Forester Download

The LDAP and Active Directory browser for Mac.

Browse, search and look after your directory in a fast, native app. Every connection stays read-only until you allow changes, so you can open production without a second thought.

Download on the Mac App Store View on GitHub

Free on the Mac App Store · Open source · macOS 14 Sonoma or later · Apple silicon and Intel

Forester's main window: connections in the sidebar, the directory tree of corp.example in the middle, and the user Pieter Van Damme on the right with his account options, identity and direct reports.

Built for

  • Active Directory
  • AD LDS
  • OpenLDAP
  • 389 Directory Server
  • eDirectory
  • Any LDAPv3 server
Read-only by default

Open production without holding your breath.

A new connection can read but never write. Forester refuses every change until you allow it for that connection, with the Read-only button in the toolbar or ⌥⌘E. The toolbar and the status bar say in words which mode you are in, so nobody has to guess.

  • Per connection. Editing your lab never unlocks production.
  • Asks before it matters. Deletes, moves and password resets say exactly what they will touch.
  • Deleting a branch waits until you type its name.
  • Undo. Most changes come back with ⌘Z, and Change History lists every change made since you connected.
The Read-only button in Forester's toolbar, with the account options greyed out and the note: Read-only. Click Read-only in the toolbar, or press Option Command E, to change these.
Everything in one window

Built for the work you actually do.

The tree, the entry and the tools you reach for, in an app that feels like the rest of your Mac.

Browse at any size

A native outline that loads one level at a time and pages through large OUs. Object icons, disabled accounts dimmed, containers only when you want, and drag to move.

Decoded, not raw

SIDs, GUIDs, timestamps, account flags and group types in plain words, with the raw value one click away. Hex dumps, photos and certificates too.

Edits that know the schema

The right editor for every value, chosen from your server's own schema: text, numbers, dates, account expiry, DNs with a directory picker, files and photos.

Accounts in a click

Enable, disable and unlock accounts, reset passwords with a generated one, and set the options you know from Active Directory Users and Computers.

Search that checks itself

Filters checked as you type, attribute names completed from the schema, a builder for when you would rather click, and 32 ready-made searches.

LDIF in and out

Import new entries and change records with a summary first and a log of every record after. Export an entry, a branch or search results as LDIF or CSV.

Made for the keyboard

Every common task has a shortcut, and the menus show them all.

Browse or search
⌘1⌘2
Go to a DN
⇧⌘G
Show in the tree
⌘L
Copy the DN
⇧⌘C
Allow or stop changes
⌥⌘E
Reset a password
⇧⌘P
Active Directory

Answers that usually need a Windows machine.

Forester reads Active Directory the way an administrator does, and shows what is easy to miss.

  • Domain information: functional levels, operations masters, domain controllers and sites, trusts, the Recycle Bin and tombstone lifetime.
  • Password policies: the default policy and every fine-grained one, with who it applies to.
  • Account status on every domain controller, because failed sign-ins and last sign-in are kept per DC.
  • Replication metadata for each attribute, and when each member joined a group.
  • Nested membership in a single query, primary groups, and groups past 1,500 members read in full.
  • Permissions in words: who may do what with an object, whether it is inherited, and what your own account may do there.
  • The whole forest: search every domain at once through the global catalog, and open any domain from the list.
Enabled Password never expires Has SPN Privileged
The service account svc_sql in Forester, marked Password never expires and Has SPN, with its account options, last sign-in on this domain controller, password policy PSO-ServiceAccounts and service principal names.
Search

Find anything, then take it with you.

Write an LDAP filter and Forester checks it as you type, or build one from conditions. Start from a ready-made search for disabled users, stale computers, Kerberoastable accounts, empty groups and more.

Forester's search: the Password never expires preset, six matching accounts, and the selected account svc_sql with its account options.
  • Find by name in the toolbar uses Active Directory's own name resolution, so a name, account or mail address all work.
  • Results page past the server's limits, and export to CSV or LDIF with the attributes you choose.
Changes

Change things with care.

Adding one member to a large group sends one addition, not the whole list. New users fill in their account names from the name you type. Rename, move and duplicate show the result before they send anything.

The Reset Password sheet, with a button to generate a strong password and the option that the user must change it at next sign-in.
Passwords, the Active Directory way or the LDAP way.
The Import LDIF sheet, summarising a file of eight records: four new entries, two modifications, one rename or move and one deletion.
See what an LDIF file will do before you import it.
Privacy and security

Your directory stays between you and your server.

A directory browser holds the keys to your organisation. Forester is built to be easy to trust with them.

Nothing phones home

No account, no analytics, no crash reports. Forester talks only to the directory servers you add, and to their domain controllers when you ask for an account's status on each. The Mac App Store keeps it up to date.

Passwords in your keychain

Kept in the macOS keychain, tied to the server they were saved for, and never written into exported connection files. Turn off “Remember the password” and nothing is saved.

Encrypted connections

LDAPS and StartTLS, with the certificate chain and its fingerprint shown before you choose to trust it. Sign in with your Kerberos ticket and no password is typed at all.

No third-party code

Forester from the Mac App Store is written entirely in Swift on Apple's own frameworks, the LDAP client included. There are no dependencies to audit.

Open source

Read every line before you trust it.

Forester is free software under the GNU General Public License, version 3 or later. Read the code, build it yourself, report a problem or send a change.

git clone https://github.com/versaminds/forester cd forester && scripts/build-app.sh
Source on GitHub Buy me a coffee
Questions

Good to know.

Is Forester really free?

Yes. It is free to download and free software under the GPL. There is no paid tier and no account to create. If it saves you time, you can buy me a coffee.

Which Macs does it run on?

Any Mac with macOS 14 Sonoma or later, with Apple silicon or an Intel processor.

How is Forester updated?

Through the Mac App Store, like your other apps. Turn on automatic updates in the App Store's settings and each new version arrives by itself.

Can it change my directory by accident?

No. A new connection is read-only, and Forester refuses every change until you allow changes for that connection. You can make it read-only again at any time.

Does it work with Microsoft Entra ID?

Microsoft Entra ID (formerly Azure Active Directory) has no LDAP interface, so there is nothing for an LDAP browser to connect to. Forester works with on-premises Active Directory and with any directory that speaks LDAP or LDAPS.

Can I sign in with Kerberos?

Yes. Forester signs in with the Kerberos ticket your Mac already has, from Ticket Viewer, kinit or your organisation's single sign-on, over LDAPS or StartTLS and bound to that connection, so no password is typed or kept. A name and password, or an anonymous connection, work too.

Does it replace Active Directory Users and Computers?

For most of what people use it for on a Mac, yes: finding, reading and changing users, groups and computers, passwords and account options. It shows permissions in words but does not edit them, apart from "user cannot change password", and it does not edit Group Policy.

What does Forester send to VersaMinds?

Nothing. There are no analytics, no crash reports and no account. The privacy policy has the details.

How do I report a problem or ask for a feature?

The support page says how: by email, or as an issue on GitHub. Please leave out names, addresses and anything else from your directory that others should not see.

From VersaMinds

Your directory, and what your team knows about it.

Forester shows what is in your directory. Stackbridge, made by the same people, keeps what your IT team knows about it: incidents, runbooks and decisions, each approved by a person and checked against your systems, on your own servers.

See Stackbridge About VersaMinds

Get Forester.

Free, open source and at home on your Mac.

Download on the Mac App Store View on GitHub