v14.0.0

Added

• One command now scans the domain and renders the branded Client Deliverable Kit. adscan ci --generate-report takes every report option adscan deliver takes (document selection, frameworks, theme, branding, client name and logo, custom cover and back page, outputs) and renders through the same pipeline. A scan whose results stand but whose deliverable did not render exits 4.
• Scan policies decide what a scan does and how hard it works the network, and replace the workspace type. Three ship. Lab / CTF runs every check at the Fast pace, Audit runs attack steps that roll back on their own at the Normal pace, and Production-sensitive sends no password guess and runs nothing that changes the directory, locks an account or makes another system authenticate to the scanner, at the Polite pace. Attack steps are always mapped and the weakness each relies on is always reported, so turning off Kerberoasting never hides the Kerberoastable accounts.
• A policy also sets how close password guessing may go to each lockout threshold, what the scan aims at, whether it follows trusts and opens pivots on its own, cracking effort, online hash lookups, poisoning, bait, whether attack steps run unattended, and what it leaves in the directory. A policy for a real environment cannot widen the scope on its own, plant bait unattended, send a hash online without asking or keep its changes. Save your own, run it with adscan ci --policy, manage it from the host with adscan policy, and policy review-new tells you which checks arrived after you saved it.
• Scan speed has four levels (Fragile, Polite, Normal, Fast), set with --pacing, tunable per setting and savable as a pace profile. The policy caps the speed, and ADscan slows down on its own when a server starts to struggle, leaving one that stops answering alone and recording its remaining checks as not assessed.
• PRO workspaces keep an engagement history that records which findings and attack steps are new, fixed, reopened or not re-checked on every run (adscan engagement status, history, export). adscan recheck re-verifies an earlier scan's findings read-only, with no new scan, and can repeat one attack step or walk one path to see where it now stops.
• Every finding and attack step carries the command that proves it exists and the one that confirms the fix, in PowerShell and a Linux equivalent where one applies, filled in with your domain controller, domain, accounts, template and certificate authority. Passwords and keys are left for you to type.
• Running an attack path shows the plan first, then each step as it starts and settles with its technique and MITRE ID, and a plain cause when a step does not complete. A step-through mode asks before each step, and a path the policy cuts short names the check that would let it be proven.
• Both reports state how many enabled computers the assessment reached and which network segments gave no answer, declaring an unreached computer as not assessed. The connection check can validate trusted domains as well as the origin, each with its own controller lookup, port check, sign-in and account counts.
• ADscan detects AD CS ESC12, a certificate authority whose YubiHSM2 password sits in clear text on the CA host, with two read-only registry reads that never read the password.
• The Endpoint Defense section shows, per host, which kind of product was active, any product installed but not running, the LSA protection and Credential Guard settings, and what the assessment proved there. Tier 0 hosts with no active EDR get a recommendation to deploy one.
• workspace purge-secrets removes the passwords, hashes, keys, tickets and certificates a workspace recovered and keeps its findings, attack paths and history, so a later re-test still compares with it. The removal is recorded with who ran it.
• adscan run --plan plan.json runs a scan, a connection check or a deliverable kit from one reviewable file that names credentials by reference, with a versioned progress stream through --events-file.
• Both reports state which edition of each compliance framework they map against and where a later one is published, and scorecards report verified-clear on attack surfaces the scan enumerated and found nothing abusable on.
• The Enterprise platform adds an Executive Progress Report for the board, a summary after every assessment and an immediate alert when a new route to Tier 0 is executed. The appliance runs on an offline license file checked on the appliance itself and updates without being rebuilt.

Changed

• adscan ci needs a scan policy and runs at its pace. --type and set type change nothing and print the equivalent policy command, and an existing workspace moves to the built-in policy its type stood for. adscan execute is now part of PRO beside adscan ci, every action stays available in adscan start, and the free tier exits with code 42 after the PRO notice so a pipeline never reads a skipped scan as a success.
• When the policy skips something an interactive scan says so at that moment and names the command to turn it back on. Both reports state the policy and pace each assessment ran under, and an excluded check reads as not assessed, never as clean.
• adscan ci and adscan execute keep their workspace by default and --ephemeral deletes it. Logs live inside the workspace with every password, hash, key and ticket masked, and deleting a workspace removes everything it left on the machine, including the per-scan working copies earlier versions left behind.
• Findings are rated by how certain the evidence is. A CVE a probe confirms stays Critical, one inferred from patch level is High and names the update, and configuration findings reach Critical only when an attack relying on them was carried out. ADscan Priority is the score the scan computed on every surface, never a CVSS figure, and routes that stop on a Tier 0 account without reaching the domain have their own reach class, Tier 0 control.
• Reverting ADscan's directory changes is a policy setting, on in Audit. An unattended run removes what it created and reads each object back, trying a cleanup-only account your team provides first, and the report names who removed each change. Audit runs the steps only a cleanup account can undo only when one is supplied and confirmed as an administrator.
• ADscan never resets the password of krbtgt, a managed service account or an Entra ID sync account, and every password change sits in one policy family, off in Audit and Production-sensitive. An unattended audit never copies a certificate authority's key, and certificates the assessment obtains are revoked at the end and the revocation confirmed.
• An attack path that uses a logged-on session shows each step on its own and acts with the rights of the account that holds the access. What it writes is decided from the session user's group memberships, so only a domain administrator's session leads to a temporary account, and any other session is proven with one read-only command. Sessions now include users signed in at the console or over Remote Desktop.
• Checks are classified by what they touch. Zerologon runs under Production-sensitive, PrintNightmare and Drop the MIC 2 are read from the host's configuration and update level, Drop the MIC tests its flaw within the lockout budget, the pre-Windows 2000 computer check counts as a password guess, and ADSCAN_PORTSCAN_NMAP_TIMING caps nmap at -T4. Patch-level CVE checks read installed updates with administrator access whenever ADscan holds it.
• A network interface is no longer asked for at start. An unattended run poisons on each adapter with a known domain host behind it, coerced authentications are captured on every segment, each directed to the address that reaches that target, and set listener-ip declares the callback address when it sits on none of your interfaces.
• Compliance sections declare only the DORA and NIS2 requirements an identity assessment can evidence, describe ISO 27001 controls in ADscan's own words, cover two more ENS Anexo II measures and cite each requirement the way an auditor writes it. Anti-malware is never conformant while an antivirus is installed and not running, audit-policy controls are decided only from observed evidence, and no control reads as both verified and never tested. Conformance percentages move.
• The trust matrix states what each trust is (its kind, transitivity, SID filtering, selective authentication and ticket forwarding), with both sides shown where they differ.
• Offline mode turns AI off, and no provider, local or remote, is contacted.

Fixed

• Attack-path diagrams in the report draw an account or host that a route reaches through a session and then takes over as one box, from Access to Compromised, with the step between them under its own proof status. A stage is filled only when a step ADscan executed reached it; otherwise it is dashed and marked mapped, and a directory relationship leaving it draws as mapped. Long routes now wrap row by row, left to right.
• Scans stay inside the agreed engagement scope. A step acting on a domain outside it, a host another domain owns, or a SQL linked server outside the scope is mapped and reported as not executed. A route that compromises an in-scope domain and continues into an excluded one now counts only up to the in-scope domain, as validated end to end when it was, and the domain it would reach next appears in a separate "Reach beyond your scope" block, outside every in-scope figure. Unattended scans no longer stop to ask which trusted domains to include.
• Scans hold back any sign-in that would bring an account to its lockout threshold. ADscan counts every sign-in it sends with a password, hash or key over Kerberos, LDAP, SMB, WinRM, MSSQL and RDP, keeps the reserve your policy sets, and in a real environment reads each domain account's live failed sign-in count before using it. A rejected or empty password is never sent, and fine-grained password policies are honoured when spraying.
• Every policy switch holds whichever path reaches the technique. Password resets, shadow credentials, group changes and replication reached through GenericAll or Owns, connection probes, pivots, local credential reuse, share mapping, sprays, and passwords read from descriptions or Group Policy files each follow their own check, and a blocked step reads as excluded, never as attempted. When an operator decides each step, silence approves nothing and a timed-out approval reads "awaiting approval".
• A scan that mapped routes to domain compromise without running them no longer reports that the domain held. The recap, the Security Assessment Report and the free report give the same counts of routes declined, excluded or awaiting approval, and a scan whose collection or path search does not complete says the assessment is incomplete, with adscan ci exiting 3. That includes a collection cut off because a domain controller stopped answering, and a SQL Server collection Kerberos refused for clock skew: each reads as incomplete and names what it could not read, so a linked server it could not reach is never presented as absent.
• Every change ADscan makes to your directory is listed as what it is, passes the same consent rule as a password reset, and, when it could not be undone, says why and who acts next. Owner restores work and read the value back, a password reset is skipped when the account's credential is already held, and the ESC9/ESC10 cleanup removes only the key credential ADscan added.
• No recovered password, hash or key is written into the attack graph or the technical report, so none reaches a client deliverable, and the account ADscan creates for itself is never listed as a compromised credential. Secrets passed to a scan never reach the log outside a workspace, and the start_auth password prompt hides what you type.
• Figures agree across both reports. The ordinary-account figure counts the Tier 2 accounts on every page, recovered-password counts say which accounts they cover, and the coverage figures count as executed only the 68 techniques ADscan runs. Eight techniques carry a corrected ATT&CK mapping.
• Start Here lists only changes a client can make, each naming its object, and keeps the containment of credential material the assessment took apart from the exposure fixes. Remediation leads with the change that closes the technique, commands print on their own with no comment lines or internal placeholders, and accounts read the way an operator writes them, so "KHAL.DROGO@ESSOS.LOCAL" reads "khal.drogo". It no longer asks you to revoke the permissions Account Operators and the Exchange security groups hold by default, or to enable Credential Guard on a domain controller. Account Operators' default control reads as one action, keeping the group empty, and the Exchange permission inherited from the domain root points to the Exchange cumulative update and Setup /PrepareAD.
• Attack paths no longer count a session on a computer as control of it. The attack-surface map shows where each route ends, a Backup Operators chain names the domain controller it acts on, a multi-domain forest ends each route in the listed domain, and the same scan gives the same routes on every run.
• ESC6, ESC11 and Certighost are checked once ADscan holds a credential that administers the CA host, and each AD CS technique has its own name. Managed service accounts are no longer reported as Kerberoastable or AS-REP roastable.
• A credential captured off the network is filed under the domain it belongs to, and a password leaked in a directory attribute that opens another account is reported as that working credential.
• ADscan puts the host clock back to real time when a scan ends, even when it fails or is stopped. A run stopped by a signal exits with that signal's status, deliver --output writes to your folder instead of inside the container, --terminal-relations confines execution as well as the listing, and ADscan PRO no longer shows the PRO upsell.
• The Enterprise platform shows the report's own figures and verdicts, and closes an item only when the check that observes it ran again, otherwise reading "Not re-checked in the latest scan".
• A step left unrun behind another step's operator decision now reads "depends on a step awaiting approval" or "depends on a step the operator chose not to run" in both reports, as it already did on the console, and a route awaiting approval says whether the request went unanswered in time or no operator was present.
• The Security Assessment Report names the account behind a password left in a description and says when the scan policy kept the value from being tried, names the Tier 1 accounts beside the ordinary-account figure, picks its "most proven fix" card by what the scan actually executed, and files a forest root as a domain rather than an account.
• When the AD Password Hygiene Report is not produced, the console says why and names any credential the run recovered, and the unauthenticated summary counts AS-REP roastable accounts from every source that answered.
• White-label kits now carry only your brand when the install holds the white-label entitlement. Before, deliver --branding whitelabel could not read that entitlement and rendered co-branded without saying so. Every document in the kit is covered, the MITRE ATT&CK Navigator files included, and a white-label request on an install without the entitlement now prints a warning.

Removed

• --keep-workspace is gone from adscan ci, adscan execute and adscan doctor since keeping the workspace is the default. A command that still passes it stops and says to drop it or use --ephemeral.
• NetExec is no longer bundled, so the images are smaller and adscan install and adscan check no longer list it. Every technique already ran on ADscan's own stack. The session reverse-shell command stays on development builds only.