Active Directory Permissions Analyzer is an audit tool designed to help IT teams analyze security permissions in Active Directory (AD) environments. It was created by a former Microsoft Program Manager for Active Directory Security. The tool automates the analysis of AD security permissions, enabling organizations to determine who has what permissions, where those permissions apply, and which specific permissions are granted — across an entire domain. Key capabilities include: - Domain-wide permissions analysis covering all AD objects - Filtering by Allow/Deny permissions and Explicit/Inherited inheritance types - Support for any default or custom AD Schema class, attribute, or extended right (e.g., Reset Password, Get Replication Changes) - Security principal-specific analysis to find permissions granted to a specific user, computer, or group - Customizable analysis scope using LDAP filters - Export of analysis results The tool runs on any Windows computer and does not require administrative privileges, agent installations, service deployments, or prior Active Directory knowledge. It operates in real time against the live AD environment. It is licensed on a subscription basis (monthly, quarterly, or annual) and also offers a free downloadable version. The product is marketed under the alternate name "Gold Finger" in some references on the page.