AdFind

Summary

Command line Active Directory query tool. Mixture of ldapsearch, search.vbs, ldp, dsquery, and dsget tools with a ton of other cool features thrown in for good measure. This tool proceeded dsquery/dsget/etc by years though I did adopt some of the useful stuff from those tools.

Warranty

See warranty.

Platforms

Current Version

Version 1.57.00 - November 19, 2021

Modification(s) from previous version

Security Requirements

There are no local security requirements for running AdFind other than the ability to launch executables. Information returned from Active Directory and ADAM/ADLDS will be dependent on the security configured for the directory. Generally a normal Active Directory user can return a considerable amount of information from Active Directory while ADAM/ADLDS tends to be more locked down.

The -showdel option will require permissions to see into the cn=Deleted Objects container. By default, this requires administrator permissions. It can be modified but it is non-trivial for most admins.

The STATS control options (stats, stats+, statsonly, stats+only, etc.) require the user to have DEBUG_PRIVILEGE on the server being queried. This generally means admin access is required to use that functionality.

The -sdna (Security Descriptor Non-Admin) or -nosacl options can be used to tell LDAP to not return the SACL portion of the ACL. This will allow users without auditing rights to retrieve most of the Security Descriptor of an object. Specifically, the Owner, Group Owner, and DACL information will be returned. If you attempt to use -sddl,-sddc,-owner* options and you don't get the information returned, add the -sdna option to see if that helps.

Language

C++. Compiled with Visual Studio 2022

Source Code Availability

None

Story

AdFind was put together when I finally got sick of the limitations in ldapsearch and search.vbs and didn't want to continue writing quick vbscript solutions every time I needed some generic info. Plus, anyone will tell you vbscript doesn't handle several of the attributes in Active Directory very well. Eventually after I had this tool out there for some time, Microsoft introduced dsquery and dsget. While they are nice tools, AdFind continues to be more flexible and I rarely, if ever, use the ds* tools. I did, however, like the ability to pipe the quoted DN results from the query into other command line tools so I emulated that functionality from the ds* series with AdFind with the -dsq option. One day I realized that I could take the piping one step further and worked out the -adcsv option which when combined with AdMod is extremely powerful for performing updates on AD. 

V01.31.00 added a bunch of new changes, some of these changes include shortcut options. You can view information on the shortcut options with the new help screen available through /sc?. The story behind these shortcut options is that there were queries I was doing on a regular basis that I hated typing up the whole command for, for example, one of my most common queries is to check a schema object for its definitions which would normally take the command adfind -schema -f "|(name=objectname)(ldapdisplayname=objectname)" and now it is as simple as adfind -sc s:objectname. Another common one for me is listing all of the schema objects with a specific prefix which normally would look like adfind -schema -f "|(name=prefix*)(ldapdisplayname=prefix*)" -sort -list ldapdisplayname and now it is adfind -sc sl:prefix*. Anyway there are a ton of shortcuts, have fun.

V01.40.00 finally added an often requested feature - the ability to pipe the output from one AdFind command as the input for the BASE DN for another AdFind command, this allows things like requesting constructed attributes that require a base scope query for all users in an OU or the entire directory with a single command line or counting the number of users in every OU in the directory.

V01.47.00 added a beta switch -nopaging which turns off the default LDAP Paging option. This should make it so AdFind can be used against LDAP directories that do not support the paging control. In V01.48.00 this switch auto-enables itself when it detects a directory that doesn't indicate paging is a supported capability in the RootDSE.

V01.52.00 added some beta Regular Expression (regex) functionality. See -regex? usage for more information.

Add-Ons

ADCSV.PL - Perl script to convert a full ADFIND output dump to CSV style format. Included in ZIP file for AdFind. No I will not rewrite this in vbscript. I dislike vbscript. I have received a couple of vbscript scripts to do this, I will not include them as I will only include stuff that I have written so I am only answering questions on stuff I wrote. If you only need to export specific attributes, specify those attributes and use the -csv option to get CSV output natively.

 

Download

You do not have to supply the email address. I would like you to fill that in though so that I have an idea on how popular a tool really is. If I see 1000 downloads with 900 different email addresses I know it is more widespread than one that has 1000 downloads and 200 different email addresses because the same person needed to keep downloading it for some reason.

Email Address: Optional
 
Sponsored Link:

Version History

As seen in

Usage

    Download and type adfind /? for basic usage

See current usage screens