# ADRecon

**Gather information about the Active Directory and generates a report.**

**Download Link --->--->--->**  [**https://github.com/sense-of-security/ADRecon**](https://github.com/sense-of-security/ADRecon)<br>

<mark style="color:orange;">**ADRecon is a tool which extracts and combines various artefacts (as highlighted below) out of an AD environment. The information can be presented in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis and provide a holistic picture of the current state of the target AD environment.**</mark>\
\
**The tool is useful to various classes of security professionals like auditors, DFIR, students, administrators, etc. It can also be an invaluable post-exploitation tool for a penetration tester.**\
\ <mark style="background-color:orange;">**It can be run from any workstation that is connected to the environment, even hosts that are not domain members. Furthermore, the tool can be executed in the context of a non-privileged (i.e. standard domain user) account. Fine Grained Password Policy, LAPS and BitLocker may require Privileged user accounts. The tool will use Microsoft Remote Server Administration Tools (RSAT) if available, otherwise it will communicate with the Domain Controller using LDAP.**</mark>\
\
**The following information is gathered by the tool:**\ <mark style="background-color:green;">**- Forest;**</mark>\ <mark style="background-color:green;">**- Domain;**</mark>\ <mark style="background-color:green;">**- Trusts;**</mark>\ <mark style="background-color:green;">**- Sites;**</mark>\ <mark style="background-color:green;">**- Subnets;**</mark>\ <mark style="background-color:green;">**- Default and Fine Grained Password Policy;**</mark>\ <mark style="background-color:green;">**- Domain Controllers, SMB versions, whether SMB Signing is supported and FSMO roles;**</mark>\ <mark style="background-color:green;">**- Users and their attributes;**</mark>\ <mark style="background-color:green;">**- Service Principal Names (SPNs);**</mark>\ <mark style="background-color:green;">**- Groups and memberships;**</mark>\ <mark style="background-color:green;">**- Organizational Units (OUs);**</mark>\ <mark style="background-color:green;">**- GroupPolicy objects and gPLink details;**</mark>\ <mark style="background-color:green;">**- DNS Zones and Records;**</mark>\ <mark style="background-color:green;">**- Printers;**</mark>\ <mark style="background-color:green;">**- Computers and their attributes;**</mark>\ <mark style="background-color:green;">**- PasswordAttributes;**</mark>\ <mark style="background-color:green;">**- LAPS passwords;**</mark>\ <mark style="background-color:green;">**- BitLocker Recovery Keys;**</mark>\ <mark style="background-color:green;">**- ACLs (DACLs and SACLs) for the Domain, OUs, Root Containers, GPO, Users, Computers and Groups objects;**</mark>\ <mark style="background-color:green;">**- GPOReport;**</mark>\ <mark style="background-color:green;">**- Kerberoast;**</mark>\ <mark style="background-color:green;">**- Domain accounts used for service accounts;**</mark>
