<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Directory Service Security — API Reference

## Active Directory PowerShell

```powershell
# Domain controller inventory
Get-ADDomainController -Filter * |
  Select-Object Name, IPv4Address, OperatingSystem, OperatingSystemVersion, Site

# Forest and domain functional levels
Get-ADForest | Select-Object ForestMode, RootDomain
Get-ADDomain | Select-Object DomainMode, DNSRoot, InfrastructureMaster

# LDAP signing configuration
Get-ItemProperty "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" -Name "LDAPServerIntegrity"

# LDAP channel binding
Get-ItemProperty "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" -Name "LdapEnforceChannelBinding"

# Unconstrained delegation
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation
Get-ADUser -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation

# Kerberoastable accounts
Get-ADUser -Filter {ServicePrincipalName -like '*'} -Properties ServicePrincipalName, PasswordLastSet

# AdminSDHolder protected accounts
Get-ADUser -Filter {AdminCount -eq 1} -Properties AdminCount, MemberOf

# NTLM compatibility level
Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel"
```

## AD CS (Certificate Services)

```powershell
# List certificate templates
certutil -v -dstemplate

# Find vulnerable templates (ESC1)
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)" `
  -Filter {objectClass -eq 'pKICertificateTemplate'} `
  -Properties msPKI-Certificate-Name-Flag, pKIExtendedKeyUsage

# Certipy scan (Python tool)
# certipy find -u user@domain -p password -dc-ip DC_IP -vulnerable
```

## Assessment Tools

```bash
# PingCastle
PingCastle.exe --healthcheck --server domain.local

# Purple Knight
# Run from domain-joined machine — generates HTML report

# BloodHound collection
SharpHound.exe -c All --domain domain.local
```

## Key Checks

| Check | Method | Expected |
|-------|--------|----------|
| LDAP signing | Registry query | Value = 2 |
| Channel binding | Registry query | Value = 2 |
| NTLM restriction | LmCompatibilityLevel | Value = 5 |
| Unconstrained delegation | AD query | DCs only |
| Kerberoastable accounts | SPN + password age | < 365 days, 25+ chars |
| AD CS ESC1 | Template audit | No enrollee-supplies-subject with client auth |
