The demo company

20261001020000_PathwardenDemo.zip is a synthetic SharpHound collection of a fictional enterprise, SCALE.LOCAL, for trying Pathwarden without a domain of your own. No real directory was involved.

10,000 computers (3% servers, 10 domain controllers) and 15,000 users
5 regions with 4 sites each; per site an all-users group, a helpdesk group (local admin on the site's workstations, password resets in its region) and a server admins group
regions are run differently, as in real organizations: two are well run (separate admin accounts, no Domain Admin logons on servers), two are average, one is messy (site users are local admins on their workstations, Domain Admins log on to member servers, the helpdesk can edit the region's GPO, stray rights over server admin groups, weaker collection coverage)
domain-wide: Kerberoastable service accounts (one of them a Domain Admin), unconstrained delegation on a few servers, a DCSync service account, and a GPO that Domain Users control
five AS-REP-roastable accounts (no Kerberos preauthentication): three users with a path to Tier Zero through their site's local admin rights, one user in a well-run region and one service account, neither with a path

About a third of users and computers can reach Tier Zero, almost all of them in the average and messy regions.

The same zip is built into the binary, for the UI's Try the demo, pathwarden demo, and -i demo: on any command. From the repository you can also point at this folder:

PowerShell

pathwarden demo -o demo-report.html
pathwarden posture -i demo:
pathwarden report -i demo -o demo-report.html   # this folder

It is generated by scripts/gen_scale_fixture.py:

PowerShell

python scripts/gen_scale_fixture.py --computers 10000 --users 15000 --regions 5 --sites 4 --out demo-json

Earlier runs. ../demo-history/ holds the same company one to four weeks earlier (--stage 1 to --stage 4; this zip is --stage 5, the default), so the demo has five weekly runs (Sep 3 to Oct 1) that show every kind of change Pathwarden tracks:

Run	What changes
Sep 3	Domain Users is nested into a server admin group by mistake: nearly every account can take over Tier Zero
Sep 10	the nesting is undone; a Domain Admin's logons on member servers are cleaned up (a finding fixed) and a helpdesk's edit right on a GPO is removed: paths gone; a software rollout makes R02's users local admins on their workstations
Sep 17	the rollout reaches R00 too; a Domain Admin's server logons are back after the fix; another admin's finding gains objects; a well-run region isn't collected (completeness drops)
Sep 24	the rollout's admin rights are taken back; a user is added to Domain Admins (a new member of Tier Zero); a new path into the R01 servers zone; the returned logons fixed again
Oct 1	that user and a Kerberoastable service account leave Domain Admins; a different Domain Admin logs on to a server (a new finding); another new path into the zone

Accounts that can take over Tier Zero go 23,224, 11,267, 13,503, 9,022 and 8,975. The zone is R01 servers (the R01S00 to R01S03 server admin groups). The runs live outside this folder so that -i demo reads only the latest.

PowerShell

foreach ($s in 1..4) { python scripts/gen_scale_fixture.py --computers 10000 --users 15000 --regions 5 --sites 4 --stage $s --out demo-json-$s }

The same script builds a forest of any size for load testing, for example 500,000 computers and 750,000 users (1.9 GB, about 30 seconds); see "Large directories" in docs/running.md.