joeware - never stop exploring... :)

OK… Finally, at long last, an update for AdFind and AdMod. Lots of updates actually. It isn’t that I haven’t been adding things to them, I just haven’t been publicly releasing so that people update AdFind signatures on virus total that feeds all of the random AV/Ant-malware tools to go incorrectly block it.

The last time I publicly updated AdFind was in October 2023 and the last time I publicly udpated AdMod was also in Octover 2023.

This is V01.64.00 (current) vs V01.62.00 (previous). The changelog block in AdFind.cpp covers the full V01.64.00
  development cycle (2023-10-13 ? 2026-05-09). Here is the consolidated list, grouped by type.

AdFind V01.64.00 — Changes since V01.62.00

  New switches / features

  – -kdsrootkeys — query KDS root keys
  – -csvbreakcount — break CSV output at a row count
  – -onlygroup — new filter switch
  – -whoami — promoted from -sc whoami to a first-class switch
  – -decattid — ATTID decoding (decode attribute IDs)
  – -enccurrentutcgt, -encutcgt — current-time UTC generalized-time encode options
  – -outputcurrentint8 / -outputcurrentgt — output current time as Int8 / generalized time
  – -jwdsinit, -jwdsstd, -jwdsstdro — DirSync convenience modes, with aliases dirsync_init, dirsync_std, dirsyncro_std
  – parentrdn and objrdn — new computed attributes
  – Raw hex SID accepted as DN input; file input support for -dechextosid; hex GUID input added to -encguidtoiid
  – Comment capability added for the env file

  Decode additions / updates

  – K25 RootDSE decodes; began adding 2025 "vNext" / Server 2025 decodes
  – msDS-ObjectModifyMetaData decode (also binary encoded ObjectModifyMetaData), use -alldc
  – msDS-SupportedEncryptionTypes decodes updated
  – dsHeuristics decodes updated, including adminSD output tweaks
  – TLS 1.3 key-exchange decode fixed
  – ldapping / netlogon decodes updated

  Bug fixes

  – Fixed case-sensitivity issue with -e
  – Fixed -incldn + regex interaction
  – Fixed -cva bug
  – Fixed -sslinfo with a specific attribute; blocked -csv from -sslinfo
  – Fixed -gcb + -gco combination; fixed -gui
  – Fixed -dirsyncro to include objectGUID
  – Fixed metafilterval link= bug
  – Fixed SID/GUID DN input bug
  – Fixed getsidtype output for unresolved SIDs
  – Fixed AJ GUID handling
  – Fixed time-encode option error handling
  – Fixed -csvbreakcount follow-up issues
  – rootdseanon could not detect Server 2022 — fixed
  – cmdline.h argument lowercase handling fixed
  – Misc usage-text fixes (-tdcsfmt, DirSync, -nirs)

  Maintenance / build

  – Ported to VS2026
  – Updated -po switch

AdMod V01.29.00 — What’s New

This release rolls up a batch of new functionality and bug fixes that have landed since AdMod V01.28.00.

New Features

Hex SID and hex GUID now accepted as a target DN

AdMod has long let you pipe or pass a SID (S-1-5-…) or a braces-style GUID ({FBB09094-…}) in place of a
distinguished name, and it would automatically rewrite it to the <SID=…> or <GUID=…> form the directory
understands.

That recognition is now smarter. AdMod will also detect:

– Raw hex-encoded SIDs (the 0101…, 0102…, 0104…, 0105… binary SID forms), and
– 32-character hex GUIDs (e.g. 9490b0fb52e0374680b841c6c025950a)

…and convert them to the proper <SID=…> / <GUID=…> DN format on the fly. This makes it much easier to feed AdMod
the output of other tools that emit SIDs and GUIDs in their binary/hex representations without having to reformat them
first.

Clone-on-create: rename a new object via name attribute expansion

When creating objects from CSV input, you can now expand the name attribute and have AdMod reflect that change into
the RDN of the object it creates. This is a nice building block for cloning workflows.

Example — given a source DN of cn=joe,ou=testusers,dc=test,dc=loc with name present in the CSV, an expansion of:

name::{{.}}test

…results in a new object cn=joetest,ou=testusers,dc=test,dc=loc being created. Just remember to also pass and update
sAMAccountName and userPrincipalName so the clone is internally consistent.

Comments in -ef environment/parameter files

Environment files (-ef) now support comments. Any line that starts with # or // is ignored, so you can document and
annotate your parameter files inline instead of keeping notes elsewhere. Properties can still be split across multiple
lines as before.

Guardrail: -b combined with special bases now errors cleanly

Using -b together with a special base switch (-default, -schema, -config, -rootdse, etc.) doesn’t make sense, and
AdMod used to let the combination through. It now detects the conflict and exits with a clear error instead of doing
something unexpected. (This also fixed an underlying bitwise-vs-logical OR bug in the special-base detection.)

Bug Fixes

– -treenuke — Fixed a bug in the recursive tree-delete path involving error-code handling during the nuke operation.
– -e — Fixed search-string suffix handling so the trailing-character logic behaves correctly.
– DNS records + updatenchead — Fixed a bug (reported by Nara) where objects under CN=MicrosoftDNS were incorrectly
caught by the NC-head modify safety check, blocking legitimate DNS record updates.
– -sc adac — Corrected the usage text and fixed a bug in the password-set behavior for the adac shortcut, including
the unicodePwd quoting on object creates.
– Usage / help text — Various corrections, including the <SERVICES> expansion description and create/rename wording.

Is joe dead?

Is he still working on these apps?

Will we ever see new versions of AdFind and AdMod?

The answers are NO (Well, mostly NO), YES, and YES.

I am testing a release candidate for both tools now, if they clear that testing, I will perform the final compile and release to production. I hope to do that by end of March (if not sooner), assuming no issues.

I am so swamped during the week with work I don’t much like working on computers after hours, so my burn rate has gone down significantly for putting out tool updates, plus realistically, MSFT hasn’t really done much with Active Directory since 2016 (other than me bitching at them to update TLS in Windows Server 2022 to allow for TLS 1.3 for LDAPS connections) so now that they finally have some real updates with Windows Server 2025, it is time for some updates to get out there.

I don’t push after every single update I put in but the number of updates doesn’t much exceed what is in this image for the last year. I did quite a bit last August as I was thinking about releasing a version with a lot of Windows Server 2025 updates but then I got really busy for my day job again. While I do get the occasional donations here, it is not anywhere near being able to allow me to have this be my day job. And no, this image isn’t from my public Github account, that is a self-hosted local virtual gitea server that isn’t available outside of my home network, so don’t think holy moly, the AdFind/AdMod source code is available out there somewhere, I am going to out on my h@<k3r hat and go to town!!! Sorry, not sorry, it is not.

    joe