How can `csvde` be used to extract Active Directory information without being blocked by antivirus?
`csvde` is a built-in Windows command-line tool that exports AD data in CSV format, and it is typically not flagged by antivirus. For example, to export all users in the current domain, you can run `csvde -f user.csv -r "(&(objectCategory=person))"`. It can also be used remotely with the `-s` and `-a` parameters. More details on running `csvde` on older systems can be found in Penetration Basics - Running csvde on Windows 7.
csvdeActive DirectoryexportCSVantivirus bypassLDAP filter