List users in Active Directory with optional filtering.

This tool retrieves users from the specified organizational unit or entire domain. Supports custom LDAP filters and attribute selection for targeted queries.

Example:

• List all users: list_users()

• List users in specific OU: list_users(ou="OU=Sales,DC=company,DC=com")

• List with filter: list_users(filter_criteria="(department=IT)")

Returns user information including account status, group memberships, and security details.

Get detailed information about a specific user.

Retrieves comprehensive user information including attributes, group memberships, account status, and computed security fields.

Example:

• get_user(username="jsmith")

Returns detailed user profile with security assessment.

Create a new user account in Active Directory.

Creates a user with specified attributes in the designated organizational unit. Sets the user principal name, sets the initial password and enables the account.

Example:

• create_user(username="jsmith", password="TempPass123!", first_name="John", last_name="Smith", email="jsmith@company.com")

Supports additional attributes and custom OU placement.

Modify user attributes and properties.

Updates existing user attributes including personal information, security settings, and organizational data.

Example:

• modify_user(username="jsmith", attributes={"department": "Marketing", "title": "Manager"})

The password cannot be changed with this tool; use reset_user_password instead.

Delete a user account from Active Directory.

Permanently removes user account and all associated data. Use with caution.

Example:

• delete_user(username="jsmith")

Validates user existence before deletion.

Enable a user account.

Activates a disabled user account by modifying the userAccountControl attribute.

Example:

• enable_user(username="jsmith")

Allows user to log in and access domain resources.

Disable a user account.

Deactivates a user account preventing login while preserving account data.

Example:

• disable_user(username="jsmith")

Useful for temporary access suspension.

Reset user password with optional auto-generation.

Resets user password to specified value or generates secure random password. Optionally forces password change at next logon.

Example:

• reset_user_password(username="jsmith", force_change=True)

• reset_user_password(username="jsmith", new_password="NewPass123!")

Generated passwords meet complexity requirements.

Get groups that a user is member of.

Retrieves detailed group membership information including group types, scopes, and descriptions.

Example:

• get_user_groups(username="jsmith")

Returns comprehensive group membership analysis.

List groups in Active Directory with filtering options.

Retrieves security and distribution groups with detailed information about scope, type, and membership counts.

Example:

• list_groups()

• list_groups(ou="OU=Security Groups,DC=company,DC=com")

• list_groups(filter_criteria="(groupType=-2147483646)")

Shows group hierarchy and management information.

Get detailed information about a specific group.

Retrieves comprehensive group information including members, parent groups, and management settings.

Example:

• get_group(group_name="Sales Team")

Returns group configuration and membership details.

Create a new group in Active Directory.

Creates security or distribution groups with specified scope and attributes. Supports Global, DomainLocal, and Universal scopes.

Example:

• create_group(group_name="Marketing Team", group_scope="Global", group_type="Security", description="Marketing department")

Fails if a group with that name already exists.

Modify group attributes and properties.

Updates group information including description, managed by settings, and other attributes.

Example:

• modify_group(group_name="Sales Team", attributes={"description": "Updated description"})

Returns an error if the group is not found.

Delete a group from Active Directory.

Permanently removes the group object.

Example:

• delete_group(group_name="Old Project Team")

Validates group existence before deletion.

Add a member to a group.

Adds user, computer, or group as member of specified group.

Example:

• add_group_member(group_name="Sales Team", member_dn="CN=John Smith,OU=Users,DC=company,DC=com")

Fails if the member is already in the group.

Remove a member from a group.

Removes specified member from group membership.

Example:

• remove_group_member(group_name="Sales Team", member_dn="CN=John Smith,OU=Users,DC=company,DC=com")

Validates membership before removal.

Get members of a group with optional recursion.

Lists all group members with option to include nested group members.

Example:

• get_group_members(group_name="Sales Team")

• get_group_members(group_name="All Users", recursive=True)

Shows detailed member information and nesting levels.

List computer objects in Active Directory.

Retrieves computer accounts with operating system information, last logon, and security status.

Example:

• list_computers()

• list_computers(ou="OU=Workstations,DC=company,DC=com")

Shows computer health and security posture.

Get detailed information about a specific computer.

Retrieves comprehensive computer information including OS details, last logon, group memberships, and security settings.

Example:

• get_computer(computer_name="DESKTOP-ABC123")

Returns complete computer profile.

Create a new computer object in Active Directory.

Creates computer account with appropriate attributes and service principal names. Configures DNS hostname and enables account.

Example:

• create_computer(computer_name="NEW-DESKTOP", description="Marketing workstation")

Fails if a computer with that name already exists.

Modify computer attributes and properties.

Updates computer information including description, location, and management settings.

Example:

• modify_computer(computer_name="DESKTOP-ABC123", attributes={"description": "Updated description", "location": "Building A"})

Returns an error if the computer is not found.

Delete a computer object from Active Directory.

Permanently removes computer account and trust relationship.

Example:

• delete_computer(computer_name="OLD-DESKTOP")

Cleans up stale computer accounts.

Enable a computer account.

Activates disabled computer account allowing domain authentication.

Example:

• enable_computer(computer_name="DESKTOP-ABC123")

Restores computer trust relationship.

Disable a computer account.

Deactivates computer account preventing domain authentication.

Example:

• disable_computer(computer_name="DESKTOP-ABC123")

Useful for temporary computer isolation.

Reset computer account password.

Sets a new random 120-character machine password on the computer account (unicodePwd) and returns it once in the response (sensitive; do not log it). Requires an LDAPS/StartTLS connection; refused otherwise. The machine's secure channel breaks, so it must be rejoined or re-synced.

Example:

• reset_computer_password(computer_name="DESKTOP-ABC123")

Returns an error if the computer is not found.

Get computers that haven't logged in for specified days.

Identifies inactive computer accounts that may need cleanup.

Example:

• get_stale_computers(days=90)

Helps maintain clean computer account inventory.

List Organizational Units in Active Directory.

Retrieves OU hierarchy with management information and policy links.

Example:

• list_organizational_units()

• list_organizational_units(parent_ou="OU=Departments,DC=company,DC=com", recursive=True)

Shows OU structure and relationships.

Get detailed information about a specific OU.

Retrieves comprehensive OU information including child objects, GP links, and management settings.

Example:

• get_organizational_unit(ou_dn="OU=Sales,DC=company,DC=com")

Returns complete OU configuration.

Create a new Organizational Unit.

Creates OU with specified attributes and management settings.

Example:

• create_organizational_unit(name="Marketing", parent_ou="OU=Departments,DC=company,DC=com", description="Marketing department")

Establishes OU hierarchy.

Modify OU attributes and properties.

Updates OU information including description, managed by, and location details.

Example:

• modify_organizational_unit(ou_dn="OU=Sales,DC=company,DC=com", attributes={"description": "Updated description"})

Returns an error if the OU is not found.

Delete an Organizational Unit.

Removes OU and optionally all contained objects. Use with caution.

Example:

• delete_organizational_unit(ou_dn="OU=OldDept,DC=company,DC=com", force=False)

Validates OU emptiness unless force deletion specified.

Move an OU to a new parent.

Relocates OU within domain hierarchy while preserving contents.

Example:

• move_organizational_unit(ou_dn="OU=Sales,OU=Old,DC=company,DC=com", new_parent_dn="OU=Departments,DC=company,DC=com")

Maintains OU relationships during move.

Get contents of an OU.

Lists all objects within OU including users, groups, computers, and sub-OUs.

Example:

• get_organizational_unit_contents(ou_dn="OU=Sales,DC=company,DC=com")

• get_organizational_unit_contents(ou_dn="OU=IT,DC=company,DC=com", object_types=["user", "group"])

Provides OU inventory and organization.

Get domain information and security settings.

Retrieves domain configuration including password policies, lockout settings, and security parameters.

Example:

• get_domain_info()

Returns comprehensive domain security posture.

Get information about privileged groups.

Identifies and analyzes high-privilege groups including Domain Admins, Enterprise Admins, and other administrative groups.

Example:

• get_privileged_groups()

Essential for security auditing and compliance.

Get effective permissions for a user.

Analyzes user's effective permissions through group memberships and identifies potential security risks.

Example:

• get_user_permissions(username="jsmith")

Provides security risk assessment.

Get users who haven't logged in for specified days.

Identifies inactive user accounts that may pose security risks.

Example:

• get_inactive_users(days=90, include_disabled=False)

Critical for security hygiene and compliance.

Get users with password policy violations.

Identifies accounts with password policy non-compliance including expired passwords, never-expiring passwords, and policy violations.

Example:

• get_password_policy_violations()

Essential for password security compliance.

Audit administrative accounts for security compliance.

Comprehensive security audit of privileged accounts including access patterns, policy compliance, and risk assessment.

Example:

• audit_admin_accounts()

Critical for administrative account security.

Test LDAP connection and get server information.

Validates Active Directory connectivity and retrieves server status.

Example:

• test_connection()

Useful for troubleshooting and monitoring.

Health check for Active Directory MCP server.

Returns server status, LDAP connectivity, and system health information.

Example:

• health()

Essential for monitoring and alerting.

Get schema information for all available tools.

Retrieves comprehensive information about all tools, their parameters, and capabilities.

Example:

• get_schema_info()

Useful for API documentation and integration.

Get all direct and nested members of a group.

Resolves the group by sAMAccountName and evaluates transitive membership on the domain controller in a single query (LDAP_MATCHING_RULE_IN_CHAIN), so deep or cyclic nesting is handled without client-side recursion. Results are confined to the configured base DN and capped by max_list_results (see "truncated").

Example:

• get_nested_group_members(group_name="Domain Admins")

Returns members with dn, sAMAccountName, displayName and type.

Get rootDSE information from the domain controller.

Returns naming contexts, DC host name, functional levels, supported LDAP versions and SASL mechanisms, current time and sync/global-catalog state. Takes no input; a fixed attribute allow-list is read.

Example:

• get_rootdse_info()

Useful to confirm which DC answered and its functional level.

Report the TLS posture of the connection to the domain controller.

Returns the configured values (use_ssl, ssl_port, enable_tls, validate_certificate, whether a CA file is set, require_secure_connection), the live channel (ldaps, starttls or plaintext, plus TLS version and cipher when available) and a list of findings {severity, code, message}. Takes no input; no secrets or paths are returned.

Example:

• get_tls_posture()

Useful to verify that the bind is encrypted and the certificate is validated.