Integrate SYNERGY Management Gateway for Active Directory with 2,000+ apps and services

Get the RootDSE, domain, forest, domain controllers, trusts, sites and optional features in one call

Get the domain, including the base DN and default container DNs that other operations need

Get the domain controllers with their site, roles and global catalog flag

Get the forest, its domains, functional level and UPN suffixes

Get the KDS root keys required before a group managed service account can be created

Get the optional features and whether each is enabled, such as the AD Recycle Bin

Get the RootDSE, including the configuration and schema naming context DNs

Get the replication site links with their cost and interval

Get the replication sites with their subnets and domain controllers

Get the replication subnets and the site each maps to

Get the domain trusts with their direction, type and SID filtering state

Get the members of a group, optionally following group nesting

Delegate control of a container to a group using a named template, as the Delegation of Control Wizard does

Get the decoded access control list of any object: owner, entries with resolved trustees and rights, and whether inheritance is blocked

Get the available delegation templates and the access-control entries each expands to

Report which delegation templates are present on a container, per trustee

Get the SPNs of a user or computer, and whether the account is therefore Kerberoastable

Remove the access-control entries a delegation template defines for a trustee

Protect an organizational unit from accidental deletion, or allow it to be deleted

Replace the complete set of SPNs on a user or computer. Writing one makes the account a Kerberos service target.

Create a managed or group managed service account. The kind cannot be changed afterwards.

Delete a service account. Every service configured to run as it will stop authenticating.

Get one service account, including who may retrieve its managed password

Check whether the forest has a usable KDS root key, which a group managed service account requires

Get managed and group managed service accounts

Get the standalone managed service accounts linked to a computer

Get who can retrieve a group managed service account password

Link or unlink a standalone managed service account and a computer

Replace who can retrieve the managed password. This hands out a usable credential.

Update the description, DNS host name, SPNs or enabled state

Change the password by supplying the current one. Needs only the Change Password right and is enforced against password history and minimum age, unlike Reset Password.

Every group in the account access token, including the primary group and well-known groups that no memberOf read reports

Find users that are locked out, disabled, expired, password-expired or inactive

Set the date the account expires, or clear the expiry so it never expires

Clear a lockout on a user account. Idempotent; check wasLocked in the output to see whether the account had actually been locked.