How do I install the Adfind skill?

Run npx skillmds@latest add timsonner/adfind in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Adfind safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Adfind?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Adfind free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Adfind?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Adfind by timsonner — Agent Skill

Name: Adfind
Author: timsonner

Adfind

Use for focused Active Directory object enumeration during authorized pentests. Trigger on approved user, group, computer, and trust review, LDAP-backed metadata collection, and validating domain assumptions with low-impact queries.

timsonner 6ad49e8 2.3 KB Updated Sep 17, 2026

File contents

AdFind

Purpose

Use this skill for low-impact AD object discovery when the engagement needs a fast LDAP-backed view of specific domain metadata.

Phase Fit

Primary: Discovery and Reconnaissance, Threat Modeling and Test Planning
Secondary: Vulnerability Analysis, Retest and Closure

Use When

Need focused queries for users, groups, computers, SPNs, or trusts.
Need a lightweight alternative to broader collection frameworks.
Need a repeatable AD metadata retest.

Avoid When

Domain scope or query boundaries are unclear.
Broad LDAP harvesting would exceed the approved objective.

Inputs

Approved domain and host context
Narrow query goal and attribute set
Output handling requirements

Procedure

Start with the narrowest filter that answers the question.
Collect only the attributes needed for the current hypothesis.
Correlate results with other AD evidence before escalation.
Preserve the exact filter and output set for retest.
Treat output as discovery context unless tied to material risk.

Command Syntax

Replace sample filters with approved in-scope queries.

:: List all domain users
AdFind.exe -f "(objectClass=user)" sAMAccountName userPrincipalName

:: List all domain computers
AdFind.exe -f "(objectClass=computer)" cn operatingSystem

:: List domain controllers
AdFind.exe -sc dclist

:: List members of Domain Admins
AdFind.exe -f "(&(objectClass=user)(memberof=CN=Domain Admins,CN=Users,DC=contoso,DC=com))"

:: List all GPOs
AdFind.exe -f "(objectClass=groupPolicyContainer)" displayName gPCFileSysPath

:: Enumerate domain trusts
AdFind.exe -f "(objectClass=trustedDomain)"

:: Dump all attributes for a specific account
AdFind.exe -f "(sAMAccountName=administrator)"

Evidence to Capture

Domain metadata relevant to the current hypothesis
Exact filters and attributes used
Why the returned objects materially affect the assessment

Safety Boundaries

Keep filters narrow and approved.
Avoid broad directory harvesting beyond the phase objective.

---name: adfinddescription: Use for focused Active Directory object enumeration during authorized pentests. Trigger on approved user, group, computer, and trust review, LDAP-backed metadata collection, and validating domain assumptions with low-impact queries.license: MIT---# AdFind## PurposeUse this skill for low-impact AD object discovery when the engagement needs a fast LDAP-backed view of specific domain metadata.## Phase Fit- Primary: Discovery and Reconnaissance, Threat Modeling and Test Planning- Secondary: Vulnerability Analysis, Retest and Closure## Use When- Need focused queries for users, groups, computers, SPNs, or trusts.- Need a lightweight alternative to broader collection frameworks.- Need a repeatable AD metadata retest.## Avoid When- Domain scope or query boundaries are unclear.- Broad LDAP harvesting would exceed the approved objective.## Inputs- Approved domain and host context- Narrow query goal and attribute set- Output handling requirements## Procedure1. Start with the narrowest filter that answers the question.2. Collect only the attributes needed for the current hypothesis.3. Correlate results with other AD evidence before escalation.4. Preserve the exact filter and output set for retest.5. Treat output as discovery context unless tied to material risk.## Command SyntaxReplace sample filters with approved in-scope queries.```cmd:: List all domain usersAdFind.exe -f "(objectClass=user)" sAMAccountName userPrincipalName:: List all domain computersAdFind.exe -f "(objectClass=computer)" cn operatingSystem:: List domain controllersAdFind.exe -sc dclist:: List members of Domain AdminsAdFind.exe -f "(&(objectClass=user)(memberof=CN=Domain Admins,CN=Users,DC=contoso,DC=com))":: List all GPOsAdFind.exe -f "(objectClass=groupPolicyContainer)" displayName gPCFileSysPath:: Enumerate domain trustsAdFind.exe -f "(objectClass=trustedDomain)":: Dump all attributes for a specific accountAdFind.exe -f "(sAMAccountName=administrator)"```## Evidence to Capture- Domain metadata relevant to the current hypothesis- Exact filters and attributes used- Why the returned objects materially affect the assessment## Safety Boundaries- Keep filters narrow and approved.- Avoid broad directory harvesting beyond the phase objective.

Frequently asked questions