Collecting Active Directory data

Pathwarden reads your directory and writes BloodHound CE data that every analysis command loads.

Before you start

• Only collect from domains you are authorized to assess. Store the collection like credentials.
• Use a computer that reaches a domain controller on TCP 389 or 636, and 88. A Full collection also needs TCP 445 to every computer.
• Use an ordinary domain account, never a Domain Admin. For local groups without local admin rights, set up a collector account.

Collect

In the app, follow Collect from Active Directory.

On the command line

pathwarden collect --domain scale.local --output C:\Temp\collect --save

--save analyzes and saves the run, as the app does. Use an empty --output folder each time. pathwarden collect --help lists every option.

Quick (--scope dc-only, the default) reads the directory in minutes. Full (--scope all) also reads sessions and local groups from every computer; it takes longer and EDR may flag it. Without it, paths through logged-on admins and local admin rights are missing.

Signing in

• Your Windows account works on a domain-joined computer and for a gMSA. With the built-in collector it is Quick only.
• A user and password (--user, with --ldaps) works on Linux and for a built-in Full collection. The password comes from PATHWARDEN_COLLECT_PASSWORD or a prompt.
• Name the domain controller by its full name (`--server dc01.contoso.local`, or Domain controller on the Collect page), not an IP address. Results are only trustworthy then: without it DNS picks the domain controller, and a spoofed one could return a clean directory and mark findings fixed. The run warns when it wasn't named. The full name also makes the LDAPS certificate match.

Signing in to computers

The built-in collector signs in to computers with Kerberos only and Require SMB signing. A computer that can't do both is skipped and counts as not collected. Leave both on: NTLM sign-ins can be relayed. Kerberos needs this computer's clock within 5 minutes of the domain's. --allow-ntlm and --allow-unsigned-smb turn them off.

What each method collects

A computer that wasn't read counts as not collected, and findings that depend on it are Can't tell. For ESC9 and ESC10, see Tier Zero settings.

Trusted domains

For paths that cross trusts, collect the trusted domains in the same run: tick them under Trusted domains on Where, or give --domain again. A domain that fails is skipped.

Run it on a schedule

See Run on a schedule. On Windows the task runs as a gMSA; on Linux, as a dedicated user with the password in a systemd credential, never in the unit or a script.

When something goes wrong