Supported platforms, privileges, and networking expectations before running ADscan.

ADscan is Linux-first. Use this checklist to make sure your jump box, lab VM, or CI runner matches what the installer expects.

Supported platforms

Component	Requirement
Operating system	64-bit Linux (recommended) or macOS with Docker Desktop, on x86_64/amd64 or arm64/aarch64 (Apple Silicon, AWS Graviton, arm64 servers). CI-verified on the Linux versions listed below. See the macOS note for a networking caveat.
Docker	Docker Engine (`docker`).
Privileges	Ability to run Docker (root or in the `docker` group).
Python	3.8+ (only used for the launcher; ADscan runs in a container by default).
Storage	≥15 GB free (ADscan container image + workspace data + Docker layers).
Memory / CPU	Minimum 4 GB RAM / 2 vCPU. Recommended 8 GB RAM / 4 vCPU for large engagements.
Network	Internet access for image pulls and Layer 3/4 reachability to the target AD environment.

Architecture support (amd64 and arm64)

ADscan LITE runtime images are published as a multi-arch manifest, so docker pull selects the right build automatically for your host — x86_64/amd64 or arm64/aarch64. This covers Apple Silicon Macs running an arm64 Linux VM (Kali, Ubuntu, Debian), AWS Graviton, and other arm64 Linux hosts.

A small number of bundled offensive tools ship only as amd64 binaries and are not present on arm64 images:

hashcat — GPU/CPU password cracking. On arm64, cracking uses John the Ripper (bundled and compiled natively for arm64).
donut — the in-memory shellcode-loader stage of the post-exploitation pipeline. The rest of post-exploitation is unaffected.

For workflows that depend on those two tools, use an amd64 host.

macOS (Docker Desktop)

ADscan runs on macOS (Apple Silicon and Intel) through Docker Desktop. Docker Desktop runs every container inside a Linux VM rather than on the Mac's own network stack, so ADscan uses bridge/NAT networking there instead of host networking. This has one practical consequence:

Routed scanning works normally. Authenticated and unauthenticated enumeration against a reachable AD target (LDAP, Kerberos, SMB) runs over Docker's NAT.
Broadcast poisoning is unavailable. LLMNR, NBT-NS, and mDNS poisoning need Layer-2 access to the local network, which Docker Desktop does not provide. Run ADscan on a Linux host or Linux VM if you need it.

ADscan prints this caveat once at launch on macOS.

CI-verified Linux versions

ADscan is tested continuously on:

Debian 11, 12
Ubuntu 22.04 LTS, 24.04 LTS
Parrot OS 6.1, 6.3, 7.0
Kali Linux 2024.3, 2025.1, 2025.2, 2025.3, 2025.4

Not supported (yet)

Windows (native launcher runtime commands are Linux-only)
WSL / WSL2 (Docker-mode launcher runtime is blocked by default; use a native Linux VM/host)
Kali Linux ≤ 2024.2 (older baselines often cause issues; not recommended)
Arch-based distributions (Arch, Manjaro, Garuda, etc.)
RPM-based distributions (Fedora, RHEL, CentOS, Rocky/AlmaLinux, etc.)

Recommended baseline: Kali Linux 2025.4 or Ubuntu 24.04 LTS, 30 GB of disk, and Docker installed.

What gets stored where?

Workspaces live under ~/.adscan/workspaces (host).
Docker images are stored under Docker’s storage directory (commonly /var/lib/docker).
Attack-path graphs (BloodHound-compatible JSON) are written inside each workspace under domains/<domain>/attack_graph.json. To explore them visually, point your own BloodHound CE instance at that file.

Validate your environment

# Verify launcher version and dependency health
adscan --version
adscan check

# Confirm Docker availability
docker info

Legacy installer note

The legacy host-based installer exists for environments where Docker is not allowed:

adscan install --legacy
adscan check --legacy --fix

Legacy mode requires many more host dependencies (apt, Python toolchains, Go/Rust, etc.) and is not recommended unless you must.

Persistence & networking tips

Keep enough free disk and back up before rotating runners.
Allow outbound SMB/LDAP/RPC to the target domain plus HTTPS to container registries and release mirrors.

Meeting these baselines prevents surprise installer failures and unlocks the full ADscan LITE/PRO workflow.

🧩 System Requirements