adPEAS

Comprehensive Active Directory security assessment — zero dependencies, single file, ready to go.

adPEAS is a PowerShell-based security assessment tool that identifies misconfigurations, vulnerabilities, and privilege escalation paths in Active Directory environments. It is designed for penetration testers, security auditors, and red teams who need a reliable, self-contained tool that works on any Windows system — no RSAT, no ActiveDirectory module, no third-party dependencies.

adPEAS v2 is a complete rewrite of adPEAS v1. It replaces the legacy DirectoryEntry/DirectorySearcher approach with a unified System.DirectoryServices.Protocols.LdapConnection architecture and adds native Kerberos authentication, advanced reporting, and offensive operations — all in pure PowerShell.

• Native Kerberos stack — AS-REQ/AS-REP, TGS-REQ/TGS-REP, Pass-the-Ticket, PKINIT, all in pure PowerShell
• Multiple auth methods — Password, NT-Hash (OPtH), AES keys (PtK), Certificates (PKINIT & Pass-the-Cert/Schannel), Windows integrated
• 40+ security checks across 9 categories with severity scoring
• Interactive HTML reports with search, filtering, risk scores, and tooltips
• JSON export for offline report conversion, incremental scanning, and scan comparison
• BloodHound CE collector — built-in data collection for attack path analysis
• Offensive operations — Kerberoasting, AS-REP Roasting, Golden/Silver/Diamond Tickets, RBCD abuse, Shadow Credentials, and more
• Session-based workflow — connect once, run multiple checks interactively
• Tab-completion — autocomplete AD object names for interactive exploration

New to adPEAS? Check the Quick-Start Guide or read the blog series on blog.sekurity.de for a deep dive into architecture, authentication, and internals.

• OS: Windows 10/11, Windows Server 2016/2019/2022/2025
• PowerShell: 5.1+ (Windows PowerShell)
• .NET Framework: 4.5+ (included in Windows)
• Network: LDAP (389), LDAPS (636), Kerberos (88), SMB (445)

No ActiveDirectory module, RSAT, or external PowerShell modules required.

All four versions are functionally identical. Choose based on your deployment scenario.

# Clone the repository
git clone https://github.com/61106960/adPEAS.git
cd adPEAS

The main branch always carries a current build of all four variants, rebuilt with every fix and feature, so the raw URLs above serve the newest code. Those builds carry a development version string (2.5.1+20260917-1759). Every tagged GitHub Release has the four stable builds attached as downloadable assets, with a clean version string (2.5.1) — use those if you need a known, citable version. To build from source yourself:

git clone https://github.com/61106960/adPEAS.git
cd adPEAS
.\Build-Release.ps1

This produces all four variants (adPEAS.ps1, adPEAS_min.ps1, adPEAS_ultra.ps1, adPEAS_obf.ps1) in the repository root. Requires Windows PowerShell 5.1 and no additional dependencies.

# Option 1: Import as module (recommended)
Import-Module .\adPEAS.ps1

# Option 2: Dot-sourcing
. .\adPEAS.ps1

# Option 3: Read and execute in memory
Get-Content -Raw .\adPEAS.ps1 | Invoke-Expression

# Option 4: Load directly from GitHub into memory (no file on disk).
# Both variants work; on an older/hardened host that still defaults to TLS 1.0,
# prepend once: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# 4a: WebClient - shortest. DownloadString detects and strips the file's UTF-8 BOM
#     itself, so nothing extra is needed. WebClient is a legacy API but works everywhere.
Invoke-Expression (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/61106960/adPEAS/main/adPEAS_obf.ps1')

# 4b: Invoke-WebRequest - the modern cmdlet. Its .Content keeps the BOM as a leading
#     U+FEFF that Invoke-Expression cannot parse, so TrimStart removes it first.
Invoke-Expression ((Invoke-WebRequest -Uri "https://raw.githubusercontent.com/61106960/adPEAS/main/adPEAS_obf.ps1" -UseBasicParsing).Content.TrimStart([char]0xFEFF))

# Domain-joined machine (current user)
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth

# With credentials
Invoke-adPEAS -Domain "contoso.com" -Username "john.doe" -Password "P@ssw0rd!"

# OPSEC mode (skip Kerberoast, ASREPRoast, BloodHound)
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -OPSEC

# Connect once
Connect-adPEAS -Domain "contoso.com" -UseWindowsAuth

# Run full scan
Invoke-adPEAS

# Or run individual checks
Get-KerberoastableAccounts
Get-ADCSVulnerabilities
Get-DangerousACLs

# Disconnect when done
Disconnect-adPEAS

# Credentials
Connect-adPEAS -Domain "contoso.com" -Credential (Get-Credential)

# Overpass-the-Hash (NT-Hash)
Connect-adPEAS -Domain "contoso.com" -Username "admin" -NTHash "32ED87BDB5FDC5E9CBA88547376818D4"

# Pass-the-Key (AES256)
Connect-adPEAS -Domain "contoso.com" -Username "admin" -AES256Key "4a3b2c1d5e6f..."

# PKINIT (Certificate)
Connect-adPEAS -Domain "contoso.com" -Certificate "user.pfx"

# Pass-the-Cert / Schannel (LDAPS, no Kerberos)
Connect-adPEAS -Domain "contoso.com" -Certificate "user.pfx" -PassTheCert

# LDAPS
Connect-adPEAS -Domain "contoso.com" -UseWindowsAuth -UseLDAPS

# All formats (default) — creates .txt, .html, and .json
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -Outputfile .\report

# HTML only
Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -Outputfile .\report -Format HTML

# Offline report conversion from JSON
Convert-adPEASReport -InputJson ".\report.json" -OutputPath ".\new_report"

# Compare two scans (diff report)
Compare-adPEASReport -Baseline ".\scan_q1.json" -Current ".\scan_q2.json" -OutputPath ".\diff"

Run specific modules:

Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -Module Domain,Creds,ADCS

Or run everything except a few, without listing the rest:

Invoke-adPEAS -Domain "contoso.com" -UseWindowsAuth -ExcludeModule Bloodhound,Computer

Full documentation is available in the docs/ directory:

A detailed blog series covering adPEAS v2 internals is published at blog.sekurity.de.

adPEAS is source-available. Internal security assessments of your own organization are free. Commercial use (consulting, MSP, paid engagements) requires a commercial license.

See LICENSE for full terms, COMMERCIAL_AGREEMENT for the commercial agreement, and PRICING for licensing options.

• Licensing Inquiries: license@sekurity.gmbh
• Technical Support: support@sekurity.gmbh

adPEAS is intended for authorized security testing only. Always obtain written authorization before testing. Never use against systems you do not own or have permission to test. The authors are not responsible for misuse of this tool. Comply with all applicable laws and regulations.

Alexander Sturz — SEKurity GmbH

• GitHub: @61106960
• Blog: blog.sekurity.de