Information about joeware mixed with wild and crazy opinions...
Apologies, I found out that the AdFind.zip file I uploaded wasn’t password protected and caused some download issues. I have uploaded the correct password protected version of the zip file so that should clear up the download issues.
OK… Finally, at long last, an update for AdFind and AdMod. Lots of updates actually. It isn’t that I haven’t been adding things to them, I just haven’t been publicly releasing so that people update AdFind signatures on virus total that feeds all of the random AV/Ant-malware tools to go incorrectly block it. The last [ ]
Sorry for that folks. One of the security plugins decided the most secure blog was one that did not function at all a few days ago. I know it has been broken for a few days but I just finally had time this morning to spend looking at it. But hey, absence makes the heart [ ]
I have had my DB util from the blog get me locked out of my mysql servers several times now and it is due to some kind of scanners doing stupid shit. i went through the logs for the last 24 hours and have blocked roughly 2.5 million IP addresses from being able to see [ ]
As I mentioned, i was close to releasing new (to you) versions of AdFind and AdMod a while back and then was told about some new functionality in Windows Server 2025+ v.Next that I have been asking for for over two decades and I wanted to get it all wrapped in a pretty bow including [ ]
Something weird happened with one of the Security plugins and took the legs out from under the blog. I have been busy with things and hadn t had a chance to look in a while but noticed it last night and got it sorted today. Apologies for going dark. Still here. 🙂 joe
So it begins And anyone who wants to be mad about yet another delay on the latest AdFind release, blame Narayanan Subramanian. He showed me some new functionality in Windows Server 2025 v.Next that I want to get into the tool so I have to sort it out first, and then get it added. It [ ]
Is joe dead? Is he still working on these apps? Will we ever see new versions of AdFind and AdMod? The answers are NO (Well, mostly NO), YES, and YES. I am testing a release candidate for both tools now, if they clear that testing, I will perform the final compile and release to production. [ ]
Testing a post with PHP 8.4 enabled.
So the same PHP upgrade that messed with downloads on the main site seems to be doing some fun on the blog as well. If you see something off, please feel free to drop me a line at joe@joeware.net
Hey all, yes, still very quiet, still very busy. AdFind and AdMod are close to a new release for both. I just upgraded the compiler to VS 2026 and did some tweaks for that. Lots of updates aside from that since the last releases. Also, I heard from some folks that the site was apparently [ ]
This is an awesome tool, subnet consolidator. So good for so many people with a mess of subnets defined in AD. So often I see an Active Directory and the subnets are INSANE. Use this tool to consolidate things, please. CIDR Merger Deduplicator Free IP Merge CIDR Overlap Calculator I will say [ ]
Hey! Sorry for the darkness. AdFind is NOT dead, I am still developing it. I have a bunch of fixes in it that I started back in December 2023 including stuff for Windows Server 2025 that I just haven’t wrapped all up to release. I have actually bumped it to two minor versions too so [ ]
I love winget… Full stop. But do not use winget on Windows Server 2025 and then try to sysprep it. It will break. See https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/sysprep-fails-remove-or-update-store-apps#cause for how to back out so you can sysprep it. joe
Dear everyone out there still working with Active Directory (so most all large orgs and Security Vendors and other Software Vendors), please stop writing whenChanged or uSNChanged based AD Sync methods for your applications. Those may be fine (still bad) for some small company with 1-2 domain controllers but they are utter crap for large [ ]
AdFind updates for 2025 (and other things) is under way. Thirty something builds or so since the last publicly released version of AdFind. [Sun 11/03/2024 14:05:12.57] D:\DEV\cpp\vs\AdFind\Debug adfind -appver AdFind V01.64.00cppBETA Joe Richards (support@joeware.net) November 2024 BUILD : 1.64.0.6206_DEBUG BUILDDATE: 20241103-14:03:46 EST x86 VS2022 WIN32 PATH:…
A colleague from my HP days (neither he nor I work for HP anymore) reached out to me to ask for clarification on the joeware licensing for use WITHIN a company, specifically the company he works for now. He wasn’t asking for you and your company, I mean, he is a terribly great nice person [ ]
…Microsoft, you have become so damn annoying with Windows Defender and other things that I am looking to turn it off permanently because I, not you, gets to be the arbiter of what I want on my machine and if I say leave this on my machine, I shouldn’t have to retell you over and [ ]
I released V01.62.00 last night to fix a crash bug introduced in V01.61.00 from integrating some of the joe only private ldap query tool functionality because some of the core functionality was different enough to be problematic. If you ran into that crash bug, my deepest apologies. joe
I just performed the final compiles and final commits for AdFind V01.61.00, AdMod V01.28.00, and joe’s private LDAP query tool because MSFT has their head up their ass in going after AdFind and I need a tool around that doesn’t just disappear when they decide to take it because they know better than anyone else [ ]
The first bit is of course wrong, AdFind cannot bypass any security in place. The second bit is of course right, AdFind is not malware despite what Windows Defender says. I expect this goes back to some person at Microsoft who doesn’t understand what software is nor how it works and has never, on their [ ]
My good friend, former coworker, and someone I trained for several years on the topics of Active Directory, Windows, and just troubleshooting the world at scale with basic fundamentals is now blogging the cool and fun stuff he is digging into which is usually a mix of Windows, AD, Azure AD (ok Entra ID), and [ ]
I know I know, I have said this a few times, I will not be building new versions of AdFind / AdMod and releasing them, but here I am again, releasing new versions of AdFind/AdMod. Note, AdFind is STILL not malware, regardless of what any security tool or security “expert” says. If your company blocks [ ]
I am not entirely sure what happened but it took out the blog for a few days, looks like from 2023-04-24T155831 until just a few minutes ago as I troubleshot the operation. I didn’t realize there was a problem until yesterday at work I went looking for a specific post to send to someone and [ ]
Be there or be square, sign up fast!!! https://www.accelevents.com/e/hip-global-2023?aff=MC For those of you who remember the glorious days of DEC and TEC, HIP is that but v2. Many of the same old faces and some fun new ones to boot. I would love to be there myself but I was already booked from last year [ ]
Is https://support.microsoft.com/en-us/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8 an admission that AD Delegation for computer objects is broken? The whole fix and the previous versions of the fixes were to override who can re-use an existing computer account. Theoretically, if your AD security is properly delegated and you turned off that silly…
I am getting masses of emails about people having issues downloading from the site. Primarily AdFind is the one people are having issues with but Chrome has been blocking ALL downloads from the site. I have been trying to work with Google to get Chrome sorted out but they seem to be really confused over [ ]
So I was alerted that Chrome is blocking downloads of AdFind but then also heard it is other tools as well. I am digging into it to see what can be done, I registered the site with google and told it to give me a security report and it showed me: I responded with Note [ ]
You may recall I previously ranted on twitter (https://twitter.com/joewaredotnet/status/1432548671527264258?s=20 t=LMw3UZ9dddXhxVPs8dKa7A) that MSFT added TLS 1.3 for HTTPS for Windows Server 2022 but neglected to add it for AD. Well someone listened. You are welcome. [Sat 07/09/2022 20:54:17.43] C:\temp adfind -h k22-ese.k22-ese-dom.test.loc -sslinfo AdFind V01.59.00cppBETA Joe Richards…
I have uploaded the new versions of AdFind and AdMod to www.joeware.net for download. Note that I know that a lot of anti-malware has been reporting AdFind.exe as malware now, usually some form of LOLBIN or PUA. The reason for this is because the hacker collectives are using the tool for scanning Active Directory environments [ ]
I was about to add some code to AdFind to export Security Descriptors in binary export/import format and found out I already had written that code. I apparently used a bad switch name for it though because I didn t intuitively know what it was and find it by accident. That or my brain was in [ ]
F.U.2.
Ok not really enemy #1, but they are getting stupid about it. Once again the AV Tool companies have their panties in a bunch over a joeware tool. Now it is AdFind. The digests on the website are accurate, I also uploaded it to virustotal before anyone but me had touched it so their digests [ ]
I have released new versions of AdFind and AdMod. Yeah I know I just said that I had released the last versions of both. I know. Trust me I know. I had packed the code away. Then I had a single week where I was alerted to one absolutely horrible bug in AD (https://blog.joeware.net/2021/04/19/6068/) which [ ]
Ok, let me pull that title back a teeny tiny bit… Do NOT Use msds-memberTransitive and msds-memberOfTransitive UNLESS you are absolutely positive that the number of values returned is guaranteed to be less than 4501 values. What are you talking about joe and why are you railing about an attribute that has been around since [ ]
I know I said I was putting them away, and I did. I locked down the code and started looking into other things. However, three separate bugs in Windows, well two bugs in the OS and one in a Windows tool (my opinion on the bugs, not an admission from MSFT) that I couldn’t stand [ ]
My blogging ability has been hampered for a while because OpenLiveWriter wasn’t working for me and throwing 409 Conflict errors when trying to talk to my blog. My last couple of posts were done through the web interface and anyone who knows me knows I don’t much like web interfaces, including the WordPress editor interface. [ ]
I have released AdFind V01.55.00 and AdMod V01.22.00. 🙂 AdFind There are quite a few fixes and additions since the pre-Pandemic release. You can find a breakdown at http://www.joeware.net/freetools/tools/adfind/ AdMod Surprise, it only took nine years to have a version of this I was comfortable enough to publicly release. Unlike AdFind, AdMod is exceptionally [ ]
Hi, I just wanted to touch base on the upcoming releases. I thought I would be releasing new production versions of AdFind and AdMod at the beginning of the month. Obviously that did not happen. I ran into a few bugs I needed to deal with and most recently ran into something I really wanted [ ]
https://docs.microsoft.com/en-us/security/compass/esae-retirement ”We have found that ESAE projects are often detrimental to overall security posture as they are high cost, difficult to use and support, and provide a limited set of security (only Active Directory administrators and only preventive controls).” What took so long to figure that out? Oh, they knew, they just didn’t have something [ ]
For a short time only I have the latest daily build Beta versions of AdFind V01.53.00 and AdMod V01.21.00 out on the joeware website at https://www.joeware.net/downloads/beta/20201231_expire/ As the folder name implies, these versions will expire on December 31, 2020 UTC. These may actually be the Release Candidates unless I find something in the next week [ ]
So say you hate Account Operators group as much as I do and want to just strip the AO ACEs off of objects… Then this output below is something you will like… Less than 30 seconds to strip all AO access off of 20 objects remotely from a non-domain joined PC over wireless to a [ ]
Look no further, check out the custom ornament my niece put together just for 2020. https://www.etsy.com/shop/CustomDesignByBrooke ENJOY! joe
https://thedfirreport.com/2020/10/08/ryuks-return/ This isn’t the first I have read about AdFind being used by bad actors, it won’t be the last. I first started hearing about AdFind being used in exploits and recon work roughly 2.5 or so years ago when IR teams and Security Researchers started emailing me about it and asking for hashes of [ ]
Thoughts? [Tue 08/18/2020 0:24:46.40] E:\DEV\cpp\vs\AdMod\Debug adfind -f ou=tobedeleted -jsdenl AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) July 2020 Using server: LO-DC4.lockout.test.loc:389 Directory: Windows Server 2019 (10.0.17134.1) Base DN: DC=lockout,DC=test,DC=loc dn:OU=tobedeleted,DC=lockout,DC=test,DC=loc [OWNER] LOCKOUT\Domain Admins [GROUP] LOCKOUT\Domain Admins [DACL]…
Another common thing that people want to do from the command line with AdFind AdMod is to clear the “Protect object from accidental deletion” setting that is implemented with a deny delete ACE on the object, specifically [DACL] DENY;;[DEL TREE][DEL];;;Everyone As mentioned previously, the Security Descriptor is a BLOB so you have to deal [ ]