Active Directory Change Tracker vs LTB Self Service Password

Active Directory Change Tracker is a self-hosted Windows desktop tool that audits Active Directory activity and records what changed, the previous and new values, timing, location, and responsible user. It gathers incremental events from audit-enabled Active Directory Security Event logs without installing agents. Change history is stored in a Microsoft SQL Server database, with an option to retain original audit records. Reports include object creation, modification, and deletion; user logon and logoff; password changes; and Terminal Services activity. Administrators can search by period, change type, organizational units, containers, keywords, and event IDs. Real-time email alerts can report changes appearing in a domain controller’s security log. Reports can be exported immediately or on a schedule in HTML, CSV, or XLSX. Listed requirements include Windows client or Windows Server, .NET Framework 4.0 or later, and SQL Server 2005, 2008, or 2012 editions. Pricing is by quote, with no free plan and a free trial listed.

LTB Self Service Password is a PHP web application that lets users change or reset passwords in LDAP directories, including standard LDAPv3 directories and Active Directory. Password resets can rely on security questions, an emailed token, or SMS through an external Email 2 SMS service or SMS API. Administrators can configure checks for length, character classes, forbidden characters and words, password reuse, entropy and breached-password status using the Have I been pwned API. Other features include CAPTCHA, password-change email notices, and scripts that run before or after a password change. Users can also update their SSH key, email address and phone number in LDAP. A REST API is available. The free, GPL-3.0-licensed software is self-hosted. Documented installation routes include a tarball, Debian or Ubuntu packages, CentOS or Red Hat packages, Docker and Git for developers. Prerequisites include PHP 7.4 or later, required PHP extensions, Smarty 3 or later, configured mail and sessions, and LDAP connectivity. The project directs software questions to its mailing lists and bug reports to GitHub issues.