Cut helpdesk tickets, enforce MFA across your domain, block breached credentials, and sync passwords everywhere they're needed — all on-premises, with zero plaintext leaving your network.
ADPassSync intercepts password changes right at the domain controller, enforces your policy, checks for breaches, and gives users a secure self-service reset portal with MFA — without ever sending credentials to the cloud.
Six capabilities, one lightweight deployment. Explore what each one does.
A clean, MFA-protected web portal lets users reset or unlock their Active Directory account in under a minute, from any device. The #1 helpdesk call disappears.
Users enroll a second factor through the same self-service portal. Choose the providers that fit your environment and enforce them on every password operation.
Active Directory's native policy stops at length and complexity. ADPassSync adds 10+ configurable rule types so you can block weak, predictable, and guessable passwords before they're ever set.
Every new password is checked against a bloom filter of over 2 billion credentials exposed in public breaches — in real time, entirely offline. No password or hash ever leaves your network.
When a user changes their AD password, ADPassSync can push that change to downstream LDAP directories and applications — keeping every system in sync without forcing users to juggle multiple credentials.
ADPassSync deploys as a distributed pipeline across your AD infrastructure. Passwords are envelope-encrypted at the domain controller and never appear in plaintext anywhere downstream.
AES-256-GCM + RSA-OAEP. Credentials are encrypted on the DC and only decrypted by the central service.
All component-to-component communication uses mutual TLS with certificate pinning.
The relay forwards encrypted blobs. No intermediate component ever sees the password.
If any ADPassSync component fails, AD password changes continue unaffected. We never break Active Directory.
Everything runs in your environment. No credentials leave your network. No cloud dependency.
Every password event, MFA verification, and policy decision is logged for compliance and forensics.
A web-based admin console gives IT a real-time view of reset activity, MFA enrollment, blocked breaches, and license usage — plus the tools to manage users and policy across the domain.
The ADPassSync mobile app doubles as a TOTP authenticator and a self-service reset tool — so users can secure their account and recover access without ever calling the helpdesk.
Full functionality for up to 50 Active Directory users. No credit card required.
A user is any identity counted as an active Active Directory object — any account that has a password. Contact us for special pricing on non-human accounts (service, machine & shared accounts).
Questions about ADPassSync? Want to discuss pricing for your organization? We'd love to hear from you.