Skip to main content
Applies to BloodHound Enterprise only By default, SharpHound Enterprise collects only from the domain where the SharpHound service account belongs.
If you need to collect from trusted domains or other forests, configure Scope Collection to Multiple Domains in the client or schedule Advanced Options.You can either specify a list of domains or enable Collect from all domains trusting the SharpHound service account domain, including transitively.

​
Configure Cross-Trust Collection

In Scope Collection to Multiple Domains, you can either specify a list of domains to collect from or enable Collect from all domains trusting the SharpHound service account domain, including transitively. This option also collects from trusting domains in other forests.
If selective authentication is enabled on a trust, the SharpHound Enterprise service account must explicitly be granted read permissions on all AD objects in all domains of the targeted forest to perform collection.

​
Collect Across External Trust

Kerberos authentication works by default for all Active Directory trust types except external trusts. SharpHound Enterprise supports collection across external trusts via two mechanisms.

​
Forest Search Order (preferred)

Administrators can enable Kerberos authentication across external trusts by adding the name of the other domain to the Use forest search order policy setting on Domain Controllers.
We recommend deploying this setting to all Domain Controllers in domains with external trusts to avoid using the older and less secure NTLM authentication.

​
LDAP Auto-Negotiation

By default, SharpHound Enterprise only supports Kerberos authentication for the LDAP connections to Domain Controllers for Active Directory Structure Data collection. This will cause the collection across the external trust to fail without modifying SharpHound’s default behavior in the settings.json configuration file.
The default configuration file path is described in SharpHound Enterprise Local Configuration.
To enable support for auto-negotiation in LDAP connections:
  1. Stop the SharpHound Delegator service.
  2. Open the settings.json configuration file as an Administrator (right click -> Run as Administrator on notepad.exe).
  3. Change the ForceLDAPKerberosAuth setting to False (no quotes).
  4. Save the settings.json configuration file.
  5. Start the SharpHound Delegator service.
If NTLM fallback is enabled, deny outbound NTLM authentication from the SharpHound server to all servers except Domain Controllers in domains with external trust relationships. For hardening guidance, see NTLM cracking (and relaying) remediation.

​
Troubleshoot Cross-Trust Collection

The collection across a trust will fail if:
  • The Kerberos-supported encryption types between domains/forests do not match.
  • Authentication has been restricted, e.g., using authentication policy silos or IPSec.
  • There is no network access from the SharpHound server to the trusting domain’s DCs and domain-joined Windows systems in scope for privileged collection.