Top 20 Active Directory Management Tools in 2025

Although many systems have moved to the cloud, Active Directory (AD) remains the central identity platform for managing users, devices, and access across most organizations. In this article, I picked the top tools that support key areas of Active Directory management:

🔵 = Full AD management (Administrative control) – Provide direct control over AD objects (users, groups), including creation, modification, delegation, and automation of directory tasks.

🟠 = AD insight and oversight (Auditing, Monitoring, Security) – Focused on monitoring, logging, auditing, and analyzing changes or access activity in AD for security and compliance purposes.

🟢 = AD operational support  – Enhance or complement AD environments (e.g., password policy enforcement, account recovery, remote support, system backups), but do not manage AD objects directly.

Platform support: Windows / Linux / macOS

• ✅ – Full native support
• ❌ – No support
• Web-based UI only – Accessible via browser; no native desktop app for that OS.
• Sensor-based Linux – Monitors Linux using lightweight agents or sensors, rather than a full application.

Licensing

For smaller teams with limited budgets, I’ve compiled a list of the best AD tools that offer a free version or at least a trial.

Do I need to use Active Directory tools?

Technically, you don’t. But if you’re managing more than a handful of systems, it becomes a highly effective and indispensable tool for centralized administration and access control.

What is Active Directory?

Active Directory (AD) is Microsoft’s directory service, an implementation of Lightweight Directory Access Protocol (LDAP), an open protocol used to access and manage directory information. 

It organizes your environment using objects (users, computers, printers, shares) and stores them in Organizational Units (OUs)—much like folders in a file system.

Local accounts vs. centralized authentication

Organizations typically manage user access through either local accounts or centralized authentication.

Local accounts can suffice in small environments with only a few machines. Scripting can partially automate local account management, but it introduces several limitations:

• Offline systems may miss updates.
  
• Immediate deprovisioning, such as when an employee is terminated, is difficult to guarantee across all endpoints.

Moreover, as infrastructure scales to support hundreds, or even tens of thousands of systems, managing user creation, updates, and deactivation at the individual device level becomes operationally inefficient.

By contrast, centralized authentication, such as that provided by Active Directory (AD) offers a more scalable solution:

• A single user account provides consistent access across all systems.
  
• Disabling that account immediately revokes access organization-wide.

So, we recommend a centralized identity management solution such as Active Directory or an LDAP-based directory service to minimize the risk of access misconfigurations, particularly for teams managing complex organizational units (OUs), GPOs, and tiered access models. 

AD authentication for Linux systems

Linux systems can authenticate to Active Directory (AD) using tools like Samba and SSSD, which enable Kerberos-based authentication and LDAP directory protocols.

While this setup works well for centralized login and identity resolution, it does not fully replicate all AD capabilities (e.g., Group Policy enforcement) on Linux. There are important limitations:

• Linux does not support most Group Policy Objects (GPOs).
  
• Linux configuration is best managed with tools like Ansible, Chef, or Puppet, which are designed for Unix-based systems.
  
• Nested group membership resolution may be incomplete or inconsistent.

On the other hand, Windows supports AD natively, and LDAP-based integration with Windows is generally limited and unreliable.

Thus, Active Directory remains the most comprehensive and integrated identity and configuration management system for Windows environments.

For mixed OS setups, authenticating Linux systems to AD gives you the best of both worlds: centralized control over Windows and flexibility for Linux.

Netwrix Directory Manager

Focus: Identity lifecycle & user management

Why is it for: IT teams looking to reduce AD-related helpdesk load by automating identity tasks and delegating safe self-service capabilities to end users and managers. Useful in hybrid environments across AD, Entra ID (Azure AD), and LDAP.

Netwrix Directory Manager is an identity and group management tool that automates user provisioning, group updates, and account changes across Active Directory, Azure AD, and other directories. 

It’s enterprise-focused, not just a scripting tool. It integrates deeply with AD to support approval workflows, dynamic group logic, and delegated administration through a centralized web portal.

Distinct capabilities

• Role-based delegation with approval workflows
  
• Groups that auto-update based on directory data
  
• Identity data validation before committing changes
  
• Native multi-directory sync without third-party connectors
  
• Built-in history tracking and audit trails
  

Pros

• Enables rule-based provisioning and deprovisioning of users and groups
  
• Provides lifecycle controls such as group expiration, recertification, and scheduled cleanup
  
• Allows creation of dynamic groups based on directory attributes and query rules
  

Cons

• Complex patching and upgrade process
  
• No public pricing; licensed per AD user

Licensing

Subscription-based, licensed per enabled AD user. Free trial available. Pricing is quote-based and varies by user volume and organization type.

Free vs paid edition:

ManageEngine ADManager

Focus: Identity lifecycle & user management

Why is it for: Best for administrators who manage users across multiple domains and platforms. It also supports the delegation of tasks to non-administrative personnel, making it a good fit for environments where role-based access control is required.

ManageEngine ADManager Plus is a cloud-based tool for managing Active Directory (AD), Exchange, and Office 365 from a centralized web interface.

Distinct capabilities

ADManager Plus allows administrators to manage AD objects in bulk and define templates to standardize user provisioning and updates. It provides detailed reports such as last logon activity, inactive user accounts, and group memberships etc. I also provide visual overviews of share permissions and security group memberships.

Pros

• Generates compliance reports (e.g., PCI-DSS, HIPAA)
  
• Supports multi-domain environments
  
• Enables secure delegation of tasks
  
• Offers visibility into AD share and permission structures
  

Cons

• Performance issues in large environments (e.g., performance lag with high AD object counts)
• Complexity for cloud and hybrid setups, with limited support for multi-domain or hybrid Azure AD environments
• Steep learning curve

Licensing

• Free Edition: $0, limited to 100 Domain Objects
• Standard Edition: $595
• Professional Edition: $795
• A 30-day trial of the full version is available. After the trial, the license reverts to the Free Edition unless a paid license is purchased.

SolarWinds Access Rights Manager

Focus: Permission & access rights management

Who is it for: Mid-to-large organizations that manage complex AD and Microsoft 365 environments. A good fit for those needing to audit, control, and delegate user access, and enforce least-privilege policies.

The Windows-based admin console is intuitive for browsing and editing access structures. The web portal enables business data owners to approve access requests or run delegated access reviews.

That said, some configuration tasks remain non-intuitive. For example, creating or editing user provisioning templates may require using a JSON editor or a separate UI tool, which has been flagged as less user-friendly by admins. Not all automation is fully GUI-driven, and there’s room for improvement in simplifying advanced workflows.

Distinct capabilities

• Access mapping across users, groups, file shares, SharePoint, Exchange, and Teams
  
• AD & Azure AD provisioning using role-based templates
  
• Delegated permission management via a self-service web portal
  
• Automated access reviews (attestation campaigns)
  
• Risk analysis dashboard highlighting over-provisioned accounts and policy violations
  
• Audit-ready reporting for SOX, HIPAA, GDPR, PCI DSS, etc.
  
• File system integration with NTFS, NetApp, and EMC support

Pros

• Deep integration with AD, Azure AD, M365, and file servers
  
• Reports are customizable, exportable, and audit-ready for regulations like GDPR, SOX, and HIPAA.
  
• Role-based delegation and business owner workflows
  

Cons

• Automation setup (e.g., provisioning templates) requires JSON edits
  
• No native GUI for all configuration steps
  
• Primarily focused on Microsoft environments
  
• On-prem deployment requires a server, SQL, and patch management
  

Licensing

The free trial is available for 30 days, includes all features in the full edition. Audit Edition offers read-only access, visibility, and reporting. Full Edition unlocks provisioning, permission changes, workflow automation, and delegation starting at $2,292. ¹

Quest ActiveRoles Server

Focus: Permission & access rights management

Who is it for: Large organizations with advanced identity governance needs across Active Directory and Azure AD. Best for teams requiring policy-driven delegation, compliance automation, and granular access control at scale.

ActiveRoles uses a Windows-based console that supports delegation, policy enforcement, and workflow automation. It includes predefined roles, approval workflows, and policy-based provisioning to standardize access control and reduce manual admin tasks.

The interface is configuration-heavy. Advanced features like custom policies and automation often require PowerShell scripting or REST API integration. Delegation is granular, but proper setup is required to avoid privilege overlaps.

Distinct capabilities

• Policy-based provisioning with attribute-level rules
  
• Granular delegation using predefined and custom roles
  
• Approval workflows for access and provisioning
  
• Support for hybrid environments (on-prem AD and Azure AD)
  
• PowerShell and REST API support for automation and integration
  

Pros

• Fine-grained control over delegation and workflows
  
• Policy-driven automation enforces compliance standards
  
• Scales well across complex or multi-domain environments
  

Cons

• Steep learning curve for custom configuration
  
• Advanced automation requires scripting knowledge
  
• Interface optimized for technical users, not casual operators
  

Licensing

Commercial software licensed per user or per managed object.

Microsoft AD Explorer

Focus: Lightweight AD inspection tool

Who is it for: System administrators and auditors needing quick access to view and compare Active Directory object data. Best for read-only inspection, auditing, and troubleshooting—not management.

AD Explorer is a read-only utility for inspecting Active Directory objects. It supports attribute search, schema browsing, and snapshot comparisons for change tracking. The tool runs without installation and offers fast access to directory data.

It does not support write operations, provisioning, or workflow management. Usage is limited to inspection and auditing. No role-based delegation or task automation is available.

Distinct capabilities

• Snapshot comparison of AD states—like user accounts, group memberships, or permissions— over time
  
• Shows attribute-level changes
  
• No installation needed, the tool can run directly from a file (like .exe)

Pros

• Lightweight and fast
  
• Useful tool for read-only exploration

Cons

• No write access or delegation support
  
• Lacks integration, automation, and policy enforcement features
  
• Not suited for lifecycle or compliance tasks

Licensing

Free tool from Microsoft Sysinternals suite.

Hyena

Focus: Lightweight AD & Windows system administration

Who is it for: IT administrators who manage Windows servers, AD, and file systems from a unified console. Useful in small to mid-size environments for operational efficiency.

Hyena provides a central interface for managing AD users, groups, shares, and sessions. It enables bulk operations, event log access, and WMI queries from a single dashboard.

The interface is function-rich but uses an older design. It lacks RBAC, workflow delegation, and modern reporting tools. Setup and execution of tasks are manual and depend on the operator’s AD knowledge.

Distinct capabilities

• Manage users, groups, and sessions across domains
  
• Perform bulk operations (e.g., password resets, group updates)
  
• Integrates WMI and service management
  
• Basic event log and file system tools included

Pros

• Centralizes Windows and AD tasks
  
• Useful for bulk directory operations
  
• No server-side components required

Cons

• No delegation or role control
  
• The interface follows a traditional design
  
• Limited reporting and compliance features

Licensing

Commercial: per-seat pricing. Free trial available.

Softterra LDAP Administrator

Focus: Lightweight AD & LDAP administration

Who is it for: Directory administrators working across LDAP environments, including Active Directory, OpenLDAP, and Novell eDirectory. Best for those managing schemas and entries directly.

Softterra LDAP Administrator supports direct editing, schema navigation, and bulk changes across multiple LDAP directories, including AD. It provides attribute-level access, server session handling, and schema validation through a GUI.

It does not include role delegation, policy automation, or access workflows. The focus is on manual object management, with no built-in compliance or review controls.

Distinct capabilities

• Browse and manage the LDAP schema and entries
  
• Perform bulk edits and imports
  
• Supports multi-server views
  
• Visual schema browsing and comparison

Pros

• Strong attribute-level control and visibility
  
• Compatible with multiple directory types

Cons

• No role delegation, workflows, or reporting
  
• Not intended for compliance or audit tasks
  
• Requires directory schema familiarity

Licensing

Commercial; per-user license. Free trial available.

Dameware Remote Everywhere (DRE)

Focus: Remote support & endpoint access

Who is it for: IT helpdesk and support teams needing secure remote desktop access, live troubleshooting, and end-user support across platforms.

DRE is a cloud-based remote support tool designed for endpoint access, live support, and remote troubleshooting. It includes features like session logging, file transfer, and multi-platform compatibility.

It does not include any directory management, provisioning, or delegation functionality. All functionality centers on support operations, not identity or access governance.

Distinct capabilities

• Remote desktop control and live diagnostics
  
• Session recording, audit logging, and multi-monitor support
  
• Integrated chat, file sharing, and ticketing
  
• Works across Windows, macOS, and mobile

Pros

• Responsive interface with secure session handling
  
• Designed for support workflows
  
• No on-prem setup required

Cons

• No support for AD/identity management
  
• Not suitable for access governance or provisioning
  
• May require internet access for full functionality

Licensing

Subscription-based. Free trial available via SolarWinds.

Netwrix Auditor for Active Directory 

Focus: Auditing & compliance

Why is it for: Mid-to-large organizations that require deep visibility across multiple IT systems for compliance.

Netwrix Auditor for Active Directory is an auditing solution designed to provide visibility into AD changes, logon activity, and policy configurations across cloud, on-premises, and hybrid environments.

It supports organizations with compliance requirements (e.g., HIPAA, GDPR, PCI DSS, SOX, ISO/IEC 27001) by providing detailed audit trails, access monitoring, and prebuilt reports aligned with regulatory requirements.

Distinct capabilities

• Prebuilt compliance reports aligned with standards such as HIPAA, GDPR, PCI DSS, SOX, and more
  
• Tracks changes to Active Directory and Group Policy with details on who made changes, what was changed, and when
  
• Monitors logon activity, including successful and failed attempts, for access visibility and investigation
  
• Offers configuration and permissions reporting for audit support
  
• Supports integration with ITSM platforms (e.g., ServiceNow) for automated ticket creation

Pros

• Accurate AD and SQL change auditing: Best for environments with compliance and internal governance needs
  
• Fast access to audit info: Daily summaries are useful for tracking and investigating changes
  
• Audit trail accuracy: Enables quick investigations by pinpointing the who/what/when of changes
  
• Supports compliance efforts: Provides evidence for audits, especially in change control-heavy orgs.

Cons

• Alert configuration is less intuitive and may require manual tuning
  
• Limited support for non-Microsoft platforms (e.g., Cisco, Linux)
  
• High cost for user-heavy environments—licensed per enabled AD user object
  • Even service accounts and shared mailboxes count against the license
  • Pricing example: ~$4,300 for 550 AD objects + ~$900/year maintenance

Licensing

Netwrix Auditor offers a 20-day free trial that tracks all user logons, object changes and sends daily email reports.

Key differences from the paid edition:

• No real-time alerts – only daily email summaries
• No interactive dashboards 
• No integrations with SIEMs or ticketing systems

✅ Paid edition includes full audit trail, alerting, custom reports, and prebuilt compliance reports

LepideAuditor for AD

Focus: Auditing & compliance

Who is it for: IT administrators and security teams focused on real-time monitoring, auditing, and compliance enforcement within Active Directory environments.

Lepide Active Directory Auditor is a centralized auditing and monitoring tool designed to track and report on configuration changes across multiple systems, including Active Directory, Group Policy, Exchange, SQL Server, and SharePoint. It offers real-time visibility into security and compliance-related events and supports automated alerting based on predefined thresholds.

Distinct capabilities

• Generates detailed reports on user and group activity
  
• Audits both successful and failed logons
  
• Audits changes to Group Policy, including who made changes and when
  
• Includes over 300 predefined reports for compliance tracking and  monitoring

Pros

• Provides clear visibility into configuration and permission changes within AD
  
• Allows quick access to user details such as last login, name, and CN path
  
• Supports CSV and HTML export for reporting purposes
  
• Includes a user-friendly wizard for setting up custom alerts

Cons

• No bulk password management and account unlock functions

Licensing

A free 15-day trial of LepideAuditor is available.

Varonis DatAdvantage for AD

Focus: AD auditing & behavior-based access analytics

Who is it for: Organizations that need continuous monitoring of Active Directory access, privilege abuse, and data risk, especially in highly regulated or hybrid environments.

Varonis provides a graphical interface with built-in analytics and investigation tools. Admins can track user behavior, flag anomalies, and simulate changes before committing them. Setup may require time due to agent-based deployment and environment scanning.

Distinct capabilities

• User behavior analytics for AD and file systems
  
• Automated privilege risk scoring
  
• What-if simulation before making access changes
  
• Audit trails for forensics and compliance

Pros

• Strong visualization and alerting engine
  
• Cross-platform insights across AD, file shares
  
• Supports compliance frameworks out of the box

Cons

• Agent deployment increases complexity
  
• High cost for smaller organizations
  
• Focused on monitoring, not access provisioning

Licensing

Tiered pricing based on users or data volume. Free trial available on request.

Paessler PRTG Active Directory Monitor 

Focus: Infrastructure / AD monitoring for auditing & compliance

Who is it for: IT administrators and network engineers responsible for maintaining Active Directory health and overall infrastructure performance.

Paessler PRTG Active Directory Monitor is part of the broader PRTG Network Monitor platform developed by Paessler GmbH. It provides real-time monitoring of Active Directory environments as part of a sensor-based framework for tracking IT infrastructure. Supports both on-premises and cloud-based deployments.

Distinct capabilities

• Customizable sensors to monitor specific AD metrics
  
• Replication error detection and domain controller synchronization issue tracking
  
• Identification of logged-out and deactivated users across Active Directory
  
• Group membership change tracking and monitoring of AD object status
  
• Alerting system based on user-defined thresholds and sensor triggers
  
• Extended monitoring support for additional systems, including networks, applications, and databases

Pros

• Sensor-based monitoring offers flexibility and granularity
  
• Centralized dashboard integration for unified AD and network monitoring
  
• Script-based automation to check user account status and other AD parameters
  
• Free tier availability with support for up to 100 sensors — a good fit for small-scale environments

Cons

• Steep learning curve due to the platform’s extensive feature set
  
• Time-consuming initial configuration for teams unfamiliar with sensor-based monitoring models

Licensing

PRTG is licensed based on the number of sensors.

For example, PRTG 500 (500 sensors, 1 server installation) starts at $1,360. A 30-day free trial is available up to 100 sensors.

ENow Software’s COMPASS

Focus: Active Directory service monitoring

Who is it for: Enterprises requiring real-time health monitoring for Active Directory, DNS, replication, and related services.

COMPASS offers a Web dashboard with color-coded visualizations, performance KPIs, and alert-based insights. Easy to deploy for operational teams, but doesn’t extend to access control or policy enforcement.

Distinct capabilities

• Real-time AD health monitoring
  
• DNS, replication, and service validation
  
• Synthetic transaction testing
  
• Custom thresholds and alerting

Pros

• Prevents AD outages with proactive monitoring
  
• Quick deployment and low admin overhead
  
• Integrates with PowerShell and existing alerting systems

Cons

• No support for user management or auditing
  
• Limited to service health, not access review
  
• Lacks reporting for compliance use cases

Licensing

Annual subscription model. Pricing is based on AD infrastructure size.

ManageEngine ADAudit Plus

Focus: Active Directory change auditing

Who is it for: Organizations needing real-time tracking of AD changes, logon events, and group modifications for security or compliance.

ManageEngine ADAudit Plus offers a web-based interface with prebuilt reports, alert rules, and live dashboards. Designed for quick deployment and a low learning curve. Customization and long-term log retention may require additional tuning.

Distinct capabilities

• Tracks user logon/logoff, GPO changes, group modifications
  
• File server and DNS audit support
  
• Alerting and incident response integrations
  
• Built-in compliance reports for SOX, HIPAA, GDPR

Pros

• Strong real-time event visibility
  
• Hundreds of built-in compliance reports

Cons

• No role delegation or access control tools
  
• Primarily read-only auditing

Licensing

Based on # of domain controllers. Free and paid editions available.

SolarWinds Permission Analyzer

Focus: Permission & access rights management

Why is it for: Best for system admins who need quick insights into user and group permissions within Active Directory. Useful for troubleshooting access rights without the complexity of full-fledged IAM suites.

SolarWinds Permission Analyzer is a lightweight, free tool designed to visualize and analyze effective permissions in Active Directory. 

Distinct capabilities

Visualizes effective permissions, including inherited rights, without requiring deep navigation through AD, making it easier to identify misconfigurations and excessive access.Provides a tree view of group memberships and nested permissions.

Pros

• Visualizes complex permission hierarchies
  
• Saves admins from manually clicking through Active Directory Users and Computers to trace user and group permissions

Cons

• No editing or modification features
  
• No reporting or export functionality
  
• Not suitable for large-scale enterprise IAM management

Licensing

Free. Available as a free tool from SolarWinds; no paid tier or version.

BeyondTrust Privileged Management

Focus: Endpoint privilege management & access control

Who is it for: Organizations seeking to enforce least-privilege access on endpoints without compromising productivity, especially across Windows/macOS.

BeyondTrust Privileged Management’s admin console supports policy definition, application control, and session monitoring. Offers centralized reporting and integration with SIEMs. Flexible tool for large, distributed environments.

Distinct capabilities

• Application elevation rules
  
• Privilege elevation requests with audit trail
  
• Session recording and endpoint behavior logs
  
• Integration with AD, Azure AD, and ITSM tools

Pros

• Enforces least privilege at endpoint level
  
• Limits lateral movement and insider threats
  
• Detailed audit logs and policy enforcement

Cons

• Complex environments may require custom policy tuning
  
• Best suited for managed corporate devices
  
• High configurability may require training

Licensing

Subscription-based. Tiered by number of endpoints/users.

Specops Password Policy

Focus: Password enforcement for Active Directory

Who is it for: IT teams wanting to enforce stronger password complexity, length, and block lists beyond native AD Group Policy.

Specops Password Policy integrates into Group Policy Management Console (GPMC) with graphical rule configuration. Straightforward to deploy and manage. Includes real-time feedback at password change screens.

Distinct capabilities

• Custom password complexity rules
  
• Banned password dictionary and breached password check
  
• Real-time user feedback at reset/change
  
• Reporting for compliance audits

Pros

• Extends native AD password policies
  
• Protects against weak or breached passwords
  
• Supports dictionary-based enforcement

Cons

• Focused only on password policy, not broader IAM
  
• No identity provisioning or audit features
  
• Breached password list updates may require maintenance

Licensing

Licensed per enabled user in AD. Free trial available.

Netwrix Account Lockout Examiner

Focus: Account Lockout Analysis

Who is it for: Help desk teams and admins responsible for identifying and resolving Active Directory account lockouts.

Netwrix Account Lockout Examiner is a free troubleshooting tool designed to help IT teams quickly identify the cause of Active Directory account lockouts. It provides targeted diagnostics to trace lockout events, including those caused by cached credentials, scheduled tasks, mapped drives, or mobile device sync errors. The tool is particularly helpful in diagnosing issues with service accounts, where lockouts can cause operational disruption.

Distinct capabilities

• Real-time root cause identification of AD account lockouts
  
• Credential and service issue tracing, including stale credentials, outdated passwords, and misconfigurations
  
• Quick diagnosis with minimal setup by accepting a username as input
  
• Lockout source visibility across multiple systems and services

Pros

• Single-step trace initiation via username input
  
• Automated log correlation across systems to identify lockout sources
  
• Reduced need for manual parsing or custom PowerShell scripts
  
• Effective tracing of service account lockouts, including scheduled tasks and stale credentials across domain controllers

Cons

• Limited to lockout diagnostics — no support for general AD change or logon monitoring
  
• No centralized auditing or remediation features

Licensing

Free. No commercial edition is required for use.

Quest Recovery Manager for AD

Focus: Active Directory backup and recovery

Who is it for: Teams that need fast, granular recovery of AD objects, attributes, or even entire domain controllers after accidental or malicious changes.

Quest Recovery Manager for AD offers a GUI-based interface for backup configuration, object-level restore, and comparison with live AD. 

Distinct capabilities

• Granular object/attribute restore
  
• Comparison reports for live vs. backup
  
• Restore from unbootable domain controllers
  
• Integration with Group Policy and DNS recovery

Pros

• Prevents extended outages from accidental deletions
  
• Provides point-in-time recovery without reboots
  
• Supports compliance through change logs

Cons

• Not designed for identity provisioning or audit
  
• Requires regular backup configuration
  
• Limited to AD recovery scope

Licensing

Commercial license based on domain/forest size. Trial available.

Acronis Cyber Protect

Focus: Endpoint protection and backup

Who is it for: Organizations needing an integrated solution for backup, antivirus, anti-ransomware, and endpoint patching across physical and virtual devices.

Acronis Cyber Protect provides a unified web console that provides dashboard-based control, threat detection, and backup policy configuration. Its agent-based architecture supports cross-platform deployment.

Distinct capabilities

• File- and image-level backup
  
• AI-based threat detection
  
• Ransomware rollback and vulnerability patching
  
• Centralized protection for Windows, macOS, Linux, and mobile

Pros

• Combining data protection and cybersecurity in one platform
  
• Central console reduces tool sprawl
  
• Rapid deployment with prebuilt policies

Cons

• Not an identity or AD tool
  
• Complex environments may need tuning

Licensing

Subscription pricing per endpoint. 

External Links

• 1. Compare Audit and Full Versions of Access Rights Manager | SolarWinds.