AD Automatic Enumeration

Choose the missing information. Do not run every LDAP/SMB collector for identical users and groups under the same identity.

Relationship graph: SharpHound and BloodHound CE

Use SharpHound compatible with your deployed BloodHound CE. On a Windows domain-authenticated collection host, use working DNS and the selected reachable DC:

.\SharpHound.exe --collectionmethods DCOnly --domain DOMAIN --domaincontroller DC_HOST --outputdirectory C:\Evidence --zipfilename ad-directory.zip --memcache

Replace DOMAIN with the DNS domain and DC_HOST with its DC; use an existing writable output directory. Import the generated *ad-directory.zip through that BloodHound version's ingestion interface; the filename may carry a timestamp prefix. Read collection errors as well as the ZIP contents. Review memberships and rights from your identity, then validate useful edges.

This replaces All-by-default and the obsolete Neo4j/Electron startup instructions. DCOnly does not establish current sessions, local-admin access or member-host execution rights. Retain focused host/session collection when a path depends on it: complete domain-mapping variants.

Kali directory graph without a menu

Use BloodHound.py's CE branch from a fresh private working directory. DC_HOST is the DC FQDN; DC_IP is the DNS server/DC IP. It produces CE-compatible JSON/ZIP, not a finished finding:

bloodhound-ce-python -d DOMAIN -u USER -p 'PASSWORD' -dc DC_HOST -ns DC_IP -c DCOnly --disable-autogc --zip

DCOnly collects directory groups, trusts, object properties, ACLs and containers; it bypasses member-computer/session enumeration. --disable-autogc avoids automatically choosing a separate Global Catalog when none is discovered. DNS, DC/GC discovery and directory resolution still require scoped connectivity; this is not a packet-level endpoint allowlist. The normal authentication mode can request a TGT and fall back to NTLM: stop on an invalid credential instead of repeatedly retrying. ZIP creation replaces this run's local JSON files; use a new directory per run.

Do not substitute linWinPwn's all,LoggedOn as a routine first pass. That adds member-host RPC and remote-registry queries; connecting to the registry pipe can trigger the target's RemoteRegistry service. Use the focused Windows host/session variants below only when that evidence is needed. No PEAS-style result is proof of usable rights.

.\SharpHound.exe --CollectionMethods LocalGroup --ComputerFile .\candidate-hosts.txt --OutputDirectory C:\Evidence --ZipFileName candidate-localgroups.zip
.\SharpHound.exe --CollectionMethods Session --ComputerFile .\candidate-hosts.txt --OutputDirectory C:\Evidence --ZipFileName candidate-sessions.zip

Readable inventory from Kali: ldapdomaindump

Choose this for readable users/groups/computers/policies when you do not already have that inventory. It is not a rights graph:

ldapdomaindump -u 'DOMAIN_NETBIOS\USER' -p 'PASSWORD' -o ldap-inventory ldap://DC_IP

Use the NetBIOS domain in DOMAIN_NETBIOS\USER; the explicit password avoids a prompt. Command arguments and collected data need private handling. Read the domain_users, domain_groups, domain_computers and policy reports. Missing attributes or denied reads remain gaps. Do not enable extra hostname resolution by default (-r). Its LDAP connection does not explicitly disable referrals, so do not treat one supplied IP as an enforced single-host boundary. Transport signing/channel-binding support differs between upstream and forks; handle a failed bind through the LDAP procedure rather than adding SIMPLE authentication. Upstream.

Writable directory objects from Kali

With the same valid domain identity, ask the DC which attributes, security descriptors and child classes are writable. This performs LDAP searches, not test modifications:

bloodyAD --host DC_HOST --dc-ip DC_IP -d DOMAIN -u USER -p 'PASSWORD' get writable --detail --partition DOMAIN

--detail reports the affected attributes/classes; --partition DOMAIN confines the query to the default domain naming context. Configuration/schema/DNS partitions are intentionally omitted. Do not add --transitive or --bh: those expand trust traversal or collection. A result is a permission candidate; confirm object type, effective rights, protected-object behavior and the relevant consumer/trigger before choosing a write. A missing result can reflect unreadable attributes or incomplete visibility. Upstream.

If get writable -h lacks --partition, use a compatible reviewed version; do not assume an older default searches only the domain partition.

Native fallback: our AD surface helper

When the graph workflow or third-party collector is unavailable, copy the entire scripts/ad-map directory. From Windows PowerShell 5.1 with usable domain authentication:

.\scripts\ad-map\Invoke-ADMap.ps1 -Server DC_HOST -Domain DOMAIN

Read next-checks.md, raw.json and queries.csv in the printed private directory. Accounts/groups/delegation/policy/AD CS metadata and visible object DACLs generate candidate clues and missing checks. This is not BloodHound's graph or effective-access calculation: nested groups, object-specific rights, deny effects and remote sessions require further validation.

[SUMMARY] lists the returned query counts and candidate clues; [GAPS] identifies failed/limited/partial reads. Start with one clue's evidence and missing check. Returned means that query returned, not that the directory is fully visible. A failed initial RootDSE/domain check stops collection; fix endpoint, authentication or domain context before interpreting absence of findings. Keep the whole ad-map directory together; the entry script needs ADMap.psm1.

$Credential = Get-Credential -UserName 'USER@DOMAIN'
.\scripts\ad-map\Invoke-ADMap.ps1 -Server DC_HOST -Domain DOMAIN -Credential $Credential -Module Accounts,Groups,Policies -OutputDirectory "$env:LOCALAPPDATA\ADMap\directory-pass1" -SummaryLimit 8

For a specifically missing metadata question, avoid another broad pass:

.\scripts\ad-map\Invoke-ADMap.ps1 -Server DC_HOST -Domain DOMAIN -Module ADCS

Template flags alone do not prove a certificate attack. Setup and limits.

Retain manual LDAP for precise objects/attributes, SMB/RPC for its service view and real host-access checks after obtaining a new identity. A new credential or route justifies targeted re-enumeration.

Prepare tools used on this page

Run setup on Kali after preparing the shared workspace. Skip a clone when its checkout already exists; review/update it deliberately rather than cloning over it. Operational commands remain in the sections above.

sudo apt install python3-ldapdomaindump

ldapdomaindump --help

sudo apt install sharphound
cp -a /usr/share/sharphound "$HOME/oscp/tools/artifacts/windows/"

file "$HOME/oscp/tools/artifacts/windows/sharphound/SharpHound.exe"

sudo apt install docker.io docker-compose-v2
sudo systemctl start docker
mkdir -p "$HOME/oscp/tools/repos/bloodhound-ce"
cd "$HOME/oscp/tools/repos/bloodhound-ce"
curl -fL https://github.com/SpecterOps/bloodhound-cli/releases/download/v0.2.1/bloodhound-cli-linux-amd64.tar.gz -o "$HOME/oscp/tools/downloads/bloodhound-cli.tar.gz"
tar -xzf "$HOME/oscp/tools/downloads/bloodhound-cli.tar.gz"
sudo ./bloodhound-cli install

sudo "$HOME/oscp/tools/repos/bloodhound-ce/bloodhound-cli" running
curl -I http://127.0.0.1:8080

pipx install bloodhound-ce
bloodhound-ce-python --help

pipx install bloodyAD
bloodyAD get writable -h