-
Notifications
You must be signed in to change notification settings - Fork 242
Open
Description
As it turns out, SharpHound does not collect CN=Deleted Objects.
Manually, it can be viewed using ldapsearch:
ldapsearch -H ldap://<DC_IP> \
-x -D "user@domain.local" -w '<PASSWORD>' \
-b "CN=Deleted Objects,DC=domain,DC=local" \
-E 1.2.840.113556.1.4.417 \
"(sAMAccountName=*)" '*'NOTE: LDAP_SERVER_SHOW_DELETED OID - 1.2.840.113556.1.4.417 is required.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels