In short: Netwrix PingCastle is an Active Directory and Entra ID security assessment tool that scores your domain's risk, maps findings to MITRE ATT&CK and ANSSI and gives remediation guidance. The free Community edition only covers your own environment without support; auditing other organisations needs a commercial licence, and Enterprise adds continuous monitoring.
What PingCastle is
PingCastle started as a well-known free tool among Active Directory administrators and is now part of Netwrix. It connects to your domain, checks it against a large set of rules and produces a health check report with a risk score, the findings behind it and what to do about each one.
Typical findings include stale and inactive objects, privileged accounts and nested admin groups, weak password settings, risky domain trusts, Active Directory Certificate Services misconfigurations, Kerberoastable accounts and Group Policy problems. Findings are aligned to MITRE ATT&CK and the French ANSSI framework, so you can see which ones an attacker would use for initial access, privilege escalation or lateral movement; the maturity level and MITRE scoring sections of the report are in the paid editions.
The same checks power the identity insights in Netwrix 1Secure, where findings can be explored alongside data risk.
PingCastle editions
| Edition | Who it is for | What you get |
|---|---|---|
| Community (free) | Auditing your own environment | Health check reports; no technical support and no commercial-use rights |
| Commercial licence | Service providers and audit firms assessing other organisations | Commercial-use rights shown in the report header, maturity level evaluation, extra charts such as last logon and password age, and support |
| Enterprise | Organisations securing their own environment continuously | Centralised reporting and continuous monitoring in one dashboard, with maturity scores, KPIs and history tracking |
Many organisations do not need to license PingCastle themselves. If we run the assessment for you, it is carried out under a commercial PingCastle licence, as Netwrix's terms require, and you receive the report, the risk score and a prioritised fix list.
How PingCastle is licensed
PingCastle's paid editions are priced on request, and a commercial licence key unlocks the licensed features in the tool. The Community edition is free, but its terms only allow you to audit your own environment and it comes without support.
| Option | How it works |
|---|---|
| Assessment by Forever Systems | We run PingCastle against your domains under a commercial licence and walk through the results with you |
| Continuous assessment in 1Secure | PingCastle-powered identity checks run inside Netwrix 1Secure, licensed per identity |
| Your own licence | Enterprise for in-house teams, or a commercial licence for consultancies that audit other organisations |
Ask us for a quote for a one-off assessment, regular reassessments or ongoing 1Secure coverage.
Requirements and deployment
PingCastle runs on Windows and connects to your domain controllers over LDAP (TCP 389), Active Directory Web Services (TCP 9389) and SMB (TCP 445). It does not need an internet connection, except to verify the signature of the program, so it can be used on isolated networks. The machine-readable report can be encrypted with an RSA key for safe transfer by email.
PingCastle 3.5, released in February 2026, moved to ASP.NET 8, changed the configuration file to appsettings.console.json, added Entra ID app registration for email notifications in place of SMTP basic authentication, and added a privileged mode for deeper certificate and domain controller checks. Older scripted deployments may need updating. Netwrix ended support for version 3.3 on 3 August 2026.
Who it suits and how we help
A PingCastle assessment is one of the quickest ways to understand how exposed an Active Directory really is. It is useful before a cyber insurance renewal, after a merger or a change of IT provider, as preparation for Cyber Essentials or a penetration test, and whenever nobody is sure who has domain admin rights.
We run the assessment, explain the score in plain English, agree which findings matter most and can carry out the fixes, then reassess to show the improvement. For ongoing coverage, Netwrix 1Secure keeps the checks running between assessments. Browse other vulnerability management tools or ask us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is PingCastle free?
The Community edition is free to download for auditing your own environment, but it has no technical support and no commercial-use rights. Auditing other organisations needs a paid commercial licence, and Enterprise is a separate paid edition for continuous monitoring.
What does a PingCastle risk score mean?
The score summarises the most serious findings across stale objects, privileged accounts, trusts and anomalies. Lower is better. The report lists the rules behind the score with remediation guidance, so you can see exactly what to fix first.
Does PingCastle change anything in Active Directory?
No. PingCastle reads the directory and produces a report. Fixes are made separately, by your team or ours, once the findings have been reviewed.
What is the difference between PingCastle and Netwrix 1Secure?
PingCastle produces point-in-time health check reports of Active Directory. 1Secure runs PingCastle-powered identity checks as part of a SaaS platform that adds data risk, auditing and alerting, licensed per identity.