AdFind

Summary

Command line Active Directory query tool. Mixture of ldapsearch, search.vbs, ldp, dsquery, and dsget tools with a ton of other cool features thrown in for good measure. This tool proceeded dsquery/dsget/etc by years though I did adopt some of the useful stuff from those tools.

Warranty

See warranty.

Platforms

Current Version

Version 1.62.00 - October 13, 2023

Modification(s) from previous version

Security Requirements

There are no local security requirements for running AdFind other than the ability to launch executables. Information returned from Active Directory and ADAM/ADLDS will be dependent on the security configured for the directory. Generally a normal Active Directory user can return a considerable amount of information from Active Directory while ADAM/ADLDS tends to be more locked down.

The -showdel option will require permissions to see into the cn=Deleted Objects container. By default, this requires administrator permissions. It can be modified but it is non-trivial for most admins.

The STATS control options (stats, stats+, statsonly, stats+only, etc.) require the user to have DEBUG_PRIVILEGE on the server being queried. This generally means admin access is required to use that functionality.

The -sdna (Security Descriptor Non-Admin) or -nosacl options can be used to tell LDAP to not return the SACL portion of the ACL. This will allow users without auditing rights to retrieve most of the Security Descriptor of an object. Specifically, the Owner, Group Owner, and DACL information will be returned. If you attempt to use -sddl,-sddc,-owner* options and you don't get the information returned, add the -sdna option to see if that helps.

The biggest news around AdFind in the last few years (2020+), the hacker collectives have really taken a liking to it and the AV / Antimalware companies that still, STILL, have no better tools and mechanisms than to block whole binaries because they might be used in a bad way have decided that AdFind, as a PUP (potentially unwanted program), should be blocked outright instead of use more intelligent mechanisms to see maybe what it is actually doing (like enumerating all objects in the Directory and alerting on that). This has made it challenging for people to download and run the tool without working with their Internet Security and EndPoint Security teams in their companies. I am sorry for the stupid out there but there really isn't much I can do about this. The cluelessness in the AV/Antimalware companies and in some corporate Security teams is well beyond my ability to correct. As I figure things out about how to bypass the controls etc in place to block AdFind I will share on the blog, https://blog.joeware.net. The AV and anti-malware companies are probably a lost cause, but perhaps you can show your corporate Security folks this page and also how useful the tool is for you to do your work and perhaps you will be able to convince them. I have generally found that Security folks who are actually trying to be secure and have a solid knowledge and understanding of security and actually accurately understand what a PUP or PUA is in the ratings without having to look it up will generally whitelist the tool if you really explain how useful it is for you to them. The fact that the hacker collectives like the tool speaks to its power and capability for knowledgable admins. If you have Security folks who feel blocking AdFind is the right model and aren't also blocking DSQuery, LDAPSearch, PowerShell, and ADSI really don't actually understand the problem space all that much. If you would like for them to contact me about it, tell them to hit me up at support@joeware.net and explain the issue they have with the tool and I will try to explain why it shouldn't be an issue though I doubt there will be much I can say to them that they couldn't google and find out on their own if they wanted to.

Language

C++. Compiled with Visual Studio 2022

Source Code Availability

None

Story

AdFind was put together when I finally got sick of the limitations in ldapsearch and search.vbs and didn't want to continue writing quick vbscript solutions every time I needed some generic info. Plus, anyone will tell you vbscript doesn't handle several of the attributes in Active Directory very well. Eventually after I had this tool out there for some time, Microsoft introduced dsquery and dsget. While they are nice tools, AdFind continues to be more flexible and I rarely, if ever, use the ds* tools. I did, however, like the ability to pipe the quoted DN results from the query into other command line tools so I emulated that functionality from the ds* series with AdFind with the -dsq option. One day I realized that I could take the piping one step further and worked out the -adcsv option which when combined with AdMod is extremely powerful for performing updates on AD. 

V01.31.00 added a bunch of new changes, some of these changes include shortcut options. You can view information on the shortcut options with the new help screen available through /sc?. The story behind these shortcut options is that there were queries I was doing on a regular basis that I hated typing up the whole command for, for example, one of my most common queries is to check a schema object for its definitions which would normally take the command adfind -schema -f "|(name=objectname)(ldapdisplayname=objectname)" and now it is as simple as adfind -sc s:objectname. Another common one for me is listing all of the schema objects with a specific prefix which normally would look like adfind -schema -f "|(name=prefix*)(ldapdisplayname=prefix*)" -sort -list ldapdisplayname and now it is adfind -sc sl:prefix*. Anyway there are a ton of shortcuts, have fun.

V01.40.00 finally added an often requested feature - the ability to pipe the output from one AdFind command as the input for the BASE DN for another AdFind command, this allows things like requesting constructed attributes that require a base scope query for all users in an OU or the entire directory with a single command line or counting the number of users in every OU in the directory.

V01.47.00 added a beta switch -nopaging which turns off the default LDAP Paging option. This should make it so AdFind can be used against LDAP directories that do not support the paging control. In V01.48.00 this switch auto-enables itself when it detects a directory that doesn't indicate paging is a supported capability in the RootDSE.

V01.52.00 added some beta Regular Expression (regex) functionality. See -regex? usage for more information.

Add-Ons

ADCSV.PL - Perl script to convert a full ADFIND output dump to CSV style format. Included in ZIP file for AdFind. No I will not rewrite this in vbscript. I dislike vbscript. I have received a couple of vbscript scripts to do this, I will not include them as I will only include stuff that I have written so I am only answering questions on stuff I wrote. If you only need to export specific attributes, specify those attributes and use the -csv option to get CSV output natively.

 

Download

You do not have to supply the email address. I would like you to fill that in though so that I have an idea on how popular a tool really is. If I see 1000 downloads with 900 different email addresses I know it is more widespread than one that has 1000 downloads and 200 different email addresses because the same person needed to keep downloading it for some reason.

NOTE: The AV/Malware companies are being morons blocking AdFind. Please see https://blog.joeware.net/2023/02/22/6166/

NOTE2: I have added a zip password for AdFind.exe in the zip, open the zip file and look in password.txt which isn't password protected.

Email Address: Optional
 
Sponsored Link:

Version History

As seen in

Usage

    Download and type adfind /? for basic usage

See current usage screens