Install ADscan LITE, run your first scan, and choose the right path for labs vs real internal AD engagements.

Welcome to ADscan. This section gets you from “fresh box” to “first useful output” fast—without losing an hour to setup, copy/paste, and tool orchestration.

Authorization Required

ADscan is a powerful security tool. Only use it on systems you have explicit written authorization to test. Unauthorized use is illegal and unethical.

Installation Steps

Follow these steps in order to get ADscan running:

1. System Requirements

Verify your system meets the requirements

What is ADscan?

ADscan is a professional Active Directory security scanner with an interactive CLI that automates:

Enumeration: Discover users, computers, groups, and domain controllers
Credential Attacks: AS-REP roasting, Kerberoasting, credential spraying
Post-Exploitation: DCSync, SAM/LSA dumping, DPAPI extraction
Attack-Path Analysis: Native graph collector with BloodHound-compatible JSON export
Reporting: Organized workspace data for reporting and analysis

Key Features

Interactive CLI

Professional command-line interface with autocomplete, command history, and contextual help.

Two Operation Modes

Semi-automatic (auto=False) - Prompts before risky operations (production)
Automatic (auto=True) - Fast enumeration with minimal prompts (labs/CTFs)

Workspace Isolation

Each target domain gets its own workspace with isolated credentials, scan output, and attack-path graphs.

ADscan ships a native LDAP-based graph collector that materialises attack paths directly inside the container. The output is written as a BloodHound-compatible attack_graph.json per workspace — bring your own BloodHound CE instance if you want the graph UI, or read paths straight from the ADscan CLI with attack_paths.

Supported platforms

ADscan is Linux-first and also runs on macOS through Docker Desktop, on both amd64 and arm64 (Apple Silicon included). The full matrix — CI-verified distributions, the two amd64-only bundled tools, and the one networking caveat on macOS — is on the System Requirements page.

You need Docker Engine, the ability to use it without sudo, and 15 GB free.

Quick Installation

If you're ready to install right now:

# Install via pipx (recommended)
pipx install adscan

# Pull the ADscan image
adscan install

# Start ADscan
adscan start

ADscan does not require running every command under sudo. If your user cannot access the Docker daemon, fix that once (add user to docker group) instead of running everything as root.

For detailed installation instructions, see the Installation Guide.

Where to go after the first scan

Everyone starts with System Requirements, Installation and Quick Start. After that:

Practising AD attacks — take a lab walkthrough end to end, starting with HTB Forest.
Running a client engagement — read Best Practices before you scan anything, then keep the Command Reference open.
Working under strict rules of engagement — Scanning Commands documents which phases are noisy and how to keep the footprint down.

Stuck? Troubleshooting, then Discord or a GitHub issue.

Running 2+ internal AD engagements a year? Request PRO beta access — use it on a real engagement, validate the reporting workflow, send feedback. Beta access is free.

Getting Started