Active Directory · Open source · v1.5.2
Follow the relationship.
Keep the evidence.
Illustrative route: svc-build, workstation-07, delegation, Tier-0. Scroll to explore the graph, then follow Collect, Graph, Validate, and Report. This is a presentation, not a live assessment.
One fictional route. Follow its relationships, inspect what is known, and carry the same context into a report.
The same selected object and evidence state, carried forward. Change the model above and this illustrative record changes with it.
Return to the Observatory ↑This is a presentation model, not captured output, a validation receipt, or an exact export schema.
Consult the public ledger for evidence, tested environments, and outstanding validation.
Read the validation ledger ↗Version 1.5.2 refines the work around an assessment: quieter scripting, versioned report data, print-ready HTML, and build provenance. The changelog also records correctness fixes and dependency hardening.
--quiet suppresses decorative progress; --no-color supports plain output. Warnings and errors remain.schema_version field for downstream consumers.--version includes version, commit, and build date when available; -V stays short.These are documented release changes, not a new live-validation claim. The validation ledger remains authoritative; partial and unvalidated paths retain their stated limits.
Windows, Linux, and macOS assets are listed on GitHub with SHA-256 sidecars. The v1.5.2 CLI is also available on crates.io, verified unyanked on September 20, 2026. Choose a prebuilt download or install the pinned registry version below.
Historical ADhammer 1.3.3 measurements, with tool versions, transport differences, and raw logs. These results do not establish current-release performance.
Process spawn to exit on the published Windows Server 2025 testbed. Python tools ran through the documented WSL/SOCKS path; that caveat and the pending current-release refresh are part of the record.
| Scenario | ADhammer | Comparison | Result |
|---|
Explore ESC1–ESC16 through configuration, evidence, and defensive checks. Select a class for its explanation and an ADhammer example where a focused check is verified.
Scroll over the circle · swipe sideways · or select a class
Inspect the condition, then review the evidence and check below.
Explanation & command ↓ESC1 concerns identity control in certificate templates. Risk depends on configuration, permissions, and the service accepting the certificate.
Illustrative review sequence / ESC1 / not a running test
adhammer check adcs --url ldaps://dc.example.test:636 --user auditor@example.test --password "@file:./audit-password.txt" --jsonv1.5.2 source-checked syntax · documentation placeholders, not ready-to-run targets. Replace hosts, account, and CA name only within your approved scope. Protect the password file. These examples contact real services when run; this page never executes commands or accepts credentials.
Approved LDAP collection scope, a trusted LDAPS certificate, and appropriate directory-read permissions.
Collects directory data, extracts certificate templates, and emits template-analysis findings as JSON.
Review the affected template and its configuration evidence, then confirm permissions and approval controls separately.
Constrain requester-controlled identity fields and restrict enrollment.
No complete ACL walk, CA registry audit, or active enrollment. Empty output does not establish a secure environment.
Configuration signals ≠ proven exploitation. Missing reads, incomplete scope, and patch differences can change the interpretation. ESC1–ESC16 is this guide’s scope, not an exhaustive taxonomy or a support score. Examples were not executed against a live domain for this site.
Choose the question first. See what the command reads, what it returns, and what it cannot prove.
Separate connectivity problems from assessment results before collecting directory data.
adhammer doctor --domain example.test --dc dc.example.test --timeout 3 --jsonAdd --quiet --no-color to suppress decorative progress and request plain output. Warnings and errors remain; CLICOLOR_FORCE=1 can still override the color setting.
adhammer --quiet --no-color doctor --domain example.test --dc dc.example.test --timeout 3 --jsonThe global --fast flag opts into native-speed mode. Its environment equivalent is ADHAMMER_FAST=1. It reduces selected delays and timeouts—not every command’s runtime.
adhammer --fast <command>enum net --deep service-probe timeouts. The basic network sweep retains its fixed timeouts in v1.5.2.doctor or template checks. Target-protection controls, such as lockout safeguards, remain unchanged.Inspect the network command’s options without running a scan: adhammer --fast enum net --help. The syntax above is a pattern, not a ready-to-run command. Read the speed-mode implementation ↗
These examples were checked against v1.5.2 source, not executed against a live domain. Run only within written authorization. Replace example.test placeholders; protect password files and collected output. The website never executes commands. Check the validation ledger ↗
ADhammer composes published standalone icedracon crates into one Rust engine. Each layer remains independently inspectable and reusable outside the binary.
Directory objects, ACLs, ACEs, and security descriptor parsing.
windows-sddl docs ↗Microsoft RPC interfaces and transport primitives.
dcerpc docs ↗Ticket and authentication workflows, with support tracked in the ledger.
Kerberos crate docs ↗NTLMSSP authentication, message integrity, and session security.
ntlmssp docs ↗Authenticated transport and protocol serialization.
Export directory objects and relationships for further analysis.
Export crate docs ↗
AD//HAMMERone composed engineThe implementation follows Microsoft protocol structures.
Possible and proven remain different objects.
Graph, technique, command, and artifact stay linked.
Open source, MIT licensed, and composed from standalone crates.
Open source / MIT / GitHub v1.5.2
Choose a v1.5.2 GitHub download for your platform. Verify its checksum and review command help and the validation ledger before an assessment.
Prefer Cargo? crates.io v1.5.2 is available. Install with cargo install --locked adhammer@1.5.2. Registry availability checked September 20, 2026.