> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# windapsearch

> windapsearch: lightweight LDAP enumeration of Active Directory users, groups, computers, and privileges.

## Install

```bash theme={"dark"}
# Python version — no PyPI package; clone the repo
git clone https://github.com/ropnop/windapsearch.git && cd windapsearch
pip install python-ldap

# Go version (faster)
# https://github.com/ropnop/go-windapsearch/releases
```

***

## Basic Usage

```bash theme={"dark"}
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user@domain.local' -p 'password'
```

***

## Enumerate Users

```bash theme={"dark"}
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -U
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -U --full
```

***

## Enumerate Groups

```bash theme={"dark"}
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -G
```

***

## Enumerate Computers

```bash theme={"dark"}
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -C
```

***

## Privileged Users

```bash theme={"dark"}
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --da        # Domain Admins
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --admin-objects  # Objects with protected ACLs
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' -PU         # Privileged users
```

***

## Unconstrained Delegation

```bash theme={"dark"}
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --unconstrained-users
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --unconstrained-computers
```

***

## Custom LDAP Filter

```bash theme={"dark"}
windapsearch -d DOMAIN.LOCAL --dc-ip DC_IP -u 'user' -p 'pass' --custom "(servicePrincipalName=*)"
```

***

## Anonymous Bind

```bash theme={"dark"}
windapsearch --dc-ip DC_IP -d DOMAIN.LOCAL
```

***

## Go Version (go-windapsearch)

```bash theme={"dark"}
./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u 'user@domain.local' -p 'pass' -m users
./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u 'user@domain.local' -p 'pass' -m computers
./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u 'user@domain.local' -p 'pass' -m groups
./windapsearch -d DOMAIN.LOCAL --dc DC_IP -u 'user@domain.local' -p 'pass' -m privileged-users
```

***

## Quick Reference

| Task          | Flag                                                                           |
| ------------- | ------------------------------------------------------------------------------ |
| Users         | `-U`                                                                           |
| Groups        | `-G`                                                                           |
| Computers     | `-C`                                                                           |
| Domain Admins | `--da`                                                                         |
| Privileged    | `-PU`                                                                          |
| Unconstrained | `--unconstrained-users` / `--unconstrained-computers` (Go: `-m unconstrained`) |