Releases · srkyn/relic

relic v0.1.0

Initial public release.

Stale computer accounts — machines that have not authenticated since the threshold. Silently offline machines still receive group policy and appear in security groups.
- Dormant user accounts — users who have not logged in within the threshold. Includes service accounts identified by servicePrincipalName.
- Disabled accounts with group memberships — most immediately actionable: account is disabled but memberships are still live, closing a re-enablement path.
- Accounts with non-expiring passwords — DONT_EXPIRE_PASSWORD in userAccountControl, escalates to HIGH when account is also stale.
- Service accounts with aging passwords — SPNs with pwdLastSet older than the threshold are flagged as Kerberoasting exposure.

Condition	Severity
Disabled account still holds group memberships	HIGH
Service account (SPN), password unchanged >365 days	HIGH
Computer account inactive >365 days	HIGH
Non-expiring password + inactive >180 days	HIGH
Stale user or computer account	MEDIUM
Non-expiring password (active account)	MEDIUM
Disabled account, no group memberships	MEDIUM
Service account password unchanged >90 days	MEDIUM

git clone https://github.com/srkyn/relic.git
cd relic && pip install .
rl --version

rl -s dc01.corp.local --domain corp.local
rl -s dc01.corp.local --domain corp.local -F --dry-run