ADscan 11.0.0

Added

• generate_report writes a free exposure report from your own scan, as a self-contained HTML file and as a paginated A4 PDF. It leads with the finding load, the paths to full domain compromise, and the techniques carrying the most paths. An audit-mode scan writes it without being asked. Compliance mapping, per-finding remediation and your own branding stay in PRO.
• ADscan executes AD CS ESC5 end to end: backing up the certification authority's private key, forging a certificate offline, and authenticating with it. It runs from the CA host's own machine account as well as from a recovered local-administrator password, and reports the copied key and the forged certificate as items only a CA key rotation can remediate.
• The report cover carries your client's logo beside the ADscan mark, in the free report and the paid one. Give adscan deliver --client-logo or adscan ci --client-logo a PNG, SVG or JPG, or pick one interactively; it is embedded in the document and reused on later runs. The platform offers the same choice when you create a scan.
• Both reports open the remediation plan with what the proven compromise obliges: reset krbtgt twice with replication completing in between, rotate the accounts whose secrets were recovered, revoke the certificate your CA issued during testing. The block appears only where the engagement reached those outcomes.
• Executing a collapsed attack path lets you choose which of the interchangeable accounts to target: several at once for a roast or a spray, one for a step that succeeds outright. An unattended run picks the strongest candidate without pausing.
• writeup saves the mechanical two thirds of a lab writeup while the evidence is still on disk: the ports, the directory contents, the chain as an editable mermaid diagram, every step with its outcome, timestamp and credential provenance, the flags, the dead ends. The analysis it is judged on is left as marked placeholders. Lab and CTF scans write it on their own; nothing is uploaded.
• Service accounts carrying an HTTP SPN are flagged as a Kerberos web-application relay and coercion surface, with native remediation guidance in the report and the platform.
• COVERAGE.md lists every Active Directory technique ADscan implements, each mapped to MITRE ATT&CK and marked as executed, detected, or declined for safety. It is generated from the product catalog, so it cannot drift from the tool.
• The Enterprise platform plots exposure across a workspace's scans and compares any two, listing the findings and attack paths that appeared, closed, or carried over.
• The optional end-of-session question now names the channels people actually arrive through and takes a free-text answer; a later session asks what kind of work you do. One question per session, and none on an unattended or air-gapped run.

Changed

• Attack paths identical except for which account sits in the middle collapse into one finding that names and counts the interchangeable accounts. A 774-host audit produced a 200-page report dominated by fifty near-duplicate rows that were one decision. A cracked account keeps its proven status inside the collapsed row.
• Attack-path steps that already ran can be executed again from the step selector, labelled with their previous outcome and behind a confirmation that defaults to No. Reviewing which steps are runnable no longer prompts for an account on every step, and an unattended run never re-executes a proven step.
• Attack-path computation on large environments is much faster and finds the same paths. On a simulated 8,000-user domain, the step that works out who each path affects went from about 225 seconds to under two.
• The share credential hunt and the attack-path discovery phase show live progress. Both can run for hours behind nothing but an elapsed counter, which made the tool look frozen. Unattended runs print plain lines instead of a panel.
• The free exposure report is redrawn on the same design as the paid one, so it reads as the same product rather than a dashboard export. Its headline is labelled "Posture score" with "higher is safer" beside it, and attack-path steps lead with the plain-language technique and the object involved instead of a raw permission token.
• The certificate-authority key-theft technique is called AD CS ESC5 (Vulnerable PKI Object Access Control) throughout the CLI, the reports and the platform, replacing the older "GoldenCert" label.
• The Scan complete panel says what deliver will ask you and what it costs before you run it, and stays quiet after a scan that collected nothing.

Fixed

• The free report records the findings behind the attack paths it prints. A free scan of a domain with exploitable certificate templates, noPac, PrintNightmare or readable LAPS recorded none of them, so the cover read 0 critical beside paths exploited to full domain compromise. A proven step is also no longer dropped when its target was named by IP where the graph knew it by name, which could leave a chain ADscan had walked end to end reporting no attack paths at all.
• Findings name the objects they affect: the accounts, the hosts by name and address, the shares and files, the certificate templates and the issuing authority. Twenty-nine of them, among them noPac, shadow credentials and the LAPS coverage gap, named the domain instead. Both tiers resolve assets through one implementation, so they cannot disagree.
• A step granted through a group is executed by an account that is actually in that group, or not at all. ADscan had been falling back to whichever credential it captured first, and for local-admin, RDP, WinRM and SQL steps an unrelated account's own access to the host would make the step pass — so the report claimed the group grants access where nothing of the kind had been tested. A step whose source account you do not control is now locked, with the reason.
• Several findings that were never real are gone. krbtgt's stock description read as a leaked password on every domain, and the remediation would have invalidated every Kerberos ticket in the domain. ESC13 was raised wherever a template carried an issuance policy, even with no group linked to it and so nothing to abuse. Group Managed Service Accounts were listed as roasting targets although their passwords are machine-managed. And text that merely resembles a password was called a confirmed disclosure before anything had tried it.
• A control the scan found clean is no longer also reported as an open weakness. An SMBv1 audit printing "No SMBv1 exposure detected" still produced a confirmed finding that travelled the whole deliverable; the obsolete-OS, stale-account and LDAP-signing audits had the same fault. A weakness two checks observe is reported once, at the higher severity, and all three documents state the same total.
• Directory replication is recorded as proof on the one permission it actually used. Marking every principal holding replication rights as having performed it turned one event into several and credited steps to accounts no credential was ever used for. That permission is still reported, as identified from configuration rather than demonstrated.
• An attack avenue closed by your own configuration is no longer also billed as a confirmed critical finding, and its path is view-only rather than offered for execution. One document credited the hardening in its attack-path section and charged for it twice in its findings list.
• The counts in a report reconcile with its own legend. The executive headline counted avenues the configuration already closes and routes ADscan had no surface to walk, reading 25 paths where 14 were actionable; chains with steps run against the live environment were filed under configuration analysis; and a domain reached over a trust and never enumerated was counted as scope, which now reads "1 assessed · 2 discovered". The end-of-scan panel quotes the report's figures instead of counting graph permutations.
• The compliance annexes carry the evidence the assessment produced and score it the way the rest of the report does. Seventeen findings reached no NIS2, DORA or ENS control, so all three printed "No major non-conformities identified" in a document that proved domain compromise on the same pages, and ten findings including all nine criticals carried one score in the findings and another in the annex. A score is called CVSS only where a published Base vector exists to recompute it from.
• The AD Control Coverage Report has something to attest after a credentialled scan: clean results were discarded rather than recorded, so it arrived empty on the most common engagement shape. It also lists the controls it found weak, and is left out of the kit when there is nothing to attest.
• A host that answers on one network interface and not another is reached on the one that works, chosen by probing the port the connection will use. A server advertising an internal-only address alongside a routable one could be reported offline and its attack path abandoned, on roughly one run in three. This covers the SQL Server chain through to SYSTEM.
• Recovered credentials are filed under the account and host they belong to. A machine account from an LSA dump was stored under the domain controller's name, a gMSA secret under the registry key naming the service, and a legacy LAPS password under the computer name, where it failed its own logon check and was discarded. A local credential is no longer handed to the next step as the domain account of the same name.
• A credential that cannot be verified is kept and reported as unverified rather than discarded as wrong, and every technique that reached an account is recorded with the Kerberos key material it carries. The first route used to claim the account and the rest were dropped, so on a domain enforcing AES the pass-the-key routes quietly stopped being available.
• An expired Kerberos ticket no longer kills an attack step. Every authenticated channel checks the ticket before it connects and re-mints it for the same account; a ticket whose privilege lives in the ticket itself is used exactly as issued.
• Switching domains could destroy a workspace's stored credentials: loading a domain's point-in-time snapshot emptied the credential store, and the next routine save wrote that empty store over the workspace file, losing every password, hash and ticket captured for the engagement.
• Session recordings uploaded to ADscan can no longer carry your client's domain name, a domain controller's hostname, your certificate authority's common name, IPv6 addresses, or key material split across a terminal line wrap. Recordings only leave your machine when telemetry is enabled, which is the default on the free and PRO tiers only.
• Leaving telemetry on no longer slows a scan: events were sent on the thread doing the work and waited for a reply, piling into minutes on a large environment, and now go in the background. set telemetry off is per-workspace again, set telemetry off global sets the operator-wide default, and adscan start accepts --no-telemetry and --offline. What is sent, and the scrubbing applied before it leaves your machine, are unchanged.
• Neither report issues an all-clear it cannot support. A workspace's first run reported that nothing had been changed on runs that created machine accounts, modified certificate templates and reset passwords. Where the record of those changes cannot be read, both documents now say so.
• A certificate your CA issues while ADscan proves an ADCS path is disclosed with its serial, request id, template, CA and expiry, and a native certutil procedure to revoke it — printed at the page's full width, since a 40-character serial broken across lines produced a failed revoke and a certificate that keeps authenticating as a domain administrator. Directory changes are named in plain English rather than internal identifiers.
• The remediation ranking decides what a client can actually change, per group membership and per permission holder rather than per technique. Built-in nesting that cannot be removed is excluded, routes the configuration already closes or that were never assessed no longer inflate a fix's count — 21 paths claimed where 12 are open — and priorities read "Certificate Mapping Abuse (ADCS ESC9)" instead of "Adcsesc9".
• The paid deliverable no longer prints internal engineering notes in the client's PDF, and the line about deliberately not executing a step to spare a production host is reserved for the steps ADscan genuinely refuses on safety grounds. Everything else states that it was identified from configuration and not exercised.
• The Privilege Blast Radius table matches the tier glossary six pages earlier, where DnsAdmins had been listed under "Tier 2: Standard" and Domain Admins under "Tier 0: Escalation-capable". The reports also render in the product's own typefaces and carry the ADscan mark on the cover, the ATT&CK matrix fits its page, the kill-chain page has no column of empty boxes, and the free report's PDF prints to the edge of the sheet.
• writeup builds its chain from the steps the run actually proved, in the order a reader follows them, keeps the failure history on a step that eventually worked, records what was changed in the directory from the rollback ledger, and runs on a workspace that has a scan but no report. Both reports and writeup recompute attack paths the same way, so one workspace always produces the same document.
• Reaching SYSTEM through MSSQL on a domain controller continues into a coupled DCSync step, so the path ends at domain compromise rather than at a foothold; on a member server it does not. MSSQL discovery also seeds targets from MSSQLSvc service accounts and from hosts a pivot confirmed listening, so an instance on a filtered port is attempted rather than skipped.
• adscan check --fix is accepted instead of rejected by the host command, adscan check reports the memory actually free and stops a run below 1 GB unless you pass --allow-low-memory, adscan update closes with an outcome instead of silence and upgrades a launcher installed with uv tool install, and --partner-tag activates PRO from the command line. adscan execute gained the read-only users verb and suggests the closest verb when you mistype one.
• adscan ci reports the scope it scanned and exits when domain discovery finds no controllers, instead of rescanning the same range indefinitely. Ctrl+C is reported as a partial scan listing what was captured; a domain scanned twice in one workspace stays initialized; the host range offered for discovery comes from your DC or your own interface rather than a fixed 10.10.10.0/24; and a lab scan that meets its objective early is recorded as finished rather than offering to resume.
• Clearer output on a normal run. SMB collection collapses per-host access-denied errors into one line on large estates, a forest without the LAPS schema extension is asked once rather than on every object, the certificate-authority check reports "not permitted" instead of an error when the account lacks CA rights, and a password crack that hits its time limit names the cap it stopped at instead of reporting that it recovered nothing. File paths in panels and under --debug point at ~/.adscan on your own machine rather than the container's /opt/adscan.

Removed

• The domain command group — domain select, domain create, domain delete, domain show — is gone. The verb was already disabled in the shell, nothing else reached it, and its selection path was the one that could destroy a workspace's credentials. Workspace and domain context is set by workspace select and by the scan flow.