WARNING - This repo is under active development. APIs are subject to change, and it is not considered stable for production.
A powerful, cross-platform CLI tool for managing Active Directory environments. Built with Go for performance and reliability.
- Installation
- Quick Start
- Global Options
- Commands
- Examples
- Configuration
- Output Formats
- Troubleshooting
git clone https://github.com/igolden/adctl.git
cd adctl
go build -o bin/adctlDownload the latest release from the releases page.
-
Initialize Configuration
adctl init
-
Test Connection
adctl user list --limit 5
-
Get Help
adctl --help adctl user --help
All commands support these global options:
--output, -o: Output format (table, json, csv)--metadata: Include metadata in output--dry-run: Show what would be done without making changes (where applicable)--save-report: Save command as a report with given name
# List all users
adctl user list
# List users with filters
adctl user list --filter "name=john*"
adctl user list --filter "department=IT"
# Limit results
adctl user list --limit 10
# JSON output with metadata
adctl user list --output json --metadata# Find specific user
adctl user find jdoe
# Find with limit
adctl user find jdoe --limit 5
# Save as report
adctl user find jdoe --save-report "daily-user-check"# Get direct group memberships
adctl user get-memberships jdoe
# Get all transitive memberships (recursive)
adctl user get-memberships jdoe --recursive
# Save membership report
adctl user get-memberships jdoe --save-report "jdoe-groups"# Copy all group memberships from one user to another
adctl user copy-memberships jdoe jsmith
# Dry-run to see what would be copied
adctl user copy-memberships jdoe jsmith --dry-run
# With JSON output
adctl user copy-memberships jdoe jsmith --output json# Add user to group
adctl user add-to-group "Finance Staff" jdoe
# Dry-run to see what would happen
adctl user add-to-group "Finance Staff" jdoe --dry-run
# With metadata
adctl user add-to-group "Finance Staff" jdoe --metadata# Remove user from group
adctl user remove-from-group "Temp Contractors" jdoe
# Dry-run to see what would happen
adctl user remove-from-group "Temp Contractors" jdoe --dry-run# Enable user account
adctl user enable jdoe
# Disable user account
adctl user disable jdoe
# Dry-run to see current state
adctl user enable jdoe --dry-run
adctl user disable jdoe --dry-run
# With detailed output
adctl user enable jdoe --output json --metadata# List all groups
adctl group list
# List groups with filters
adctl group list --filter "name=Admin*"
adctl group list --filter "description=*Security*"
# Limit results
adctl group list --limit 20
# JSON output
adctl group list --output json# Find specific group
adctl group find "Domain Admins"
# Find with limit
adctl group find "Finance*" --limit 10
# Save as report
adctl group find "Security*" --save-report "security-groups"# Get direct group members
adctl group get-members "Finance Staff"
# Get all nested members recursively (users only)
adctl group get-members "Domain Admins" --recursive
# Save member report
adctl group get-members "IT Staff" --save-report "it-members"
# JSON output with metadata
adctl group get-members "Executives" --output json --metadata# Copy all members from one group to another
adctl group copy-members "Source Group" "Target Group"
# Dry-run to see what would be copied
adctl group copy-members "Finance Staff" "Backup Finance" --dry-run
# With detailed output
adctl group copy-members "IT Staff" "IT Backup" --output json --metadata# List all OUs
adctl ou list
# List OUs with filters
adctl ou list --filter "name=Engineering*"
# Limit results
adctl ou list --limit 15
# JSON output
adctl ou list --output json# Find specific OU
adctl ou find "Engineering"
# Find with limit
adctl ou find "Sales*" --limit 5
# Save as report
adctl ou find "Disabled*" --save-report "disabled-ous"# Interactive setup
adctl init
# View current configuration
adctl config get
# Set specific configuration values
adctl config set domain corp.local
adctl config set server dc1.corp.local
adctl config set output json# List saved reports
adctl report list
# Run saved report
adctl report run "daily-user-check"
# Delete saved report
adctl report delete "old-report"# Check for new users created today
adctl user list --filter "whenCreated>=$(date -d 'today' +%Y%m%d)000000.0Z"
# List all disabled users
adctl user list --filter "userAccountControl=514"
# Find empty groups
adctl group list --filter "member=*" --output json | jq '.[] | select(.memberCount == 0)'
# Get all members of Domain Admins
adctl group get-members "Domain Admins" --recursive --output json# Copy group memberships from template user to new employee
adctl user copy-memberships template-user new-employee --dry-run
adctl user copy-memberships template-user new-employee
# Bulk add users to group by copying from another group
adctl group copy-members "Finance Staff" "Finance Backup" --dry-run
adctl group copy-members "Finance Staff" "Finance Backup"
# Disable multiple users (using shell loop)
for user in user1 user2 user3; do
adctl user disable $user --dry-run
done# List all users with admin privileges
adctl user get-memberships admin-user --recursive --output json
# Check group membership for compliance
adctl group get-members "Privileged Access" --recursive --save-report "privileged-audit"
# Generate user access report
adctl user get-memberships jdoe --recursive --output csv --save-report "jdoe-access"Configuration is stored in ~/.adctl/config.yml:
domain: corp.local
dc_host_url: ldap://dc1.corp.local
ldap_port: 389
ldap_tls_option: "none"
base_dn: "DC=corp,DC=local"
bind_username: "administrator"
bind_password: "encrypted_password"
default_output: "table"You can override configuration with environment variables:
ADCTL_DOMAINADCTL_DC_HOST_URLADCTL_LDAP_PORTADCTL_LDAP_TLS_OPTIONADCTL_BASE_DNADCTL_BIND_USERNAMEADCTL_BIND_PASSWORDADCTL_DEFAULT_OUTPUT
Clean, human-readable table format suitable for terminal viewing.
Structured JSON output perfect for scripting and integration:
adctl user find jdoe --output json | jq '.username'Comma-separated values for spreadsheet import:
adctl group list --output csv > groups.csvInclude additional information about the query:
adctl user list --metadata --output json-
Connection Failed
# Check configuration adctl config get # Test with verbose output adctl user list --limit 1 --metadata
-
Authentication Issues
# Reinitialize configuration adctl init # Check credentials adctl config get
-
Permission Denied
- Ensure the bind user has sufficient privileges
- Check Active Directory permissions
- Verify group memberships of the service account
-
No Results Found
# Check if objects exist adctl user list --limit 1 # Verify search filters adctl user list --filter "name=*" --limit 5
Enable debug logging by setting the environment variable:
export ADCTL_DEBUG=true
adctl user find jdoe# General help
adctl --help
# Command-specific help
adctl user --help
adctl group get-members --help
# Subcommand help
adctl user copy-memberships --help- Fork the repository
- Create a feature branch
- Make your changes
- Add tests
- Submit a pull request
MIT License - see LICENSE file for details.
- GitHub Issues: Report bugs and request features
- Documentation: Wiki
- Discussions: Community Forum