substring scan - the access-control user search in particular is now near-instant.
Fixed
- Assorted fixes across the reports, tools and sync.
v4.1.0
September 19, 2026
New
- Licence seat tiers. The number of admin seats is read from the licence key, with a redesigned Licence page showing the tier, who the licence is registered to, and when it expires.
- User Provisioning role. A scoped role that can create accounts from the New user tool and nothing else - no user grid, reports or settings.
- Licensed automations. Scheduled rules that act on the directory, gated by the licence tier; the free edition runs them in report-only mode.
v4.0.0
September 11, 2026
- Major update: secrets stored in the database are encrypted under a portable master key, the sync is hardened against overlapping and stuck runs, and a group-compare tool is added.