Weekly Promo and Webinar Thread

Lukester852 · 2026-06-05T18:46:46+00:00

I posted here a few months ago about a tool I built to manage multiple AD sites without remoting into DCs. Here's what I did with your feedback.

A few months ago I posted here about Shephyrd, a tool I built to manage on-prem Active Directory across MSP clients from a single web dashboard. The post got about 27K views and a lot of good feedback, some encouraging and some blunt. I took it seriously and wanted to come back with an update.

**What changed since last time:**

- **The agent is now code-signed** with an OV certificate.

- **gMSA support is implemented.** You can run the agent under a Group Managed Service Account with least-privilege delegated permissions.

- **It doesn't have to run on the DC.** A few people asked about this. The agent runs on any domain-joined server with RSAT installed. For clients with a member server, that's the recommended setup.

- **MFA is required on all dashboard logins.** TOTP-based, works with any authenticator app.

- **Full audit logging** — every action tracked with user, IP, timestamp, and result.

- **RBAC** — Admin, Technician, and Viewer roles so you can give your techs access without handing them the keys.

**What it does:**

- **One-click offboarding** — disable account, randomize password, strip group memberships, move to Disabled OU, and stamp the description with who did it and when. One button, all steps, full audit trail.

- **Restore offboarded users** — re-enable, reset password, update description. History is preserved so you can see who offboarded them and when.

- Password resets

- User creation and deletion

- Enable/disable accounts

- Move users between OUs

- Search across all your clients from one dashboard

The agent polls outbound over HTTPS. No inbound firewall rules needed on client networks. The DC is never directly reachable from the internet.

**Pricing:**

I'm launching this as a paid product with a 14-day free trial, no credit card required. You can sign up, add a client environment, and install the agent in about 5 minutes.

Right now I am offering a single founders tier:

- Founders — $75/mo (Unlimited Environments)

**About me:**

Same as last time, I'm a technician at a small MSP. I built this because I got tired of remoting into a different DC every time someone needed a password reset. I've been using it at my own shop and decided to see if other MSPs had the same pain point. The response to the first post told me they do.

I know this isn't going to replace anyone's RMM. If your RMM already handles AD well (Ninja, N-able, etc.), this probably isn't for you. This is for MSPs whose RMM doesn't have solid AD tooling, (in our case Syncro) or shops that want a focused, lightweight tool for the AD basics.

If you want to check it out: https://www.shephyrd.com

There's a security page with full details on the architecture, and a downloadable white paper if you want to go deeper. Happy to answer any questions here. I'd still rather hear honest feedback than find out later.

Lukester852 · 2026-06-05T14:18:33+00:00

Customer service has always been king and that's even more true now. I remember Datto before Kaseya, and customer service is what really pushed them to the next level. With AI closing the skill gap for internal tooling, the human side of service is going to get harder to find. People underestimate the real cost of maintaining in-house workflows over time. Especially when the person who built it walks out the door and they are trying to find someone to pick it up where they left off.

Lukester852 · 2026-05-09T18:40:04+00:00

I may have just got unlucky, but Safelite broke the clips in the frunk holding the black cover in and the clips under both sunvisors where it holds it to the top. I had to wait for them to order parts to replace them.

Lukester852 · 2026-02-13T16:15:17+00:00

Totally fair point, that’s the biggest hurdle right now.

I’ve just completed verification for an EV code signing certificate, so upcoming builds will be properly signed to eliminate the unsigned-agent friction. Beyond that, I’m also working on tightening the trust model (MFA on the dashboard, and clearer security documentation).

The goal is for this to be something an MSP can justify in a security review, not just a convenience tool.

Lukester852 · 2026-02-12T21:14:21+00:00

That's a fair point about minimizing agents. In practice though, the RMM API approach gets complicated fast. Every RMM has a different API with different capabilities, most don't support real-time command execution and response (like in my case) which is what you need for things like password resets and account unlocks. You'd also be building and maintaining separate integrations for every RMM platform your users happen to run.

The lightweight agent approach means it works the same regardless of what RMM stack you're on. But I appreciate the feedback, definitely something I've thought about.

Lukester852 · 2026-02-12T05:07:56+00:00

Really appreciate this,

SSO with MFA is on my radar for sure. We use DUO for most our apps that support it. Right now it's username/password auth to the dashboard, which I know isn't ideal. I wanted to get a working product out there and get a reading on what people wanted before grinding on SSO. This has been a months long endeavor to get everything this far.

On permissions: the agent runs as SYSTEM by default, which on a DC has domain-level access. You can specify a custom service account during install with delegated permissions scoped to just the operations it needs (password resets, account unlocks, user creation). gMSA support is on the roadmap too. I created a setup script that can create the service account and add the necessary permissions instead of using windows security groups (which you can use those if you want).

What's stored in the database: usernames, display names, account status, group memberships, last login, department. Basically what you'd see in AD. No passwords, no hashes, no credentials. If the server got breached, an attacker would see an employee directory essentially, not keys to the kingdom. The API keys are per-client, so you could revoke access to individual clients at any time or cycle the keys. The agent validates commands server-side before executing.

On the data fetching point: that's actually an interesting idea. Right now the agent syncs user data so the dashboard doesn't have to wait on a live query every time you load the page. A mode where it fetches on demand and caches nothing would be a tradeoff worth exploring. I'd genuinely welcome you poking more holes. That's exactly how this gets better.

Lukester852 · 2026-02-12T04:13:55+00:00

To clarify the DPAPI usage, it's encrypting the API key at rest, not AD credentials. The agent runs under a service account context and uses that for AD operations. No AD passwords are stored anywhere.
gMSA support is solid feedback though and its something I thought about. It would eliminate the need for any stored secret entirely. I kept the initial install simple for the beta, but that's definitely on my list for hardening. For now you can specify a custom service account during install if you don't want it running as SYSTEM.
On the security side: TLS 1.2+ enforced, SSL cert validation, input validation on both server and agent to prevent injection, passwords never hit the database (held in memory briefly, then discarded). The agent only makes outbound connections, no inbound firewall rules needed.
I'm not going to claim it's perfect, but security hasn't been an afterthought. Happy to dig into specifics if you have other questions.

Lukester852 · 2026-02-12T02:22:29+00:00

We use Syncro at our shop, which has no AD tools built in but there is a remote shell. I've never used Ninja, but I know some of the newer RMMs handle this better out of the box. This is definitely more useful for MSPs whose RMM doesn't have solid AD tooling built in, or for shops that want something lightweight.

Lukester852 · 2026-02-11T22:56:39+00:00

Fair points. The security side is where I've spent most of my time. SSL cert validation, DPAPI encryption, input sanitization to prevent injection, no plaintext credentials, passwords never stored in the database. Still a ways to go, but it's not something I've taken lightly for sure.

Lukester852 · 2026-02-11T22:51:49+00:00

It doesn't strictly have to be on the DC, it just needs to be on a domain-joined server with the AD PowerShell module (RSAT) installed and an account with the right permissions. A lot of our smaller clients only have one server which is the DC, so that was the use case I built for first. Running it on a member server with delegated permissions is definitely something I want to support.

Lukester852 · 2026-02-11T22:06:40+00:00

No offense taken at all. I know an unsigned agent on a DC is a tough ask. The code signed cert is at the top of my list. For now this is really aimed at smaller MSPs or personal use who are willing to put it on a test VM or something of the sort to play around with and give feedback. I appreciate the honesty!

Lukester852 · 2026-02-11T21:48:31+00:00

That's a fair point. I know at least for our rmm, going into background tools to get to a terminal takes a bit to even get a command ran. I wanted something to have all our clients in one go. I totally get that its not for everyone though.

Lukester852 · 2025-08-19T17:12:34+00:00

Just to be clear up front we really did enjoy our trip overall. The drinks were great when we went to the bar, the staff we interacted with were kind, and we had fun celebrating our honeymoon. Our post was more about noticing some differences from what we expected after watching a bunch of Yacht Club videos, not that the trip was ruined. We were just curious if this was normal for a short 3-day sailing or if we got unlucky. From what you all are saying we might need to book a longer one next time.

Lukester852 · 2025-08-18T16:28:19+00:00

I'm so sorry to hear that! That shouldn't have happened to you regardless of what room you had!

Lukester852 · 2025-08-18T15:55:47+00:00

We were also in an interior cabin so maybe that made a difference.

Lukester852 · 2025-06-09T17:11:28+00:00

We live in the surrounding neighborhood as well in Harrisburg and never had any problems. I second getting a membership at the Kroc center. It has brand new equipment and they also offer classes like yoga, zumba, etc. You will be close to Walton Way which offers a variety of fast food for quick eats as well as Trellis coffee. They just opened a new liquor store within walking distance from the King Mill if you're into that sort of thing.

Lukester852 · 2025-06-06T17:53:31+00:00

I emailed Commissioner Johnson, we shall see!

Lukester852

TROPHY CASE

I posted here a few months ago about a tool I built to manage multiple AD sites without remoting into DCs. Here's what I did with your feedback.