Stars is an AGPL-3.0 Windows tool for auditing Active Directory, NTFS and SMB permissions. For any user it shows the effective access rights that actually apply to a folder or share — and, above all, why: through which groups, which ACL entries, which inheritance. For 1 path or 5000 paths alike.
Why Stars is different
Explainable permission paths
Every result comes with the full chain: identity → group → ACE → normalized right → effective right. No black box.
Correct, not approximate
Windows AccessCheck semantics: stored-order DACL evaluation, Deny precedence, inheritance breaks, generic-rights expansion, NTFS ∩ Share combination.
OWNER RIGHTS (S-1-3-4)
Handles the implicit owner grant and OWNER RIGHTS ACEs exactly — where many tools over-report the owner's access. Read more.
Honest about uncertainty
When something cannot be fully resolved, the result reads NOT DETERMINABLE with the reason and the range — never a guessed value stated as fact. Verified bit for bit against Windows itself in a two-forest lab.
Hardened DCs, no certificate
Signed LDAP (SASL GSSAPI/Kerberos sign & seal) lets Stars query a hardened Windows Server 2022/2025 DC that enforces LDAP signing — without an LDAPS certificate.
Strictly read-only
No release will ever write to NTFS, SMB or AD. No agent on target systems. No telemetry, no phone-home.
What Stars analyzes
- NTFS DACLs — allow/deny, explicit/inherited, special rights
- SMB shares — share permissions ACE by ACE and the NTFS ∩ Share result, with the side that limits it
- User Account Control, Guest and anonymous — decided from the target's policies (read-only), so a local administrator over SMB gets an exact answer
- Active Directory — nested groups, primary group, FSPs, disabled accounts, sIDHistory (migrated users and groups, evaluated into the token)
- Trusted domains — partner accounts resolved on their own domain controller: global and universal groups, SID filtering, your domain-local groups through Foreign Security Principals, and Selective Authentication (“Allowed to authenticate”)
- Effective rights per user, with risk findings
- Permission graph — the explanation path as a diagram (account → groups → ACEs → NTFS and share → result), with the limiting side, a refused logon and every route on a click; in the GUI (saved as SVG) and the HTML report
- Reports — CSV, JSON, HTML; SQLite scan history and delta comparison
- Identity resolution — SAM/LSA, LDAPS, Global Catalog, signed LDAP
Get started
Download the Windows installer from the releases page (no administrator rights required). The installer is not yet code-signed, so verify the published .sha256 to confirm the file is the exact build GitHub Actions produced — see the integrity-check steps.
Stars is exclusively a read-and-analyze tool. It does not modify any permissions, groups, or AD objects.
Documentation
User Guide · Audit Criteria · OWNER RIGHTS (S-1-3-4) · Technical Documentation · Known Limitations · Architecture Decision Records