Custofaber Guard / Guard Access
Identity and access
See who can access what. Close the doors left open.
Guard Access reads your Active Directory, finds orphaned accounts and excess privileges, and proposes a fix for each finding. You approve the fix, then it is applied.
It keeps answering three questions.
Who is still inside? Who has more access than needed? What should we do? Access keeps these three answers up to date.
Orphaned accounts
Lists accounts not closed after people leave, accounts with no sign-in for a long time and service accounts with no clear owner.
muhasebe03 · last sign-in 94 days ago · not on the staff list
Excess privilege
Shows group memberships and admin rights beyond what is needed. With the Lapis agent connected it also sees local administrators on workstations.
Domain Admins · 11 members · 4 with no sign-in for 6 months
Approved fixes
Proposes a concrete fix for each finding: disable the account, remove it from a group, assign an owner. Approval, action and outcome are recorded.
Proposal: disable the account · Awaiting approval
It reads, finds and proposes. You approve.
Access never touches an account on its own.
-
Reads
Pulls accounts, group memberships and sign-in history from Active Directory at regular intervals.
-
Finds
Compares them with the staff list, last sign-in dates and group policies, and lists the deviations.
-
Proposes
Writes a one-step fix and its reasoning for each finding.
-
You approve
An approved fix is applied; a rejected one is recorded. Either way, who did what and when is on record.
It does not close accounts on its own.
Every change waits for an authorised person's approval. Nothing is applied without it.
It does not replace Active Directory.
Access is not an identity management system; it reads and reviews your existing directory.
It sends no data outside.
Account information and the access map stay on your organisation's server.
Guard Access FAQ.
Which directory does it work with?
Active Directory. If you have other directories, we will look at them together in the demo.
How are fixes applied?
After an authorised user approves, Access makes the change over an authorised connection and records the outcome.
Is the Lapis agent required?
Not for Active Directory findings. Lapis is needed to see local admin rights on workstations.
Can it be used with Vigil?
Yes. Access adds access context to Vigil's incident explanations: which account, with which privileges.
See Access with your own directory.
Tell us how many users you have and the question you most want answered; we will build the demo around it.