adldd - AD Explorer to ldapdomaindump converter

Convert Sysinternals AD Explorer .dat snapshots to ldapdomaindump format.

This enables offline analysis of Active Directory data captured with AD Explorer using the full ldapdomaindump ecosystem (ldd2bloodhound, ldd2pretty, and custom scripts that consume the JSON files).

Output files

File	Content
domain_users.json/html/grep	User accounts
domain_computers.json/html/grep	Computer accounts
domain_groups.json/html/grep	Groups
domain_policy.json/html/grep	Domain policy (lockout, pwd)
domain_trusts.json/html/grep	Domain trusts
domain_users_by_group.html	Users sorted by group
domain_computers_by_os.html	Computers sorted by OS

JSON files use the same schema as ldapdomaindump ({"dn": "...", "attributes": {...}}), so downstream tools work without modification.

Requirements

• Python >= 3.12
• ADExplorerSnapshot.py (and its dependencies: bloodhound-ce, dissect.cstruct, rich, etc.)

Installation

pip install -r requirements.txt

Or install the dependency directly:

pip install git+https://github.com/c3c/ADExplorerSnapshot.py

Usage

python -m adldd <snapshot.dat> -o <output_dir>

Options

positional arguments:
  snapshot              Path to the AD Explorer .dat snapshot file.

options:
  -o, --outdir DIR      Output directory (default: current directory).
  --no-html             Disable HTML output.
  --no-json             Disable JSON output.
  --no-grep             Disable greppable output.
  -v, --verbose         Enable debug logging.
  --version             Show version and exit.

Examples

Convert a snapshot, writing all formats to ./output:

python -m adldd dc01.dat -o ./output

JSON only (for scripting / downstream tools):

python -m adldd dc01.dat -o ./output --no-html --no-grep

Then use ldapdomaindump utilities on the output:

# Pretty enum4linux-style output
python -m ldapdomaindump.pretty -d ./output

# Convert to BloodHound v1 CSV
python -m ldapdomaindump.convert ./output/domain_users.json ./output/domain_groups.json ./output/domain_computers.json ./output/domain_trusts.json

How it works

1. The .dat file is parsed using the ADExplorerSnapshot.py library, which reverse-engineers the proprietary binary format.
2. Each AD object is classified by its objectClass attribute:
   • user (not computer) → domain_users
   • computer → domain_computers
   • group → domain_groups
   • domain / domainDNS (with objectSid) → domain_policy
   • trustedDomain → domain_trusts
3. Attributes are normalized to JSON-safe values (bytes → base64, SIDs → string representation) and written in ldapdomaindump format.
4. HTML and greppable reports are generated using the same attribute lists and formatting logic as ldapdomaindump.

License

MIT