# Adfind

> Use for focused Active Directory object enumeration during authorized pentests. Trigger on approved user, group, computer, and trust review, LDAP-backed metadata collection, and validating domain assumptions with low-impact queries.

- Skill: `timsonner/adfind` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/adfind`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/adfind/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/adfind

---


# AdFind

## Purpose

Use this skill for low-impact AD object discovery when the engagement needs a fast LDAP-backed view of specific domain metadata.

## Phase Fit

- Primary: Discovery and Reconnaissance, Threat Modeling and Test Planning
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need focused queries for users, groups, computers, SPNs, or trusts.
- Need a lightweight alternative to broader collection frameworks.
- Need a repeatable AD metadata retest.

## Avoid When

- Domain scope or query boundaries are unclear.
- Broad LDAP harvesting would exceed the approved objective.

## Inputs

- Approved domain and host context
- Narrow query goal and attribute set
- Output handling requirements

## Procedure

1. Start with the narrowest filter that answers the question.
2. Collect only the attributes needed for the current hypothesis.
3. Correlate results with other AD evidence before escalation.
4. Preserve the exact filter and output set for retest.
5. Treat output as discovery context unless tied to material risk.

## Command Syntax

Replace sample filters with approved in-scope queries.

```cmd
:: List all domain users
AdFind.exe -f "(objectClass=user)" sAMAccountName userPrincipalName

:: List all domain computers
AdFind.exe -f "(objectClass=computer)" cn operatingSystem

:: List domain controllers
AdFind.exe -sc dclist

:: List members of Domain Admins
AdFind.exe -f "(&(objectClass=user)(memberof=CN=Domain Admins,CN=Users,DC=contoso,DC=com))"

:: List all GPOs
AdFind.exe -f "(objectClass=groupPolicyContainer)" displayName gPCFileSysPath

:: Enumerate domain trusts
AdFind.exe -f "(objectClass=trustedDomain)"

:: Dump all attributes for a specific account
AdFind.exe -f "(sAMAccountName=administrator)"
```

## Evidence to Capture

- Domain metadata relevant to the current hypothesis
- Exact filters and attributes used
- Why the returned objects materially affect the assessment

## Safety Boundaries

- Keep filters narrow and approved.
- Avoid broad directory harvesting beyond the phase objective.