I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound include such users)?

If BloodHound doesn't consider local users, what is the reason for that? Credentials of local users might still of interest in escalation domain privileges by password reuse.


Bloodhound uses active directory searches and maps only accounts it can guarantee have the same password . It cannot guarantee local non ad accounts have the same password so it does not include them .

This is a relevant issue link


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.