Active Directory Effective Access Auditor is a specialized audit tool designed to help IT teams accurately assess effective access on Active Directory (AD) objects. It is designed to identify who has what privileged access on specific AD objects, including the underlying security permissions and group memberships that grant that access. The tool operates in two modes: - Standard Mode: Determines who has what access on individual AD objects (e.g., OUs, security groups, user accounts), including the ability to create/delete accounts, modify group memberships, reset passwords, or replicate secrets (DCSync). - Single-User Mode: Assesses whether a specific user has any access on a specific AD object and how that access is granted. Core capabilities include accurate effective permissions analysis on AD objects such as the domain root, AdminSDHolder object, Domain Admins group, and individual user accounts. It maps permissions into enactable administrative tasks, enabling organizations to identify excessive privileged access and lock it down. The tool is intended to support privileged access management (PAM) workflows, regulatory compliance demonstrations, and continuous access control. It can identify risks such as who can run DCSync attacks, link malicious GPOs to OUs, modify AdminSDHolder ACLs, or reset passwords of privileged accounts. Results can be exported via one-button CSV exports for analysis, comparison, and archival. The tool was designed by a former Microsoft Program Manager for Active Directory Security and is endorsed by Microsoft.