Contact Sales
+1 (614) 423-6718
Support
Blog
Partners
Downloads
Login
Guardian
Overview
Features & Benefits
FAQ
Resources
Get Started

PRODUCT

CayosoftGuardian

Unified console: hybrid AD change monitoring, instant rollback, & threat detection — the most comprehensive solution.
Cayosoft Guardian: Catch threats early, roll back risky changes instantly, and stay audit-ready across AD and Entra ID—all from one secure, script‑free platform.
Catch threats early, roll back risky changes instantly, and stay audit-ready across AD and Entra ID—all from one secure console.
Get A Demo
Get A Demo

Hybrid AD management

CayosoftGuardian

Catch threats early, roll back risky changes instantly, and stay audit-ready across AD and Entra ID—all from one secure console.
Get A Demo
Get a Quote
Cayosoft Guardian™

Protect What Matters Most

Your Hybrid Active Directory is your organization’s backbone. Cayosoft Guardian secures hybrid environments with real-time detection and unified monitoring.

Threats Detected & Reversed

Cayosoft Guardian spots and reverses malicious changes across hybrid AD, Entra ID, and Microsoft 365—before attackers can strike.

Protect What Matters Most

Your Hybrid Active Directory is your organization’s backbone. Cayosoft Guardian secures hybrid environments with real-time detection and unified monitoring.

Threats Detected & Reversed

Cayosoft Guardian spots and reverses malicious changes across hybrid AD, Entra ID, and Microsoft 365—before attackers can strike.

6 Logs to View Hybrid Changes

At least six native logs need to be checked to view changes across hybrid Microsoft environments.

$11.5M = Cost of Insider Threats

The average global cost of insider threats is now over $11.5 million.

Recycle Bin Only Stores for 30 Days

Azure AD Recycle Bin only keeps deleted users and groups for 30 days before they are permanently erased.

Hybrid Active Directory Recovery and Monitoring Software

Avoid Costly Hybrid AD Outages from Cyber Threats or Mistakes – In a Single Solution

Your Active Directory (AD) or Microsoft Entra ID (formerly Azure Active Directory) contain vital user identities that are crucial to ensuring your business operates without interruption. Whether from malicious actions, like cyberattacks and malware, or mistakes, like accidental deletions and misconfigurations, corruption of your Active Directory can stop your business in its tracks and cause costly outages that can last hours, days, or even weeks.

Why Cayosoft Guardian

In hybrid environments, every second counts. Cayosoft gives you real-time visibility into identity changes, instant rollback to reverse risky actions, and complete control over Active Directory, Entra ID, Microsoft 365 and Intune.

Why Cayosoft Guardian

Cayosoft Guardian was designed to reduce the complexity of hybrid Active Directory security, by combining threat detection, monitoring, and recovery into one comprehensive solution. Cayosoft Guardian continuously monitors directories and services, allowing you to isolate suspect changes and instantly recover unwanted changes made to both objects and settings. This is done across on-premises AD, hybrid AD, Entra ID, Office 365, Microsoft Teams, and Exchange Online, all from Cayosoft Guardian’s single, unified console.

Protect Vital Infrastructure

Active Directory is used by 90% of organizations worldwide, making it a prime target for cyberattacks.

Stop Attackers In Their Tracks

Discover and eliminate hybrid AD vulnerabilities. Identify and revert malicious changes before exploited.

Keep Business Running

Avoid or minimize the impact of costly ransomware attacks and AD outages. Ensure business continuity.

Features & Benefits

  • Recover Instantly

  • Instant AD Object and Attribute Recovery

    Instant object and attribute recovery allows administrators to rapidly recover from mistakes or malicious changes. Using granular change history, quickly find and fix unwanted changes, including changes to group memberships, group policy objects (GPOs), account settings, Microsoft licensing, Microsoft Teams memberships, and accidental AD object deletions. Cayosoft Guardian’s instant Active Directory recovery software enables you to recover fast and eliminate costly downtime caused by AD outages, without wasting time from the lengthy operations legacy file-based AD recovery tools require.

    Benefits:

    • Resolves outages fast, vastly reducing all associated costs
    • Easily identify & instantly reverse unwanted changes
    • Save lost productivity from common AD object deletions — keep operations running smoothly

  • Monitor for Changes

  • Continuous Change Monitoring and Alerting

    Continuous change monitoring and real-time alerting across Active Directory, Azure AD, Office 365, including other key Microsoft systems and cloud, allows administrators to quickly identify malicious changes or mistakes, like if an object gets accidentally deleted, and instantly recover from them. With Cayosoft Guardian’s Active Directory (AD) auditing and monitoring software, receive notifications and track changes in real time, enabling you to stop hackers before they have a chance to act.

    Benefits:

    • Stop breaches, malicious changes, & mistakes that ultimately cause expensive outages or fines
    • Be proactive: alert administrators about important changes before they escalate into problems
    • Ensures security, compliance, & business continuity goals are met & costly outages are avoided

  • Track Hybrid Changes

  • Unified Change History

    Continuous and unified change history records up-to-the-minute changes across integrated Microsoft services, including on-premises Active Directory, hybrid Active Directory, Azure AD, Office 365, and other key Microsoft systems and cloud-based applications. Cayosoft Guardian’s continuous, unified change history allows you to view and track changes made in and between Microsoft systems, an unachievable tasks when using event logs or legacy auditing tools. Built-in or custom queries show “who, what, when, and where” details needed to satisfy recovery, security, and compliance objectives.

    Benefits:

    • Complete view: see changes made across your entire hybrid Microsoft environment
    • Improve security & protect your critical Microsoft systems from unwanted changes
    • Ensure you meet compliance, legal, & regulatory goals

  • Detect Threats

  • Threat Detection and Response Guidance

    Like antivirus for Microsoft identities, Cayosoft Guardian automatically identifies and reverses malicious changes made to your entire Active Directory (AD) environment, including hybrid AD, Azure AD, and other systems, before attackers can use them for exploit. With Cayosoft Guardian’s threat detection and automatic response you can proactively monitor for known attack vectors, allowing you to uncover and resolve system misconfigurations, indicators of exposure (IOE), and indicators of compromise (IOC).

    Benefits:

    • Thwart AD attacks — take corrective actions before an attack takes place
    • Trigger automated responses to stop or slow down attacks
    • 360⁰ protection: on-premise AD, Azure AD, & Office 365 — one product, one screen

  • Enrich SIEM Tools

  • Event Log and Security Information and Event Management (SIEM) Enrichment

    Threat actors often target event logs first during an attack so they can blind SIEM tools, like Microsoft Sentinel, and carry out their activities, costing businesses millions of dollars each year. Cayosoft Guardian’s continuous change history records changes even when security logs or SIEM tools are compromised, including events that bypass event logs. Cayosoft Guardian collects event logs from AD, Azure AD, Office 365, and more, to enhance the detail of changes that were made.

    Benefits:

    • Checks & balances: Cayosoft works even if an attacker compromises native logs
    • Single product for hybrid Microsoft environments — reduce multi-console drain
    • Reduce response & resolution times — real-time alerts get you ahead of the curve

  • Enhance Backup Solutions

  • Traditional Backup and Restore Solution Enhancement

    Traditional backup solutions are not able to cope with instant recovery of user accounts and groups that provide access. Cayosoft Guardian improves traditional backup solutions by adding instant Active Directory recovery for objects and attributes, like user identities and group access, that are the first step to recovery. Working alongside your traditional backup solution, Cayosoft Guardian allows you to bring back user identities and their access instantly, greatly reducing the recovery process and recovery times compared to other recovery tools and native methods.

    Benefits:

    • Perfect complement to your existing backup & recovery strategy
    • Ensure a clean restoration — eliminate chances of reintroducing compromised servers
    • Reduce time: At least 3X faster than traditional tools & solutions

  • Download Datasheet

  • Download Datasheet

    Cayosoft Guardian
    Learn more about Cayosoft Guardian

    Benefits:

    • Benefit
    • Benefit
    • Benefit

Instant AD Object and Attribute Recovery

Instant object and attribute recovery allows administrators to rapidly recover from mistakes or malicious changes. Using granular change history, quickly find and fix unwanted changes, including changes to group memberships, group policy objects (GPOs), account settings, Microsoft licensing, Microsoft Teams memberships, and accidental AD object deletions. Cayosoft Guardian’s instant Active Directory recovery software enables you to recover fast and eliminate costly downtime caused by AD outages, without wasting time from the lengthy operations legacy file-based AD recovery tools require.

Benefits:

  • Resolves outages fast, vastly reducing all associated costs
  • Easily identify & instantly reverse unwanted changes
  • Save lost productivity from common AD object deletions — keep operations running smoothly

Continuous Change Monitoring and Alerting

Continuous change monitoring and real-time alerting across Active Directory, Azure AD, Office 365, including other key Microsoft systems and cloud, allows administrators to quickly identify malicious changes or mistakes, like if an object gets accidentally deleted, and instantly recover from them. With Cayosoft Guardian’s Active Directory (AD) auditing and monitoring software, receive notifications and track changes in real time, enabling you to stop hackers before they have a chance to act.

Benefits:

  • Stop breaches, malicious changes, & mistakes that ultimately cause expensive outages or fines
  • Be proactive: alert administrators about important changes before they escalate into problems
  • Ensures security, compliance, & business continuity goals are met & costly outages are avoided

Unified Change History

Continuous and unified change history records up-to-the-minute changes across integrated Microsoft services, including on-premises Active Directory, hybrid Active Directory, Azure AD, Office 365, and other key Microsoft systems and cloud-based applications. Cayosoft Guardian’s continuous, unified change history allows you to view and track changes made in and between Microsoft systems, an unachievable tasks when using event logs or legacy auditing tools. Built-in or custom queries show “who, what, when, and where” details needed to satisfy recovery, security, and compliance objectives.

Benefits:

  • Complete view: see changes made across your entire hybrid Microsoft environment
  • Improve security & protect your critical Microsoft systems from unwanted changes
  • Ensure you meet compliance, legal, & regulatory goals

Threat Detection and Response Guidance

Like antivirus for Microsoft identities, Cayosoft Guardian automatically identifies and reverses malicious changes made to your entire Active Directory (AD) environment, including hybrid AD, Azure AD, and other systems, before attackers can use them for exploit. With Cayosoft Guardian’s threat detection and automatic response you can proactively monitor for known attack vectors, allowing you to uncover and resolve system misconfigurations, indicators of exposure (IOE), and indicators of compromise (IOC).

Benefits:

  • Thwart AD attacks — take corrective actions before an attack takes place
  • Trigger automated responses to stop or slow down attacks
  • 360⁰ protection: on-premise AD, Azure AD, & Office 365 — one product, one screen

Event Log and Security Information and Event Management (SIEM) Enrichment

Threat actors often target event logs first during an attack so they can blind SIEM tools, like Microsoft Sentinel, and carry out their activities, costing businesses millions of dollars each year. Cayosoft Guardian’s continuous change history records changes even when security logs or SIEM tools are compromised, including events that bypass event logs. Cayosoft Guardian collects event logs from AD, Azure AD, Office 365, and more, to enhance the detail of changes that were made.

Benefits:

  • Checks & balances: Cayosoft works even if an attacker compromises native logs
  • Single product for hybrid Microsoft environments — reduce multi-console drain
  • Reduce response & resolution times — real-time alerts get you ahead of the curve

Traditional Backup and Restore Solution Enhancement

Traditional backup solutions are not able to cope with instant recovery of user accounts and groups that provide access. Cayosoft Guardian improves traditional backup solutions by adding instant Active Directory recovery for objects and attributes, like user identities and group access, that are the first step to recovery. Working alongside your traditional backup solution, Cayosoft Guardian allows you to bring back user identities and their access instantly, greatly reducing the recovery process and recovery times compared to other recovery tools and native methods.

Benefits:

  • Perfect complement to your existing backup & recovery strategy
  • Ensure a clean restoration — eliminate chances of reintroducing compromised servers
  • Reduce time: At least 3X faster than traditional tools & solutions

Download Datasheet

Cayosoft Guardian
Learn more about Cayosoft Guardian

Benefits:

  • Benefit
  • Benefit
  • Benefit
Want to further secure and protect your hybrid Microsoft environment?
Cayosoft Guardian secures and unifies hybrid AD change monitoring, threat detection, and instant AD object recovery, into a single console. Check out our complimentary solutions like instant forest recovery and hybrid AD management.

Instant AD Forest Recovery

Guardian Forest Recovery

Learn More >

Single Product Hybrid AD Management

Administrator

Learn More >
10 Best Practices for Hybrid Identity Threat Detection and Response
Download our whitepaper

10 Best Practices for Hybrid Identity Threat Detection & Response

Download Whitepaper

Trusted By

5+ Million

Users Worldwide

With comprehensive solutions, exceptional support, and frequent releases it’s no surprise we have 99% customer retention and 4.8/5 star customer satisfaction ratings.

Read More Customer Stories

Manage, Monitor, Recover

Cayosoft delivers modern hybrid architecture for AD, Entra ID, Microsoft 365, Intune, and Teams
Cayosoft Administrator™

Manage Hybrid AD from a Single Pane of Glass

Cayosoft Guardian Forest Recovery™

Instant AD Forest Recovery

Cayosoft Guardian™

Unified Hybrid AD Change Monitoring, Instant Rollback, and Threat Detection

Cayosoft® — Manage, Monitor, Recover

See Cayosoft Guardian In Action

Ready to see more of Cayosoft Guardian?

Request 1:1 Demo

How Cayosoft Compares

Continuous Monitoring of Active Directory

Instant Recovery of Active Directory

  • MANUAL PROCESS

  • Time-consuming and tedious process of searching through numerous native event logs and security settings. This results in the inability to see changes across entire hybrid AD environment, leading to security breaches, compliance failures, downtime, and costly service outages.

  • COMPETITORS

  • Traditional Active Directory monitoring tools and tools to monitor critical changes use file-based backups that need mounted or out-of-date snapshots. This leaves companies open to cyber risk and potentially business-crippling security breaches due to increased complexity and visibility issues across hybrid AD environments.

  • CAYOSOFT

  • Unified monitoring across on-premises Active Directory, Entra ID, hybrid AD, and Microsoft Office 365 environments. Change history repository keeps continuous, real-time backups enabling granular rollback of unwanted changes. Cayosoft Guardian was designed to simplify AD security and hybrid AD monitoring.

Time-consuming and tedious process of searching through numerous native event logs and security settings. This results in the inability to see changes across entire hybrid AD environment, leading to security breaches, compliance failures, downtime, and costly service outages.

Traditional Active Directory monitoring tools and tools to monitor critical changes use file-based backups that need mounted or out-of-date snapshots. This leaves companies open to cyber risk and potentially business-crippling security breaches due to increased complexity and visibility issues across hybrid AD environments.

Unified monitoring across on-premises Active Directory, Entra ID, hybrid AD, and Microsoft Office 365 environments. Change history repository keeps continuous, real-time backups enabling granular rollback of unwanted changes. Cayosoft Guardian was designed to simplify AD security and hybrid AD monitoring.

Instant Recovery of Active Directory

  • MANUAL PROCESS

  • Native backup and restore tools, like recycle bins, do not recover attributes and settings making them unsuitable for full object-level backups and attribute-level restorations. This time-consuming and tedious process can lead to extended downtime and expensive outages.

  • COMPETITORS

  • Legacy AD backup and recovery tools were designed only for on-premises Active Directory, requiring additional products and multiple consoles to recover across hybrid and cloud. Increased costs and inability to recover across hybrid AD environments leads to complex, error-prone processes and delayed recovery times.

  • CAYOSOFT

  • Instantly recover AD and Entra ID objects, attributes, and settings across on-premises AD, Entra ID, hybrid AD, and Office 365, with just a few clicks. With its single console, Cayosoft Guardian reduces the complexity of hybrid AD recovery and gets you back to business faster.

Native backup and restore tools, like recycle bins, do not recover attributes and settings making them unsuitable for full object-level backups and attribute-level restorations. This time-consuming and tedious process can lead to extended downtime and expensive outages.

Legacy AD backup and recovery tools were designed only for on-premises Active Directory, requiring additional products and multiple consoles to recover across hybrid and cloud. Increased costs and inability to recover across hybrid AD environments leads to complex, error-prone processes and delayed recovery times.

Instantly recover AD and Entra ID objects, attributes, and settings across on-premises AD, Entra ID, hybrid AD, and Office 365, with just a few clicks. With its single console, Cayosoft Guardian reduces the complexity of hybrid AD recovery and gets you back to business faster.

Cayosoft Guardian™ FAQ

GENERAL OVERVIEW

Cayosoft is the leader in hybrid Microsoft identity management, trusted by enterprises worldwide. We deliver automation, security, and recovery for AD, Entra ID, and Microsoft 365—all from a single platform. With 99% customer retention, 100% hybrid focus, and 100% customer satisfaction, customers don’t just trust Cayosoft—they love us.

Cayosoft Guardian is a real-time hybrid identity protection platform purpose-built for Active Directory (AD, Microsoft Entra ID (formerly Azure AD), Intune, and Teams. It delivers continuous monitoring, change auditing, and one-click rollback to reverse unauthorized changes before they become security incidents or compliance failures.

Cayosoft Guardian is ideal for:

  • Identity and Access Management (IAM) teams
  • Security Operations Centers (SOCs)
  • Compliance and audit professionals
  • Hybrid identity architects and enterprise AD admins.
Capabilities and Functionality

Guardian tracks changes across:

  • On-prem AD and Entra ID
  • Group memberships (e.g., Domain Admins)
  • User and group attributes
  • Conditional access policies
  • Group Policy Objects (GPOs)
  • Password policies
  • Object deletions, disables, and privilege escalations

It allows admins to instantly reverse unauthorized or mistaken changes, including bulk operations, without needing to restore outdated backups or relying on event logs. You can restore individual attributes, objects, or entire groups in seconds.

Yes. Guardian is explicitly built for hybrid Microsoft environments and supports:

  • Multi-domain, multi-forest AD
  • Multiple Entra ID tenants
  • Cross-platform views of AD, Entra ID, and Microsoft 365 (Teams, Exchange, Intune)

No. Guardian is agentless. It reads from native APIs and change logs to monitor identity systems securely and efficiently.

Security and Threat Detection

It continuously inspects your environment for:

  • Indicators of Exposure (IOEs): e.g., stale accounts, overprivileged users
  • Indicators of Compromise (IOCs): e.g., unauthorized privilege changes
  • Indicators of Attack (IOAs): e.g., lateral movement, suspicious deletes.

Yes. Guardian integrates with:

  • Email and syslog for immediate alerting
  • SIEM and SOAR platforms like Splunk, Sentinel, or QRadar
  • Custom alert thresholds (e.g., domain admin changes, mass disables)

Absolutely. Guardian helps enforce Zero Trust by:

  • Preventing standing admin privileges
  • Alerting on privilege escalations
  • Enabling least-privilege enforcement via integrated RBAC policies.
Compliance and Audit Readiness

Yes. Cayosoft Guardian provides:

  • Immutable, centralized audit trails
  • Customizable reports by object, admin, time, or change type
  • Scheduled report delivery for internal or external auditors
  • Support for HIPAA, SOX, PCI-DSS, NIST, and GDPR compliance.

Yes. Guardian monitors all identity changes—even those made through other tools, PowerShell, or native consoles—ensuring complete visibility and accountability.

Deployment and Operations
  • Installs on a Windows Server VM or physical box
  • Agentless—no software installed on domain controllers
  • Low system impact by using native APIs
  • Supports high availability configurations.

Most customers deploy and start monitoring within hours. There’s no need for scripting or domain controller changes, and Cayosoft provides onboarding assistance if needed.

Yes. Cayosoft Guardian is designed to support:
  • 1M+ users
  • Dozens of domains or forests
  • Multiple Entra ID tenants
  • Multi-region, multi-tenant hybrid infrastructures.
How It Integrates

Yes. It complements:

  • SIEM solutions (e.g., Microsoft Sentinel, Splunk, QRadar)
  • SOAR platforms (e.g., Cortex XSOAR)
  • Endpoint detection tools (e.g., CrowdStrike, Microsoft Defender)

Guardian fills the gap between endpoint security and identity layer protection.

Yes. Guardian is part of the Cayosoft Enterprise suite. When paired with Administrator and Guardian Forest Recovery, you get a complete lifecycle end-to-end management tool for Microsoft environments.

Why Cayosoft Guardian Over Other Tools?
Feature Cayosoft Guardian Legacy/SIEM/EDR Tools
Hybrid AD + Entra ID Coverage Full native support Partial or none
Real-Time Change Monitoring Second-level tracking Event log dependent
One-Click Rollback Yes Manual recovery only
Agentless Architecture Yes Often agent-based
SIEM/SOAR Integration Built-in Requires customization
Immutable, Auditable Logging Yes May need external setup
Compliance Reporting Templates + delivery Manual export required
Designed for Hybrid Identity Security Purpose-built Infrastructure/endpoint-focused

Guardian FAQ

Cayosoft Guardian provides monitoring, backup, and recovery for a number of AD objects, attributes, and settings critical to maintaining AD security and operational integrity, including:

On-Premises Active Directory (AD):

  • Contact, group, user, and computer objects and attributes
  • Group memberships, group policy objects (GPOs) and GPO settings, privileged groups, organizational units (OUs), and Conditional Access policies (CAPs)
  • On-premises Exchange settings and policies

Microsoft Entra ID (formerly Azure AD):

  • Users, groups, and guests
  • Roles, group memberships, administrative units, and Conditional Access policies

Office 365:

  • Exchange Online and Microsoft Teams settings and policies

And more! For additional information or questions including full capabilities of Cayosoft Guardian, contact us.

Yes, Cayosoft Guardian delivers continuous AD monitoring and real-time alerts across hybrid Active Directory environments to changes, like AD users and groups, Entra ID roles, privileged AD groups, and Microsoft Teams settings. Cayosoft Guardian’s alert query also provides a simple way for you to create custom notifications to admins through Microsoft Teams and/or email.

Yes, Cayosoft Guardian will restore hard-deleted or permanently deleted AD objects. Since the objects are no longer present in Active Directory or Entra ID, Cayosoft Guardian will recreate the object using the details stored in its database.

Note: While Guardian recreates deleted objects, some links to those objects are not restored and may need to be manually assigned. For additional information or questions about how Cayosoft Guardian recovers deleted AD objects, reach out to us.

Cayosoft Guardian requires Windows Server 2016, Windows Server 2019, or Windows Server 2022.

Unlike traditional Active Directory (AD) backup software, like bare-metal backups, system state backups, full backups, or incremental backups, Cayosoft Guardian continuously backs up your Active Directory and Entra ID in real time, allowing you to quickly and easily revert changes to any point in time. This not only reduces storage space required but eliminates the risk of reintroduction of ransomware, reinfection, and additional corruption that can occur with some legacy Windows server backup tools.

Cayosoft Guardian does not recover on-premises domain controllers, but Cayosoft Guardian Forest Recovery does. Learn more about Cayosoft Guardian Forest Recovery, including all the features of Cayosoft Guardian plus domain controller recovery and forest recovery.

Resources for Active Directory Recovery and Monitoring

Datasheet

Unified, Instant AD Recovery and Change Monitoring Solutions

Cayosoft Guardian is the only solution to combine AD monitoring and backup across Microsoft environments. With Cayosoft Guardian, IT admins can quickly see, understand, and rollback mistakes or malicious changes to Active Directory objects, attributes, and settings.

View Datasheet

Product Review

Review: Hybrid and Entra ID Recovery and Protection Solution

Microsoft MVP Nuno Mota reviewed Cayosoft Guardian, a comprehensive recovery solution for on-premises Active Directory (AD), Entra ID, and hybrid AD. After analysis, Moto gave Cayosoft Guardian a 4.6/5 rating, giving it a gold award with TechGenix.com.

Read more

Webinar

3 Modern Ways to Protect Hybrid Identities

Watch this on-demand webinar where we discuss the blind spots in native logs, how undetected mistakes and malicious privilege escalation can wreak havoc on your organization, and best practices on how to prevent and recover your Active Directory from these cyber threats.
Watch Now

Ready to See Cayosoft in Action?

Let us show you how Cayosoft can save your team time, 
reduce risk, and unlock real productivity.
Schedule A Demo
Contact sales