Domain information query tool adfind

Tool introduction

Adfind It is a very powerful information collection tool in the domain environment , Allow users to easily collect all kinds of information in the domain environment . It provides a number of options , You can optimize your search and return relevant details , It is a sharp weapon in Intranet penetration .

• Download address ：https://www.softpedia.com/get/Programming/Other-Programming-Files/AdFind.shtml

Common commands

List the domain controller names ：

AdFind -sc dclist

View domain control version ：

AdFind -schema -s base objectversion

Query the online computers in the current domain （ All attributes ）：

AdFind -sc computers_active

Query the online computers in the current domain ( Show only the name and operating system )：

AdFind -sc computers_active name operatingSystem

Query all computers in the current domain （ All attributes ）：

AdFind -f "objectcategory=computer"

Query specified domain （luckysec.cn） All computers in （ All attributes ）：

Adfind.exe -b dc=luckysec,dc=cn -f "objectcategory=computer"

Query all computers in the current domain （ Show only the name and operating system ）：

AdFind -f "objectcategory=computer" name operatingSystem

Query all users in the current domain ：

AdFind -users name

Query specified domain （luckysec.cn） All users in （ All attributes ）：

Adfind.exe -b dc=luckysec,dc=cn -f "objectcategory=user"

Query all in the field GPO Information ：

AdFind -sc gpodmp

View protected AD Domain account :

Adfind -f "&(objectcategory=person)(samaccountname=*)(admincount=1)" -dn

View domain management account ：

AdFind -default -f "(&(|(&(objectCategory=person)(objectClass=user))(objectCategory=group))(adminCount=1))" -dn

View the specified domain （luckysec.cn） Internal non constrained delegation host ：

AdFind.exe -b "DC=luckysec,DC=cn" -f "(&(samAccountType=805306369)(userAccountControl:1.2.840.113556.1.4.803:=524288))"  cn

Query specified domain （luckysec.cn） Unconstrained delegated users within ：

AdFind.exe -b "DC=luckysec,DC=cn" -f "(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=524288))" cn distinguishedName

Reference article

• https://www.cnblogs.com/Chuantouli/p/12513654.html