EnumerateAdObjectTree

Build a virtual Active Directory object tree from LDAP, discovering objects that are hidden from normal directory browsing (for example, objects suppressed by listMode ACEs or that live outside the part of the tree you can enumerate directly).

Disclaimer: This project was heavily written with the assistance of AI. It performs read-only LDAP queries and is not intended to modify the directory or have any side effects on the target environment. That said, review the code and test in a non-production environment before running it against any directory you are authorised to assess.

Intent

A plain subtree search only returns what the server is willing to list. This tool goes further: it enumerates what it can, then mines DN-valued attributes (member, memberOf, manager, managedBy, directReports, Exchange delegate links, …) for references to objects it never saw. Each referenced DN becomes a virtual node, which is then probed directly with a base-scope search. Missing parent containers are synthesised so the result is a complete, navigable hierarchy.

Markers in the text output:

Marker	Meaning
[+]	Real object returned by LDAP
[?]	Virtual / inferred node (discovered via a hint)
[X]	Deleted object (tombstone)

How it works

1. Phase 1 – Subtree enumeration of the search base.
2. Phase 1b/1c – Optional tombstone and Global Catalog sweeps.
3. Phase 2 – Direct base-scope probe of every hinted (virtual) DN.
4. Phase 3 – Enumerate groups and harvest member / memberOf DNs (optionally batch-resolved with ASQ).
5. Phase 4 – Optional tokenGroups expansion for nested/cross-trust membership.

Build

cargo build --release

The binary is produced at target/release/EnumerateAdObjectTree.

Windows

Build natively on Windows (with the Rust toolchain installed):

cargo build --release

The binary is produced at target\release\EnumerateAdObjectTree.exe.

To cross-compile a Windows binary from Linux, add the target and build with the MinGW-w64 linker:

rustup target add x86_64-pc-windows-gnu
sudo apt-get install -y mingw-w64        # provides the x86_64-w64-mingw32 linker
cargo build --release --target x86_64-pc-windows-gnu

The resulting executable is at target/x86_64-pc-windows-gnu/release/EnumerateAdObjectTree.exe.

Usage examples

Enumerate a domain using the default naming context from RootDSE:

EnumerateAdObjectTree \
  --server dc01.contoso.com \
  --bind-dn "CN=svc-reader,OU=Service,DC=contoso,DC=com" \
  --password 'S3cret!'

Target a specific base DN, use LDAPS, and write JSON to a file:

EnumerateAdObjectTree \
  --server dc01.contoso.com --ldaps \
  --search-base "OU=Corp,DC=contoso,DC=com" \
  --bind-dn "CN=svc-reader,DC=contoso,DC=com" --password 'S3cret!' \
  --include-attributes --json --output tree.json

Full forest sweep with deleted objects, Global Catalog, ASQ and tokenGroups:

EnumerateAdObjectTree \
  --server dc01.contoso.com \
  --bind-dn "CN=admin,DC=contoso,DC=com" --password 'S3cret!' \
  --show-deleted --gc --use-asq --token-groups --verbose

See all options:

EnumerateAdObjectTree --help

Notes

• Use only against directories you are authorised to assess.
• If --search-base is omitted, defaultNamingContext from RootDSE is used.
• --bind-dn and --password are optional; an anonymous bind is attempted when both are absent (most directories reject this).