Active Directory Privileged Access Assessor (also known as Gold Finger) is a tool designed to assess and identify privileged access within Microsoft Active Directory environments. It was developed by a former Microsoft Program Manager for Active Directory Security and is endorsed by Microsoft. The tool determines effective permissions on Active Directory objects domain-wide, distinguishing between explicit, inherited, allow, deny, object-specific, and special rights permissions. By computing effective permissions rather than just raw permission entries, it accurately identifies who has what access across thousands of AD objects. Key use cases include: - Identifying users with privileged (Domain Admin-level and delegated) access across an AD domain - Supporting Zero Trust initiatives by enabling least privilege access enforcement - Performing privileged account discovery and access lockdown - Supporting Privileged Access Management (PAM) implementations - Regulatory compliance and risk management - Identifying the underlying permissions and group memberships that enable each access grant The tool operates in a Standard Mode that automatically determines, domain-wide, who can perform actions such as creating/deleting user accounts, modifying security group memberships, resetting passwords, modifying permissions on AD objects, and replicating directory secrets (password hashes). It also supports querying what access a specific individual user has within Active Directory. Results are delivered in minutes, automating a process that would otherwise take months to perform manually.