ADReaper

Go-based LDAP enumeration utility for Active Directory. Its documented commands query domain controllers, trusts, users, computers, groups, SPNs, Group Policy Objects, OUs, MS-SQL service objects, AS-REP pre-authentication-disabled accounts, unconstrained-delegation objects, and objects matching adminCount=1. In v1.1, never-loggedon filters users whose lastLogonTimestamp is zero or absent; that is not proof the user has never logged on because this attribute is not updated on every logon. admin-priv filters adminCount=1, which may remain set after an account leaves a protected group and is not proof of current privilege. SPN and AS-REP commands query directory attributes only; they do not request or crack Kerberos tickets.