> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# SharpHound Enterprise System Requirements and Deployment Process
The SharpHound Enterprise service is a critical element in your deployment that collects and uploads data about your environment to your BloodHound Enterprise instance for processing and analysis.
SharpHound Enterprise is deployed as a signed Windows service, runs under the context of a domain account, and collects from one or more domains utilizing the configured service account.
## Deployment Process Overview
To collect Active Directory data with SharpHound and ingest it into BloodHound for analysis:
1. Provision a Server that meets or exceeds the recommended Hardware, Software, and Network requirements below.
2. Create a Service Account or [gMSA](/install-data-collector/install-sharphound/create-gmsa) that SharpHound will run as, meeting the service account requirements below.
3. [Install and Upgrade SharpHound Enterprise](/install-data-collector/install-sharphound/installation-upgrade)
4. [Create a BloodHound Enterprise collector client](/collect-data/enterprise-collection/create-collector)
5. [Run an On Demand Scan](/collect-data/enterprise-collection/on-demand-scan) or [Create a data collection schedule](/collect-data/enterprise-collection/collection-schedule)
## Server Requirements
### Hardware
| Resource | Minimum | Recommended | Large enterprise |
| - | - | - | - |
| **Processor Cores** | 2 physical cores | 4 physical cores | 6 physical cores |
| **Memory** | 4GB RAM | 16GB RAM | 32GB RAM |
| **Hard disk space** | 1GB for logging | 5GB for logging | 20GB for logging |
These recommendations should be considered a baseline and may need to be increased depending on the size and complexity of your environments.
Minimums apply to test or development deployments.
Where multiple collectors are deployed on a single host, scaling will be necessary to maintain performance.
### Software
* Windows Server 2019+
* .NET 4.7.2+
### Network
SharpHound Enterprise needs outbound access to your BloodHound Enterprise tenant and to at least one domain controller in each domain you collect. Additional ports are required only for specific collection methods.
#### Baseline Connectivity
| Destination | Protocol / port | Applies to | Notes |
| - | - | - | - |
| BloodHound Enterprise SaaS tenant URL | TLS `443/TCP` | All deployments | Proxy is supported |
| At least one domain controller in each collected domain | LDAPS `636/TCP` | Active Directory collection | Configurable with `LDAPSSLPort` |
| At least one domain controller in each collected domain | LDAP `389/TCP` | Active Directory collection fallback | Configurable with `LDAPPort` |
SharpHound attempts LDAP over SSL first. If LDAPS is unavailable and `ForceLDAPSSL` is disabled, SharpHound falls back to signed and sealed LDAP on the configured LDAP port. SharpHound uses [LDAP channel signing](https://www.hub.trimarcsecurity.com/post/ldap-channel-binding-and-signing) for all queries.
`ForceLDAPSSL` is a best-effort control for SharpHound's primary LDAP collection path, not a blanket guarantee that every directory-related operation during collection avoids non-LDAPS resolution paths.
Some LDAP negotiation or AD structure resolution may still occur through existing .NET APIs. Do not assume that blocking TCP `389` is safe in every deployment without validating collector behavior in your deployed version.
#### Optional Connectivity
| Collection method | Protocol / port | Destination | Notes |
| - | - | - | - |
| [Privileged collection](/collect-data/enterprise-collection/privileged-collection) | SMB/RPC `445/TCP` | All in-scope domain-joined Windows systems | Required for host-based privileged collection |
| [Privileged collection](/collect-data/enterprise-collection/privileged-collection) | SMB/RPC `135/TCP` | All in-scope domain-joined Windows systems | Required for NTLM relay-based collection |
| [DC Registry and CA Registry collection](/collect-data/sharphound-data-permissions) | SMB/RPC `445/TCP` | All domain controllers and domain-joined CAs | Required for registry-based collection |
Expected network bandwidth for privileged collection is approximately `60-100 kB` per collection.
## Service Account Requirements
Run the SharpHound Enterprise service under a domain-joined account that has the **Log on as a service** User Rights Assignment on the SharpHound Enterprise server. This account can be a traditional user account or a [Group Managed Service Account (gMSA)](/install-data-collector/install-sharphound/create-gmsa).
The service account needs permissions to collect data from your target domains and domain-joined systems as detailed in [SharpHound Data Collection and Permissions](/collect-data/sharphound-data-permissions).
We recommend following [SharpHound Enterprise Service Hardening](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening).
The SharpHound collection service account does not require `Domain Admin` membership.
| Data type | Default permissions | Least-privileged option |
| - | - | - |
| [Active Directory Structure](/collect-data/sharphound-data-permissions#active-directory-structure-data) | `Authenticated Users` can read most required data via LDAP | Delegate additional read permissions where needed (for example, restricted AD objects and dMSA) |
| [Local Group Membership](/collect-data/sharphound-data-permissions#local-group-membership) | Local `Administrators` | Delegate Remote SAM access with Group Policy configuration |
| [User Rights Assignments](/collect-data/sharphound-data-permissions#user-rights-assignments) | Local `Administrators` | No known delegation path today |
| [NTLM](/collect-data/sharphound-data-permissions#ntlm) | Local `Administrators` | Delegate registry access with Group Policy or registry configuration |
| [Sessions](/collect-data/sharphound-data-permissions#sessions) | Local `Administrators` | On Windows Server, `Print Operators` can be used; Windows desktops still require local `Administrators` |
| [Certificate Services](/collect-data/sharphound-data-permissions#certificate-services) | `Authenticated Users` can collect most ADCS LDAP data | Already least-privileged by default for LDAP-collected certificate services data |
| [CA Registry](/collect-data/sharphound-data-permissions#ca-registry) | `Authenticated Users` can collect CA registry data when AD CS is installed | No additional delegation is typically required |
| [DC Registry](/collect-data/sharphound-data-permissions#dc-registry) | Local `Administrators` on domain controllers | Delegate access via Group Policy or registry configuration for required paths |
If Active Directory tombstoning is enabled, the service account must also have [read permissions](https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/non-administrators-view-deleted-object-container) on the deleted objects container.
### Integrated Windows Authentication (IWA)
If you want to use IWA for SharpHound, the following additional requirements apply:
* Active Directory Federation Services (ADFS) server must be accessible in your network environment
Both the system running SharpHound and the BloodHound Enterprise tenant require network connectivity to the ADFS server.
* Service account must be [configured](/install-data-collector/install-sharphound/configure-adfs-iwa) in ADFS to support Windows authentication for SharpHound
* Generated Client ID must be registered in ADFS and the issued token must contain the generated Client ID or configured Custom Client Identifier in the claim BloodHound uses for client lookup (provided during [collector client creation](/collect-data/enterprise-collection/create-collector))
* Local SharpHound configuration must include [IWA-specific properties](/install-data-collector/install-sharphound/local-configuration#integrated-windows-authentication-iwa) in the `settings.json` file