Stop one stolen account from becoming a company-wide breach
Shared local admin passwords, permanent admin rights and breached user passwords are what attackers look for, because they make it easy to move from one compromised computer to the rest of your network. Our products close those gaps in Active Directory, so one stolen password or account is less likely to give an attacker a way into every computer you own.
Our products
Lithnet Access Manager
Access Manager gives your team safe, audited admin access to every computer. Replacing permanent admin access to your workstations and servers can help reduce the likelihood and impact of a widespread compromise.
Lithnet Password Protection for Active Directory
Password Protection gives you the tools to take full control of password quality in your organization. You can stop your users from choosing breached or predictable passwords, and identify users with existing breached passwords.
Answer your auditors and insurers with confidence
Auditors and cyber insurers want to know how you control admin access and passwords. With Lithnet's products in place, you can answer each of these questions with a confident yes, and you have the records to back it up.
Are local administrator passwords unique and managed?
Access Manager gives every computer its own managed local admin password, on Windows, macOS and Linux.
Is privileged access granted just in time, and is it logged?
Access Manager grants admin rights just in time, removes them automatically and records every request.
Are new passwords checked against lists of compromised passwords?
Password Protection checks every new password against the breached password lists and banned words you choose.
Who has local admin rights, and how is privileged access controlled?
With just-in-time access, permanent admin rights go away, and every request shows who had access, to which computer and when.
Meet the Essential Eight, NIST and CIS Controls
The table shows where our products help you meet the controls that matter most: Access Manager for restricting administrative privileges, and Password Protection for password quality. Each one produces the evidence to show it.
| Control | What it requires | How Lithnet helps | Evidence it produces |
|---|---|---|---|
| ASD Essential Eight: Restrict administrative privileges | Unique, managed local admin credentials; just-in-time administration; logging of privileged access | Access Manager gives every computer a unique, managed local admin password through LAPS. It grants admin rights just in time and removes them when the time is up. It also logs every request. Restrict administrative privileges for the Essential Eight | An audit event for every password, BitLocker key and just-in-time request made in the Access Manager web app, written to the Windows event log. Access Manager can also send these events to your SIEM, email, Slack or Teams |
| NIST SP 800-63B (revision 4), section 3.1.1.2 | Compare new passwords against a blocklist of commonly used, expected or compromised passwords | Password Protection checks every new password against the breached password lists and banned words that you choose. It rejects any match before Active Directory accepts it. Apply the NIST password guidelines in Active Directory | An entry in the domain controller's event log for every rejected password, with the reason it was rejected |
| CIS Controls v8, Safeguard 5.2: Use unique passwords (Access Manager) | Unique passwords for all enterprise assets, with at least 14 characters for accounts without MFA or 8 characters for accounts that use MFA | Access Manager gives every computer its own local admin password through LAPS | An audit event for every password request made in the Access Manager web app |
| CIS Controls v8, Safeguard 5.2: Use unique passwords (Password Protection) | Unique passwords for all enterprise assets, with at least 14 characters for accounts without MFA or 8 characters for accounts that use MFA | Password Protection can enforce a minimum password length. It also rejects passwords that appear in breached password lists | An entry in the domain controller's event log for every rejected password, with the reason it was rejected |
Requirements are quoted or summarized from the ASD Essential Eight Maturity Model (November 2023), NIST SP 800-63B revision 4 and CIS Controls v8.
Software you can trust
We know that our software runs in the most sensitive parts of your environment, and we take that responsibility seriously.
Security and trust- We make it easy for you to be sure that the code you run comes from us. We sign our Windows, macOS and Linux packages and publish the hash of every package.
- Every release goes through our validation pipeline, with security, unit and end-to-end testing.
- Your data is yours. Our products run in your environment and do not depend on a Lithnet cloud service.
- We value the work of security researchers and believe in the responsible disclosure of security issues. Report a vulnerability
Talk to the team behind the products
If you have a question about any of our products, or you'd like help choosing the right one for your organization, get in touch and we'll be happy to help.