The safe, audited Windows GUI for Active Directory — without PowerShell.
Every reset, unlock and disable is written to an HMAC-chained audit log you can verify independently. Runs on your admin workstation. Your credentials never leave your network.
Three things you couldn't trust before — pinned to specific evidence in the product.
An audit log you'd actually trust.
Every entry is HMAC-chained to the previous one and signed with a key derived at install. Edit a single row and the verifier breaks.
Nothing risky happens silently.
Every write will be dry-run, risk-scored, and shown to you before execution. Tier-0 objects will need a second admin to approve.
Velauth doesn't ask to be a Domain Admin.
It works within whatever the operator already has in AD. No privilege escalation. No cached credentials. No service account.
If a row gets edited, you'll know in 80ms.
Each entry contains the previous entry's HMAC. Delete a row, edit a timestamp,
or splice in something that never happened — the chain breaks and
Velauth.AuditVerifier will tell you exactly where.
See exactly what will change — before it changes.
In v2.0, every write will run a dry-run first. Velauth will show you the diff,
score the risk Low · Medium · High · Tier-0, and ask you to confirm.
For Tier-0 objects, a second admin will have to confirm too.
What you actually look at all day.
Browse OUs. Filter by password age, expiry, lockout, last login. Save filters as named scopes.
Give the helpdesk a key, not a master key.
Scope a role to "unlock accounts and reset passwords — nothing else." The junior tech sees a narrowed UI; they never need Domain Admin to do their job.
| Capability | Helpdesk | IT Lead | Auditor |
|---|---|---|---|
| Reset password | ✓ | ✓ | — |
| Unlock account | ✓ | ✓ | — |
| Disable account | — | ✓ | — |
| Modify Tier-0 user | — | — | — |
| View audit log | — | ✓ | ✓ |
| Export PDF report | — | ✓ | ✓ |
| Toggle Safety Lock | — | ✓ | — |
Per admin seat. Not per AD user.
You only pay for the people using Velauth — not the thousands of accounts in your directory.
- 1 admin seat
- 1 AD domain
- Full audit chain + PDF reports
- Email support · 48-hour response
- Up to 10 admin seats
- Unlimited AD domains
- RBAC delegation (helpdesk roles)
- Second-approver workflows
- Priority email · 24-hour response
- SSO via Active Directory
- Everything in Team
- Workspace isolation per client
- Fleet dashboard
- Per-tenant audit log exports
- Named Customer Success Manager
Centralised SaaS UI with an on-prem connector. Private beta opens Q2 2027.
SSO via Entra ID. Your AD stays on-prem; the UI lives in the cloud.
Where we're going. Dates are targets, not commitments.
Pilot customers get every release free for 6 months.
- Users, scoping, passwords
- HMAC-chained audit log
- RBAC delegation
- Global Safety Lock (read-only)
- Preflight & risk scoring
- Tier-0 second-approver gate
- Group management + GPO drift
- Entra ID / Azure AD parity
- Workspace isolation per client
- Fleet dashboard
- Per-tenant audit exports
- Web UI, SSO via Entra ID
- On-prem connector agent
- Private beta
Does Velauth need cloud access to my AD?
No. It runs entirely on your Windows admin workstation. Your credentials never leave your machine.
How is the audit log tamper-evident?
Each entry is HMAC-chained to the previous one with a key derived at install. The Velauth.AuditVerifier CLI confirms the chain is intact. If a single entry has been edited or deleted, the verifier will detect it.
What permissions does Velauth need on AD?
Whatever the operator already has. We don't escalate privileges or cache credentials.
Can helpdesk staff use it without being Domain Admin?
Yes. RBAC delegation gives them a scoped UI; the AD permissions are whatever you've already granted them in AD.
Do you support Entra ID / Microsoft 365?
Not yet. Coming in v2.0 (Q4 2026).
What happens after the 30-day trial?
The app continues in read-only mode — you can still view and export data, but writes are blocked until you activate a licence. No data is deleted.
Is there a money-back guarantee?
Yes. 30 days from purchase, no questions asked.
Do you support Mac or Linux?
No. Velauth is Windows-only. A web-based version that works cross-platform is on the roadmap for v3.0β (Q2 2027).
Be first to know when Velauth is ready for your environment.
Leave your email. We notify you the day it ships — no noise in between. Early access members get the first 3 months free and a discount that doesn't expire.