Python3 implementation of an improved ADRecon for Pentesters and Blue Teams.

ADRecon is a tool which gathers information about MS Active Directory and generates an XSLX report to provide a holistic picture of the current state of the target AD environment.

Tip

If you are a Red Team, may check out ADRecon-ADWS instead.

Table of Contents

• Installation
• Usage
• Docker
• Collection Modules
• HTML Dashboard
• Acknowledgements
• License

Installation

# stable release from pypi
pipx install pyadrecon
# latest commit from github
pipx install git+https://github.com/l4rm4nd/PyADRecon

Then verify installation:

pyadrecon --version

Tip

For Windows, may read this. NTLM + Kerberos supported.

Usage

usage: pyadrecon.py [-h] [--version] [--generate-excel-fromCSV_DIR] [-dcDOMAIN_CONTROLLER] [-uUSERNAME] [-p [PASSWORD]] [-dDOMAIN] [--auth {ntlm,kerberos}] [--tgt-fileTGT_FILE] [--tgt-base64TGT_BASE64]
[--ssl] [--portPORT] [-oOUTPUT] [--page-sizePAGE_SIZE] [--threadsTHREADS] [--dormant-daysDORMANT_DAYS] [--password-agePASSWORD_AGE] [--only-enabled] [--collectCOLLECT]
[--no-excel] [-v]
PyADRecon-PythonActiveDirectoryReconnaissanceTooloptions:
-h, --helpshowthishelpmessageandexit--versionshowprogram'sversionnumberandexit--generate-excel-fromCSV_DIRGenerateExcelreportfromCSVdirectory (standalonemode, noADconnectionneeded)
--generate-dashboard-fromCSV_DIRGenerateHTMLdashboardfromexistingCSVfiles (standalonemode)
-dc, --domain-controllerDOMAIN_CONTROLLERDomainControllerIPorhostname-u, --usernameUSERNAMEUsernameforauthentication-p, --password [PASSWORD]
Passwordforauthentication (optionalifusingTGT)
-d, --domainDOMAINDomainname (e.g., DOMAIN.LOCAL) -RequiredforKerberosauth--auth {ntlm,kerberos}
Authenticationmethod (default: ntlm)
--tgt-fileTGT_FILEPathtoKerberosTGTccachefile (forKerberosauth)
--tgt-base64TGT_BASE64Base64-encodedKerberosTGTccache (forKerberosauth)
--sslForceSSL/TLS (LDAPS). NoLDAPfallbackallowed.
--portPORTLDAPport (default: 389, use636forLDAPS)
-o, --outputOUTPUTOutputdirectory (default: PyADRecon-Report-<timestamp>)
--page-sizePAGE_SIZELDAPpagesize (default: 500)
--dormant-daysDORMANT_DAYSDaysfordormantaccountthreshold (default: 90)
--password-agePASSWORD_AGEDaysforpasswordagethreshold (default: 180)
--only-enabledOnlycollectenabledobjects--collectCOLLECTComma-separatedmodulestocollect (default: all)
--workstationWORKSTATIONExplicitlyspoofworkstationnameforNTLMauthentication (default: emptystring, bypassesuserWorkstationsrestrictions) --no-excelSkipExcelreportgeneration--no-dashboardSkipinteractiveHTMLdashboardgeneration-v, --verboseVerboseoutputExamples:
# Basic usage with NTLM authenticationpyadrecon.py-dc192.168.1.1-uadmin-ppassword123-dDOMAIN.LOCAL# With Kerberos authentication (bypasses channel binding)pyadrecon.py-dcdc01.domain.local-uadmin-ppassword123-dDOMAIN.LOCAL--authkerberos# With Kerberos using TGT from file (bypasses channel binding)pyadrecon.py-dcdc01.domain.local-uadmin-dDOMAIN.LOCAL--authkerberos--tgt-file/tmp/admin.ccache# With Kerberos using TGT from base64 string (bypasses channel binding)pyadrecon.py-dcdc01.domain.local-uadmin-dDOMAIN.LOCAL--authkerberos--tgt-base64BQQAAAw...
# Only collect specific modulespyadrecon.py-dc192.168.1.1-uadmin-ppass-dDOMAIN.LOCAL--collectusers,groups,computers# Output to specific directorypyadrecon.py-dc192.168.1.1-uadmin-ppass-dDOMAIN.LOCAL-o/tmp/adrecon_output# Generate Excel report from existing CSV files (standalone mode)pyadrecon.py--generate-excel-from/path/to/CSV-Files-oreport.xlsx

Tip

PyADRecon always tries LDAPS on TCP/636 first.

If flag --ssl is not used, LDAP on TCP/389 may be tried as fallback.

Warning

If LDAP channel binding is enabled, this script will fail with automatic bind not successful - strongerAuthRequired, as ldap3 does not support it (see here). You must use Kerberos authentication instead.

If you use Kerberos auth under Linux, please create a valid /etc/krb5.conf and DC hostname entry in /etc/hosts. May read this. If you are on Windows, please make sure you have valid Kerberos tickets. May read this. Note that you can provide an already existing TGT ticket to the script via --tgt-file or --tgt-base64. For example, obtained by Netexec via netexec smb <TARGET> <ARGS> --generate-tgt <FILEMAME>.

Docker

There is also a Docker image available on GHCR.IO.

docker run --rm -v /etc/krb5.conf:/etc/krb5.conf:ro -v /etc/hosts:/etc/hosts:ro -v ./:/tmp/pyadrecon_output ghcr.io/l4rm4nd/pyadrecon:latest -dc dc01.domain.local -u admin -p password123 -d DOMAIN.LOCAL -o /tmp/pyadrecon_output

Collection Modules

As default, PyADRecon runs all collection modules. They are referenced to as default or all.

Though, you can freely select your own collection of modules to run:

Icon	Meaning
🛑	Requires administrative domain privileges (e.g. Domain Admins)
✅	Requires regular domain privileges (e.g. Authenticated Users)
💥	New collection modul in beta state. Results may be incorrect.

Forest & Domain

• forest ✅
• domain ✅
• trusts ✅
• sites ✅
• subnets ✅
• schema or schemahistory ✅

Domain Controllers

• dcs or domaincontrollers ✅

Users & Groups

• users ✅
• userspns ✅
• groups ✅
• groupmembers ✅
• protectedgroups ✅💥
• krbtgt ✅
• asreproastable ✅
• kerberoastable ✅

Computers & Printers

• computers ✅
• computerspns ✅
• printers ✅

OUs & Group Policy

• ous ✅
• gpos ✅
• gplinks ✅

Passwords & Credentials

• passwordpolicy ✅
• fgpp or finegrainedpasswordpolicy 🛑
• laps 🛑
• bitlocker 🛑💥

Managed Service Accounts

• gmsa or groupmanagedserviceaccounts ✅💥
• dmsa or delegatedmanagedserviceaccounts ✅💥
  • Only works for Windows Server 2025+ AD schema

Certificates

• adcs or certificates ✅💥
  • Detects ESC1, ESC2, ESC3, ESC4 and ESC9

DNS

• dnszones ✅
• dnsrecords ✅

HTML Dashboard

PyADRecon automatically generates an HTML dashboard containing key statistics and security findings when all collection modules are executed.

If needed, you can disable dashboard creation during initial data collection using --no-dashboard. The dashboard can later be generated from existing CSV files with --generate-dashboard-from <CSV_DIR>.

Caution

This is a beta feature. Displayed data may be falsely parsed or reported as issue. Take it with a grain of salt!

Details

Acknowledgements

Many thanks to the following folks:

• S3cur3Th1sSh1t for a first Claude draft of this Python3 port
• Sense-of-Security for the original ADRecon script in PowerShell
• cannatag for the awesome ldap3 Python client
• Forta for the awesome impacket suite
• Anthropic for Claude LLMs

License

PyADRecon is released under the MIT License.

The following third-party libraries are used:

Library	License
ldap3	LGPL v3
openpyxl	MIT
gssapi	MIT
impacket	Apache 2.0
winkerberos	Apache 2.0

Please refer to the respective licenses of these libraries when using or redistributing this software.