Auditing Active Directory: How ADRecon Turns Complex Artifacts Into Clear Excel Reports

Security professionals and system administrators face a massive challenge when auditing Active Directory environments. ADRecon, a powerful PowerShell tool, streamlines this process by extracting critical artifacts and generating comprehensive Microsoft Excel reports.

This tool is designed specifically for auditors, DFIR (Digital Forensics and Incident Response) teams, and penetration testers. By compiling raw data into formatted Excel summary views, it enables teams to quickly analyze metrics and understand the current security posture of a target environment.

Traditionally, gathering this data required multiple disparate scripts and manual compilation. ADRecon centralizes the extraction using Microsoft Remote Server Administration Tools (RSAT) or LDAP, allowing execution even from non-domain member hosts using standard user accounts.

The tool gathers an extensive list of environment details to provide a holistic picture of the network. Features include, but are not limited to: Forest, Domain, Trusts, Sites, Subnets, SchemaHistory, PasswordPolicy, FineGrainedPasswordPolicy, DomainControllers, Users, UserSPNs, PasswordAttributes, Groups, GroupChanges, GroupMembers, OUs, ACLs, GPOs, gPLinks, GPOReport, DNSZones, DNSRecords, Printers, Computers, ComputerSPNs, LAPS, BitLocker, Kerberoast, and DomainAccountsusedforServiceLogon.

Before deploying the tool, ensure the host system meets the necessary dependencies. The script requires.NET Framework 3.0 or later and PowerShell 2.0 or later, with full support for PowerShell Core on Windows 10.

Additionally, Microsoft Excel must be installed to generate the final reports. Users should also install RSAT, specifically the Active Directory Domain Services and Lightweight Directory Services Tools, alongside the Group Policy Management Tools.

To begin, clone the repository using git, or download the latest release archive.

git clone https://github.com/adrecon/ADRecon.git

To run the tool locally on a domain member host, execute the basic script.

.\ADRecon.ps1

To run the tool as a different user on a domain member host, specify the domain controller and credentials.

.\ADRecon.ps1 -DomainController <IP or FQDN> -Credential <domain\username>

For non-member hosts, you can force the tool to communicate via LDAP.

.\ADRecon.ps1 -Method LDAP -DomainController <IP or FQDN> -Credential <domain\username>

If you only need specific modules, use the Collect parameter to limit the scope.

.\ADRecon.ps1 -Method ADWS -DomainController <IP or FQDN> -Credential <domain\username> -Collect Domain, DomainControllers

If you ran the tool on a machine without Excel, you can generate the report later from the raw CSV files.

.\ADRecon.ps1 -GenExcel C:\ADRecon-Report-<timestamp>

The development team plans to introduce several major upgrades to the repo. Upcoming features include replacing the directory search mechanism to support LDAP STARTTLS and LDAPS on TCP port 636.

Other planned additions include Domain Trust Enumeration, options to filter default ACLs, and gathering ACLs for specific users and groups. The team also aims to integrate the EPPlus library, which will completely remove the dependency on Microsoft Excel for report generation.

The reliance on Microsoft Excel for security reporting might seem outdated to some, but it remains the universal language for compliance and auditing teams. By formatting raw LDAP queries into pivot-ready spreadsheets, ADRecon bridges the gap between technical penetration testers and non-technical risk assessors.

However, the current requirement to have Excel installed on the execution host is a notable operational bottleneck. The planned shift to the EPPlus library will be a critical upgrade, allowing incident responders to generate these reports on headless servers or restricted jump boxes without triggering software compliance alerts.