Skip to main content
Transparent GIF 1

​
Bounty — Active Directory Password Security & Compliance

Bounty is a Windows-Native Active Directory password security and compliance platform. It continuously scans AD environments for weak, breached, reused, and policy-violating passwords, then provides automated remediation through forced resets, alerting, and SIEM integration. Built with Go and Wails (React-TS frontend), Bounty runs as a desktop application with a companion Windows service that handles encrypted database operations via gRPC.

​
What Bounty Does

Bounty covers the full lifecycle of AD password security:
CapabilityDescription
Breached Password DetectionCompares AD password hashes against known breach databases to identify compromised credentials
Password Reuse DetectionIdentifies accounts sharing the same password hash across the domain
AS-REP Roasting DetectionFinds accounts with Kerberos pre-authentication disabled (vulnerable to offline cracking)
Kerberoasting DetectionIdentifies service accounts with SPNs that can be targeted for offline ticket cracking
Pre-Windows 2000 Account DetectionFinds legacy accounts with predictable default passwords
SPN ManagementEnumerates and manages Service Principal Names across the domain
ADCS AssessmentEvaluates Active Directory Certificate Services for misconfigurations
Password Policy EnforcementConfigurable policies per domain, group, OU, and SPN type
Automated RemediationForce password resets, disable accounts, or alert administrators
SIEM IntegrationReal-time event forwarding to Splunk, Elastic, Sentinel, QRadar, Wazuh, ArcSight, Huntress

​
Feature Overview

Security Scans

Breached passwords, reuse detection, AS-REP roasting, Kerberoasting, Pre-2K accounts

Architecture

Wails desktop app, encrypted gRPC database service, DPAPI key management

​
Quick Start

​
Requirements

  • Windows 10/11 or Windows Server 2016+
  • Domain-joined machine or credentials with read access to AD
  • Local administrator (for service installation)

​
Installation

# Run the Bounty installer
.\Bounty-Setup.exe
On first launch, Bounty:
  1. Creates the secure data directory at %LOCALAPPDATA%\Bounty
  2. Generates an encryption key protected by Windows DPAPI
  3. Installs the Bounty database service (gRPC over mTLS)
  4. Generates a TLS key pair for service communication
  5. Prompts for AD credentials to begin scanning

​
First Scan

  1. Authenticate with domain credentials (username, password, domain FQDN)
  2. Select the scan types to run from the dashboard
  3. Review findings in the affected users tables
  4. Configure policies and automated remediation

​
Architecture Overview

+--------------------------------------------------+
|              Bounty Desktop (Wails)               |
|                                                   |
|  +-------------+  +---------------------------+   |
|  |  React-TS   |  |     Go Backend            |   |
|  |  Frontend   |◄-|  (AD scans, analysis,     |   |
|  |             |  |   policy enforcement)      |   |
|  +-------------+  +---------------------------+   |
|                         |                         |
|                    gRPC (mTLS)                     |
|                         |                         |
|  +--------------------------------------------------+
|  |          Bounty Database Service                  |
|  |  (BadgerDB, DPAPI-encrypted, Windows Service)     |
|  +--------------------------------------------------+
|                         |
|                    LDAP / ADWS                     |
|                         |
|  +--------------------------------------------------+
|  |           Active Directory                        |
|  |  (Domain Controllers, Users, Groups, SPNs)        |
|  +--------------------------------------------------+

​
Scan Types

ScanDetectionRemediation
Breached PasswordsCompare NT hashes against breach databases (NTDS.dit extraction via DCSync or RPC)Force password reset, alert, notify user
Password ReuseGroup accounts by identical password hashAlert, force unique passwords
AS-REP RoastingFind accounts with DONT_REQUIRE_PREAUTH flagRemove flag or alert with privileged user distinction
KerberoastingFind accounts with SPNs (request TGS tickets for offline cracking)Alert, rotate SPN credentials
Pre-Windows 2000Find accounts in the Pre-Windows 2000 Compatible Access groupChange password, alert
SPN EnumerationList all Service Principal Names in the domainFilter, manage, notify
ADCS AssessmentEvaluate certificate templates for ESC1–ESC16 vulnerabilitiesAlert, report

​
Group and OU Management

Bounty supports a three-tier targeting system for groups and OUs:
StateBehavior
Targeted (1 click)Group/OU is included in breach scans and remediation
Alert Only (2 clicks)Group/OU is excluded from breach scans but alerts are sent
Excluded (3 clicks)Group/OU is excluded from all scans entirely
This allows granular control over which parts of the directory are actively scanned and which are monitored passively.

​
SIEM Integration

Bounty forwards scan events and findings to SIEM platforms in real-time:
PlatformStatus
SplunkSupported
ElasticSupported
Microsoft SentinelSupported
IBM QRadarSupported
WazuhSupported
ArcSightSupported
HuntressSupported
CustomConfigurable webhook/syslog endpoint

​
Security Model

LayerProtection
Encryption keyWindows DPAPI — key is bound to the machine and user, stored in %PROGRAMDATA%\Bounty\svc.enc
DatabaseBadgerDB with encryption at rest, accessed only through the Windows service
Service communicationgRPC over mTLS with auto-generated certificates
Credential handlingAD credentials used for LDAP/RPC only, never stored in the database
TrackingAccounts tracked by SID (not name) to survive renames
LicensingHWID-bound license validation via KrakenTech API