# Invoke-ADEnum audits an Active Directory domain into a single HTML report

> Invoke-ADEnum is a PowerShell script that enumerates an Active Directory environment, runs named misconfiguration checks such as RBCD and abusable GPOs, and writes the findings into a browsable HTML report with CSV and XLSX export. It reads the directory and nothing else, and it needs no elevated rights.

**Leo4j/Invoke-ADEnum** — Active Directory Auditing and Enumeration

- Repository: https://github.com/Leo4j/Invoke-ADEnum
- Website: https://github.com/Leo4j/Invoke-ADEnum
- Stars: 549 · Forks: 59
- Language: PowerShell
- License: GPL-3.0
- Published: 2026-10-22 · Updated: 2026-10-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/leo4j-invoke-adenum

## What the script actually does to your directory

Invoke-ADEnum is a single PowerShell file, Invoke-ADEnum.ps1, whose stated job is automating the collection of information from an Active Directory environment. The security notes are unusually explicit about the boundary. The script does not record, change or interfere with anything, it does not collect or transmit information, nothing is sent over the internet, and it runs completely offline. The only file it creates is a single HTML report, saved in the current working directory if that is writable, or in C:\Users\Public\Documents. It does not need to run on a domain controller; the README says you can run it from any domain-joined machine such as a workstation. It also runs fully under a standard domain user account, with no elevated domain rights and no local admin permissions required. That combination is what makes it usable during a compliance audit by someone who has not been handed domain admin.

## Loading the script and finding the help page

The documented way to run it loads the script into memory straight from the repository, which means nothing is written to disk beyond the report itself:

```bash
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/Leo4j/Invoke-ADEnum/main/Invoke-ADEnum.ps1')
```

Once it is resident, the help page lists the available checks:

```bash
Invoke-ADEnum -Help
```

Two things follow from that arrangement. The first is that the version you run is whatever is currently on the main branch, and the repository has no GitHub releases to pin against, so a run is reproducible only if you keep your own copy of the script. The second is that the whole audit depends on the ActiveDirectory PowerShell module being present and functional on the workstation, since the script needs to query the directory. That module is not part of what the project ships, and the README does not document a fallback path for a machine that lacks it.

## Scoping the targets before anything else runs

The README puts scoping first, ahead of the coverage switches, and the ordering is the point. A dry run of targets:

```bash
Invoke-ADEnum -TargetsOnly
```

is the recommended way to see what will be touched and to stay inside the agreed scope. To point the run at one domain and bind to a specific domain controller:

```bash
Invoke-ADEnum -Domain contoso.local -Server DC01.contoso.local
```

and to pull domains out of scope:

```bash
Invoke-ADEnum -Exclude "contoso.local,domain.local"
```

For an assessor working under a signed scope, that sequence is the difference between a defensible audit and an incident. The tool is capable of walking a large forest, and the scoping switches are the only control the project puts in front of it, so they deserve to be treated as a required first step rather than an optional refinement.

## The named checks and what a coverage run costs

The recommended coverage set names the checks the project considers the useful baseline: local admin access, RBCD, user-created objects, abusable GPOs and descriptions.

```bash
Invoke-ADEnum -FindLocalAdminAccess -RBCD -UserCreatedObjects -GPOsRights -MoreGPOs -AllDescriptions
```

Those switches read as a list of specific misconfigurations rather than a generic dump. Local admin access covers who can administer machines, RBCD concerns resource-based constrained delegation, user-created objects and GPO rights are about objects and policies that were put in place outside the normal review path, and descriptions are the free-text fields that often carry operational detail. For a full sweep there is a single switch, and the README warns what it costs:

```bash
Invoke-ADEnum -AllEnum -Force
```

Running every available check can be very time-consuming, especially in large domains. That is a planning input, not a footnote, because an assessment window has an end and a full enumeration against a large directory can overrun it.

## The OPSec mode and what it gives up

There is a mode that trades coverage for quiet. The README describes it as avoiding enumeration that runs port-scanning, DNS resolution and suspicious checks:

```bash
Invoke-ADEnum -OPSec -RBCD -UserCreatedObjects -GPOsRights -MoreGPOs -AllDescriptions
```

This is a meaningful design decision and worth stating plainly. Directory enumeration that resolves names and opens ports leaves traces that a defender can see in logs, so a quieter mode is a real option for an assessor who would rather not be noticed mid-assessment. The cost is that some findings are simply not produced, and the report you get is a partial view of the domain. A quiet audit and a complete audit are different products, and you have to decide which one the engagement is buying before you start rather than after the report is finished.

## The HTML report, the CSV export and the XLSX sheets

The output is the reason the tool exists. Invoke-ADEnum produces an Active Directory Audit Report in HTML, laid out so the results can be walked through rather than read, and a published example is available at leo4j.github.io/Invoke-ADEnum/. Two export paths sit on top of it. Clicking the title of a table generates and downloads a CSV of that table's results, so you can pull a single table into a spreadsheet without re-running anything. Exporting the entire report as XLSX is done by clicking on Active Directory Audit at the top of the page, and the workbook carries a separate sheet for each table of findings. Two JavaScript libraries are embedded in the script specifically so the HTML file and the spreadsheet can be produced without a network connection, which is consistent with the offline claim. The practical consequence is that the report is a portable artifact, and that artifact becomes sensitive: it lists accounts, group memberships and rights.

## Licence, releases and the shape of the project

The project is licensed under GPL-3.0, and the repository carries a LICENSE file at the top level alongside the script, a docs/ directory, a Backup/ directory and a .github/ directory. There are no GitHub releases, so there is no versioned distribution to point a colleague at, and the last push was on 2026-10-16. In practice that means upgrade is a matter of fetching the current file, with the corresponding loss of a stable reference point. Whether a GPL-3.0 script is acceptable in your environment is a question for your own legal review, but note what the licence covers: it is a self-contained script that runs on your workstation and writes its report locally, so the licence question is about redistribution of the script rather than about linking it into a product. The README's disclaimer states the tool is intended for research, education and authorised testing, and that users must secure explicit consent before using it on any environment.

## Where Invoke-ADEnum is the wrong choice

Three cases. The first is continuous monitoring, because the tool produces a human-readable report rather than a machine-consumable feed, so there is nothing to diff between runs without extra work around it. The second is a directory that is not Active Directory: the script is built around Active Directory concepts such as RBCD, GPO rights and domain controllers, and the README does not describe support for other identity stores. The third is an assessment that needs to look at something the tool does not check, such as application-level authorisation or cloud identity providers, since the report is only as wide as the switch set you pass. On the alternative question, a defender who wants a narrower picture can query the directory directly with the ActiveDirectory cmdlets such as Get-ADUser, Get-ADGroup and Get-ADComputer, or issue LDAP queries, and that approach gives exact control over every attribute retrieved at the cost of building the report yourself. Invoke-ADEnum wins on the breadth of named checks and the finished report; raw cmdlets win on precision and on producing output that fits an existing pipeline.

## Conclusion

Invoke-ADEnum is a good fit for a defender or auditor who needs a broad, repeatable snapshot of what a domain actually exposes, and who can run one script from a domain-joined workstation without asking for elevated rights. It is the wrong choice for continuous monitoring, for environments where the ActiveDirectory PowerShell module is unavailable, and for anyone who needs results they can diff across changes over time, since the script produces a report and not a data pipeline. Check three things before you rely on it: that the machine you run it from is domain-joined, because the README states that binding requirement explicitly; that your intended checks are covered by the switches you pass rather than left to the default, since the tool reports only what it is asked to look for; and that the HTML report in the working directory is handled the way your organisation handles audit output, since the report itself lists accounts, group memberships and rights.

## FAQ

### Does Invoke-ADEnum need domain admin or local administrator rights?

No. The README states it runs fully under a standard domain user account, does not require elevated domain rights or local admin permissions, and does not need to run on a domain controller as long as the machine is domain-joined.

### What files does Invoke-ADEnum create on my system?

The only file it creates is a single HTML report, saved in the current working directory if that is writable, or in C:\Users\Public\Documents. The script does not record, change or interfere with anything in the environment, and it transmits nothing over the internet.

### How do I export the Invoke-ADEnum results to CSV or Excel?

Clicking the title of a table generates and downloads a CSV of that table's results. Exporting the whole report as XLSX is done by clicking Active Directory Audit at the top of the page, and the workbook contains a separate sheet for each table of findings.

### What is the difference between Invoke-ADEnum -AllEnum and the recommended coverage switches?

The recommended set runs specific checks for local admin access, RBCD, user-created objects, abusable GPOs and descriptions. -AllEnum -Force runs all available checks, and the README warns this can be very time-consuming, especially in large domains.

### What does the Invoke-ADEnum -OPSec switch change?

The README describes it as avoiding enumeration that runs port-scanning, DNS resolution and suspicious checks. The result is a quieter run that does not produce those findings.

## Sources

- [Issues](https://github.com/Leo4j/Invoke-ADEnum/issues)
- [Leo4j/Invoke-ADEnum on GitHub](https://github.com/Leo4j/Invoke-ADEnum)
- [License: GPL-3.0](https://github.com/Leo4j/Invoke-ADEnum/blob/main/LICENSE)
- [Project website](https://github.com/Leo4j/Invoke-ADEnum)
- [README](https://github.com/Leo4j/Invoke-ADEnum/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/leo4j-invoke-adenum