SharpHound Enterprise Local Configuration

SharpHound Enterprise stores its local configuration in two files:

File	Purpose
`settings.json`	Defines how the service behaves, including settings for connecting to the BloodHound Enterprise tenant, Active Directory, and logs.
`auth.json`	Defines the credentials the service uses to authenticate to the BloodHound Enterprise API.

When using Integrated Windows Authentication (IWA), the auth.json file is not used; all authentication information is provided in settings.json instead.

You can find the file paths for each configuration file and logs in the table below. %AppData% is the directory of the service account: C:\\Users\\SERVICE_ACCOUNT$\\AppData\\Roaming.

SharpHound File	Default Path (v2.5.8+)	Default Path (<= v2.5.8)
Configuration File	`%AppData%\\BloodHoundEnterprise\\settings.json`	`C:\\Program Files (x86)\\SHService\\settings.json`
Authentication File	`%AppData%\\BloodHoundEnterprise\\auth.json`	`C:\\Program Files (x86)\\SHService\\auth.json`
Active Logs	`%AppData%\\BloodHoundEnterprise\\*.log`	`%AppData%\\BloodHoundEnterprise\\*.log`
Archived Logs	`%AppData%\\BloodHoundEnterprise\\log_archive\\*.zip`	`%AppData%\\BloodHoundEnterprise\\log_archive\\*.zip`

Configure SharpHound Settings

To modify any settings in your SharpHound configuration, you must stop the SharpHound service. The process to modify SharpHound’s configuration files is as follows:

Stop the SharpHound Enterprise service: “SharpHound Delegator”
Edit and save one of the configuration files as an Administrator:
- settings.json
- auth.json
Start the SharpHound Enterprise service: “SharpHound Delegator”

settings.json

The settings.json file is a plaintext JSON file that defines information about how the service behaves, such as settings for connecting to the BloodHound Enterprise tenant, connecting to Active Directory, and writing logs.

settings.json

{
  "RestEndpoint": "CODENAME.bloodhoundenterprise.io",
  "RestPort": 443,
  "SSL": true,
  "CurrentJob": null,
  "LogLevel": "Information",
  "EnumerationLogLevel": "Information",
  "TempDirectory": "C:\\Users\\gmsa_SHS$\\AppData\\Roaming\\BloodHoundEnterprise",
  "Proxy": null,
  "ComputerPasswordResetWindow": 60,
  "ForceLDAPKerberosAuth": true,
  "PortCheckTimeout": 10000,
  "LDAPSSLPort": 636,
  "LDAPPort": 389,
  "ForceLDAPSSL": false,
  "NumWorkers": 50,
  "PartitionLDAPQueries": true,
  "Version": "2.5.9.0"
}

Integrated Windows Authentication (IWA)

If using IWA instead of API tokens, you must include IWA-specific configuration fields in your settings.json file. These fields are required to enable SharpHound to authenticate using the service account’s Windows credentials via Active Directory Federation Services (ADFS).

settings.json

{
... (other settings) ...
  "ProviderWellKnown": "https://adfs.example.com/.well-known/openid-configuration",
  "ClientId": "12345678-1234-1234-1234-123456789012",
  "Resource": "https://your-tenant.bloodhound.com",
  "UseIntegratedWindowsAuthForADFS": true,
}

When using this configuration, do not include an auth.json file. The authentication credentials will be handled through ADFS using the service account’s Windows identity.

See the following reference to learn more about the supported fields in the settings.json file:

string

Your tenant domain, as provided by your account team. Enter the domain only and do not include URI information such as https://.Default value: CODENAME.bloodhoundenterprise.ioExample value: demo.bloodhoundenterprise.io

integer

TCP port on which the BloodHound Enterprise API runs.Default value: 443Example value: 443

boolean

Specifies whether SSL is enabled for the API connection.Default value: TrueExample value: True

string | null

HTTP proxy URL, if your environment requires one.Default value: nullExample value: proxy.acme.com:8080

array | null

SharpHound uses this field to track the currently running task. When no task is running, the value is null.Default value: Do not modify this value.Example value: Do not modify this value.

string

Logging verbosity level for the service itself. These logs appear in service.log within the configured TempDirectory location.Supported values, from most to least verbose:

Trace
Debug
Information
Warning
Error
Critical
None

Default value: InformationExample value: Trace

string

Logging verbosity level used during collection jobs.Supported values, from most to least verbose:

Trace
Debug
Information
Warning
Error
Critical
None

Default value: InformationExample value: Trace

string | null

Directory in which SharpHound stores logs and temporary files. If this value is null when the service starts, SharpHound uses the %APPDATA%\\BloodHoundEnterprise\\ directory for the service user.Logs are retained for 14 days. Escape backslashes for valid JSON formatting by using double backslashes.Default value: nullExample value: C:\\Users\\SERVICE_USER$\\AppData\\Roaming\\BloodHoundEnterprise\\

string

Current SharpHound Enterprise version.Default value: Do not modify this value.Example value: Do not modify this value.

integer

Excludes computer objects from local collections if they have not rotated their password with the domain within this many days. By default, Active Directory computers rotate their passwords every 30 days.Minimum value: 7This Windows setting controls how often the computer rotates its password. You can also prevent password rotation entirely through Windows policy.Default value: 60Example value: 365

integer

Time, in milliseconds, that SharpHound waits for a response on TCP port 445 before considering the system unavailable.Minimum value: 200Requires SharpHound Enterprise v2.2.1+.Default value: 10000Example value: 15000

integer

Number of concurrent threads that perform privileged collection.Minimum value: 10Maximum value: 100Requires SharpHound Enterprise v2.2.1+.Default value: 50Example value: 50

boolean

Specifies whether SharpHound splits LDAP queries into multiple parts. Use this setting when you query very large domains.Default value: TrueExample value: True

boolean

Enforces Kerberos authentication when SharpHound queries LDAP servers. Disabling this setting may be required to collect across an External trust type. For more information, see Cross-Trust Collection.When set to False, SharpHound auto-negotiates authentication to domain controllers and prefers Kerberos when it is available.Default value: FalseExample value: True

integer

TCP port used for LDAP over SSL collection.Requires SharpHound Enterprise v2.2.1+.Default value: 636Example value: 636

integer

TCP port used for LDAP collection.Default value: 389Example value: 389

boolean

Controls SharpHound’s primary LDAP connection behavior.When set to False, SharpHound attempts LDAP over SSL first and can fall back to signed and sealed LDAP.When set to True, SharpHound is configured to use LDAPS for its base LDAP configuration where possible, but some ancillary directory-related operations may still use other negotiation or resolution paths.Do not use this setting as a guarantee that no TCP 389 traffic will occur in all scenarios.Default value: FalseExample value: False

IWA only

string | null

ADFS well-known endpoint URL for Integrated Windows Authentication. This is typically the ADFS server address with /.well-known/openid-configuration appended. Required when UseIntegratedWindowsAuthForADFS is enabled.Default value: nullExample value: https://adfs.example.com/.well-known/openid-configuration

IWA only

string | null

Client ID generated by BloodHound during collector client creation. SharpHound uses this value to identify itself to the ADFS server. Required when UseIntegratedWindowsAuthForADFS is enabled.Default value: nullExample value: 12345678-1234-1234-1234-123456789012

IWA only

string | null

BloodHound Enterprise tenant URL used as the resource identifier for the ADFS application. Required when UseIntegratedWindowsAuthForADFS is enabled.Default value: nullExample value: https://your-tenant.bloodhoundenterprise.io

IWA only

boolean

Enables Integrated Windows Authentication through ADFS. When set to true, SharpHound authenticates with the service account’s Windows credentials against the configured ADFS server.When this setting is enabled, SharpHound does not use auth.json. You must also configure ProviderWellKnown, ClientId, and Resource.Default value: FalseExample value: True

auth.json

The auth.json file is a plaintext JSON file that defines the credentials the service uses to authenticate to the BloodHound Enterprise API. Creating a new client or rotating the credentials of an existing one will provide you with the complete JSON structure used for a SharpHound Enterprise client.

auth.json

{
"Token": "w4Tc+heVmaMTWgodlw0YlztaEGG53J/mwogiEZLvKE6WtylfYuoVEA==",
"TokenID": "0c6120ee-2fbe-478f-a864-2e264f9c16d2"
}

See the following reference to learn more about the supported fields in the auth.json file:

string | null

Token SharpHound Enterprise uses to authenticate with the BloodHound Enterprise tenant.Default value: nullExample value: w4Tc+heVmaMTWgodlw0YlztaEGG53J/mwogiEZLvKE6WtylfYuoVEA==

string | null

Unique identifier for the token.Default value: nullExample value: 0c6120ee-2fbe-478f-a864-2e264f9c16d2

Get Started with BloodHound

Install a Data Collector

Collect Data

OpenGraph

OpenHound

Analyze Attack Path Data

Manage BloodHound

API & Integrations

On-premises BloodHound Enterprise

Resources

SharpHound Enterprise Local Configuration

Configure SharpHound Settings

settings.json

Integrated Windows Authentication (IWA)

auth.json

​Configure SharpHound Settings

​settings.json

​Integrated Windows Authentication (IWA)

​auth.json

Configure SharpHound Settings

settings.json

Integrated Windows Authentication (IWA)

auth.json