Run an On Demand Scan

​

Purpose

​

Prerequisites

• An existing SharpHound Enterprise or AzureHound Enterprise collector client
• Logged in as a user assigned a role authorized to run a collector client on demand scan

​

Process

1

Open the Manage Clients page

In the left menu, click Administration > Manage Clients.

2

Choose a collector client

On the client that you want to schedule, click the icon in the Action column and select On Demand Scan.

Verify the client is online by validating Status is Ready

3

Configure the scan

Configure the following details in the On Demand Scan window:

• Data: The type of data that the scan collects, see:
  • SharpHound Data and Permissions
  • AzureHound Data and Permissions
• Advanced Options:
  If you need SharpHound Enterprise to collect outside the SharpHound service account domain, expand Advanced Options and configure Scope Collection to Multiple Domains.To collect from every domain that trusts the SharpHound service account domain, enable Collect from all domains trusting the SharpHound service account domain, including transitively.
  

  Option	Description
  Data (Required)	Multi-select option for the different types of collection available. See SharpHound Data Collection and Permissions for details on the data collected and permissions necessary for each.
  Domain controller	By default, SharpHound automatically selects a Domain Controller for LDAP queries. Specifying a Domain Controller hostname or FQDN here will define the default value used for this scan or schedule. If not set, SharpHound will utilize the value set in the client configuration. We recommend not configuring a Domain Controller manually.
  Target Local Group and/or User Session Collection by Organizational Unit	Define one or more OUs within a domain to only collect Local Group and Session data from computers contained within the specified OUs and their descendants. If left empty, SharpHound will collect from all OUs. If defined, the schedule or On Demand Scan will not collect AD structure data. A dedicated schedule or On Demand Scan must therefore be created for AD structure collection. Not supported with multi-domain collections.
  Scope Collection to Multiple Domains	Utilize trust relationships in your environment to collect data from multiple domains. If left empty, SharpHound collects only from the domain where the SharpHound service account belongs. SharpHound supports two options: Define a specific list of domains from which to collect data. Enable Collect from all domains trusting the SharpHound service account domain, including transitively to collect from every trusting domain, including trusted domains in other forests. For setup details, see SharpHound Enterprise Cross-Trust Collection. Multi-domain collections cannot be scoped by OU.

4

Start the scan

Click Run to begin the on demand scan.

​

Outcome