ADWSDomainDump

Active Directory information dumper via ADWS (Active Directory Web Services).

Install

Recommended install:

pipx install git+https://github.com/mverschu/adwsdomaindump
# or
pipx install .

Usage

adwsdomaindump -u 'corp.local\jsmith' -p 'password' -n 10.0.0.1 dc01.corp.local
[*] Connecting to ADWS host...
[+] ADWS port 9389 is reachable
[*] Binding to ADWS host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished

Use --force to skip the ADWS port connectivity check.

Collection

Everything is queried over ADWS (port 9389), not LDAP.

* AD CS requires --bloodhound. --all enables --adcs automatically.

Not collected (ADWS / directory data only — unlike SharpHound): logon sessions, local group membership, AdminTo, RDP/PSRemote, CA registry flags (ESC6/11/16), or HTTP enrollment checks (ESC8).

Output formats

Disable defaults with --no-html, --no-json, or --no-grep. Use --all for GPOs, OUs, containers, AD CS (with --bloodhound), and DACL parsing. Use --acl without --all for ACL-only collection on the default object set.

BloodHound example (ACLs + AD CS, all via ADWS):

adwsdomaindump -u 'corp.local\Administrator' -p 'password' dc01.corp.local \
  --all --bloodhound -o ./out

Markdown ACL example (no BloodHound):

adwsdomaindump -u 'corp.local\Administrator' -p 'password' dc01.corp.local \
  --markdown --all -o ./out

More detail (flags, file list, BloodHound/AD CS): wiki.

Full OS Build Numbers (--full-build)

Active Directory only stores the major build in operatingSystemVersion (e.g. 10.0 (14393)). Use --full-build to enrich each computer with the full cumulative-update build number (e.g. 14393.8246) by querying the Remote Registry over SMB.

adwsdomaindump -u 'corp.local\jsmith' -p 'password' dc01.corp.local --full-build

The operatingSystemBuildNumber column (labelled OS Build in HTML/Markdown) will then show values like:

No admin required — HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion grants read access to all Authenticated Users by default. Any standard domain user account can perform this lookup.

Requirements:

• RemoteRegistry service must be running on each target (default on Windows Server; often disabled on workstations)
• SMB port 445 reachable from the scanning host
• Included in HTML, JSON, greppable, and Markdown output — not in the BloodHound export

Hosts where the lookup fails (unreachable, RemoteRegistry stopped) are silently skipped; the operatingSystemBuildNumber column will simply be absent for those entries.

Evasion

Currently tested against:

Credits

This project is a fork/adaptation of ldapdomaindump by Dirk-jan Mollema, converted to use ADWS instead of LDAP.

Original work: Copyright (c) 2017 Dirk-jan Mollema

License

MIT