Active Directory Toolkit
Parse LDAP filters, decode Security Identifiers, calculate Group Policy precedence, analyze group nesting, and work out Kerberos ticket lifetimes — five tools covering the parts of AD administration that are easiest to get subtly wrong. All run entirely in your browser.
How these fit together
LDAP Filter Parser & Validator breaks down a search filter's AND/OR/NOT structure, substrings, and extensible matches into plain English before you run it against a real directory. SID Decoder decodes a Security Identifier into its revision, authority, and sub-authorities, and recognizes well-known SIDs and RIDs like Domain Admins. Working out which of several linked Group Policy Objects actually wins a setting conflict? GPO Precedence Calculator accounts for LSDOU order, Block Inheritance, and Enforced links. AD Security Group Nesting Analyzer detects circular group membership and flattens a user's effective membership through nested groups, flagging Kerberos token-bloat risk along the way. And Kerberos Ticket Lifetime Calculator works out a ticket's expiry and renewal window from your domain's Kerberos Policy settings.
LDAP Filter Parser & Validator
Parse an LDAP search filter into a plain-English breakdown — AND/OR/NOT, substrings, and extensible matches.
SID Decoder
Decode a Windows Security Identifier into its components and recognize well-known SIDs and RIDs.
GPO Precedence Calculator
Compute which Group Policy Object wins, accounting for LSDOU order, Block Inheritance, and Enforced links.
AD Security Group Nesting Analyzer
Detect circular group membership and compute a user's effective group membership through nesting.
Kerberos Ticket Lifetime Calculator
Compute a Kerberos ticket's expiry, renew-till cap, and whether a renewal attempt would succeed.