Skip to main content
Applies to BloodHound Enterprise only The SharpHound Enterprise service is a critical element in your deployment that collects and uploads data about your environment to your BloodHound Enterprise instance for processing and analysis. SharpHound Enterprise is deployed as a signed Windows service, runs under the context of a domain account, and collects from one or more domains utilizing the configured service account.

​
Deployment Process Overview

To collect Active Directory data with SharpHound and ingest it into BloodHound for analysis:
  1. Provision a Server that meets or exceeds the recommended Hardware, Software, and Network requirements below.
  2. Create a Service Account or gMSA that SharpHound will run as, meeting the service account requirements below.
  3. Install and Upgrade SharpHound Enterprise
  4. Create a BloodHound Enterprise collector client
  5. Run an On Demand Scan or Create a data collection schedule

​
Server Requirements

​
Hardware

These recommendations should be considered a baseline and may need to be increased depending on the size and complexity of your environments.
Minimums apply to test or development deployments. Where multiple collectors are deployed on a single host, scaling will be necessary to maintain performance.

​
Software

  • Windows Server 2019+
  • .NET 4.7.2+

​
Network

SharpHound Enterprise needs outbound access to your BloodHound Enterprise tenant and to at least one domain controller in each domain you collect. Additional ports are required only for specific collection methods.

​
Baseline Connectivity

SharpHound attempts LDAP over SSL first. If LDAPS is unavailable and ForceLDAPSSL is disabled, SharpHound falls back to signed and sealed LDAP on the configured LDAP port. SharpHound uses LDAP channel signing for all queries.
ForceLDAPSSL is a best-effort control for SharpHound’s primary LDAP collection path, not a blanket guarantee that every directory-related operation during collection avoids non-LDAPS resolution paths.Some LDAP negotiation or AD structure resolution may still occur through existing .NET APIs. Do not assume that blocking TCP 389 is safe in every deployment without validating collector behavior in your deployed version.

​
Optional Connectivity

Expected network bandwidth for privileged collection is approximately 60-100 kB per collection.

​
Service Account Requirements

Run the SharpHound Enterprise service under a domain-joined account that has the Log on as a service User Rights Assignment on the SharpHound Enterprise server. This account can be a traditional user account or a Group Managed Service Account (gMSA). The service account needs permissions to collect data from your target domains and domain-joined systems as detailed in SharpHound Data Collection and Permissions. We recommend following SharpHound Enterprise Service Hardening.
The SharpHound collection service account does not require Domain Admin membership.
If Active Directory tombstoning is enabled, the service account must also have read permissions on the deleted objects container.

​
Integrated Windows Authentication (IWA)

If you want to use IWA for SharpHound, the following additional requirements apply:
  • Active Directory Federation Services (ADFS) server must be accessible in your network environment
    Both the system running SharpHound and the BloodHound Enterprise tenant require network connectivity to the ADFS server.
  • Service account must be configured in ADFS to support Windows authentication for SharpHound
  • Client ID property must be registered in ADFS (provided during collector client creation)
  • Local SharpHound configuration must include IWA-specific properties in the settings.json file