windapsearch

# Python version — no PyPI package; clone the repo
git clone https://github.com/ropnop/windapsearch.git && cd windapsearch
pip install python-ldap

# Go version (faster)
# https://github.com/ropnop/go-windapsearch/releases

windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u '[email protected]' -p 'password'

windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -U
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -U --full

windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -G

windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -C

windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --da        # Domain Admins
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --admin-objects  # Objects with protected ACLs
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -PU         # Privileged users

windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --unconstrained-users
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --unconstrained-computers

windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --custom "(servicePrincipalName=*)"

windapsearch --dc-ip DC_IP -d DOMAIN.LOCAL

./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u '[email protected]' -p 'pass' -m users
./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u '[email protected]' -p 'pass' -m computers
./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u '[email protected]' -p 'pass' -m groups
./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u '[email protected]' -p 'pass' -m privileged-users