Sysinternals AD Explorer Guide: Compare Active Directory Snapshots Securely

What AD Explorer is for​

AD Explorer is not a replacement for Active Directory Users and Computers (ADUC). ADUC is the console for guided daily administration. AD Explorer is for the moments when you need raw visibility:

• Objects and their attributes
• Schema definitions
• Security descriptors
• Reusable searches
• Offline snapshots that can be compared

That split is practical guidance, not a Microsoft product rule. ADUC can show plenty of detail, and AD Explorer is not faster for every task. Treat it as a diagnostic instrument, not a daily driver.

Getting started​

1. Download the standalone tool or run it from Sysinternals Live. Extract it if needed, then launch ADExplorer.exe.
2. Accept the license agreement on first launch.
3. In the connection dialog, enter a domain controller or domain name. Supply credentials only if your current Windows credentials aren't appropriate.

The tool is portable, so no traditional installation is needed. In managed environments, follow your organization's software-approval and code-signing rules.

Use the least privilege that works​

AD Explorer acts with the permissions of the account you connect with. Read access is enough for browsing and most investigations, and edits need matching delegated rights. Domain Admin should not be the default.

This matters because AD Explorer is an editor, not just a viewer. One community walkthrough compares the care needed to working in the registry editor. It notes the tool can create new objects; copy, rename or delete objects. Browse with a read-only account. Elevate only for a specific, approved correction.

Create and compare snapshots​

A snapshot saves the directory for offline viewing. Microsoft's documentation says you can see what objects, attributes, and security permissions changed between two snapshots.

Capture a baseline​

1. Connect to the live directory.
2. Choose File > Create Snapshot.
3. Add a descriptive comment and choose a protected save location.
4. Set a throttle suited to your environment. The throttle slows the scan to reduce load on the domain controller. No single value is right for every directory.
5. Use names that sort chronologically, such as AD-Baseline-2026-10-09.snp.

AD Explorer may not show a progress bar. One third-party walkthrough notes there is unfortunately no progress bar to show how long it will take to complete. Be patient on large directories.

Compare two states​

1. Open the earlier snapshot through File > Connect and choose the option to load a snapshot file.
2. With that snapshot selected, choose Compare > Compare Snapshot.
3. Select the later snapshot.
4. Limit the comparison to the relevant classes and attributes, and filter volatile values so the results stay readable.
5. Double-click a difference to jump to the affected object.
6. When delegated permissions are the concern, use the separate security comparison.

What success looks like​

You get a list of differences between the two captured states. Each one navigates to the object in the loaded snapshot. If the list is enormous, narrow the classes and attributes and rerun the comparison.

Scheduled captures​

AD Explorer supports unattended capture through a -snapshot option. It takes a connection string and an output filename. The documented example captures the default domain with an empty connection string:

adexplorer -snapshot "" c:\snapshots\snapshot1.snp

Wrapping this in Windows Task Scheduler is a common administrator approach, not a Microsoft-prescribed procedure. A sensible setup:

• Run it daily, weekly or around change windows.
• Use an account with read access to the directory and write access to the snapshot folder.
• Generate a unique, sortable filename for each run with a script or date variable.
• Set the task to run whether or not anyone is signed in.
• Test the exact command interactively first.
• Check the task history, and open a snapshot now and then to confirm it is complete.

Suppose an application stops authenticating on Wednesday. Comparing Tuesday's and Wednesday's snapshots can show which user, service account, group membership, SPN or permission values differ. That narrows the search considerably. It does not prove a given difference caused the failure.

Limits to keep in mind​

• Snapshots are not backups. You can't restore or roll back from one. TechTarget's tutorial makes the same point, saying you can't restore or roll back with it. A Microsoft Tech Community post says the same, warning against confusing it with a Hyper-V checkpoint.
• Snapshots don't show who or when. They show differences between two captured moments. Use directory auditing for attribution and proper backups for recovery.
• Offline snapshots are read-only. To change a value, reconnect to the live directory with suitable rights.
• Store snapshots securely and set retention limits. This is good security practice, not a built-in feature.

The security flip side​

A full copy of your directory is valuable to attackers as well as administrators. Detection vendors and researchers flag -snapshot use as possible reconnaissance. Sigma's rule description says attackers can use it to extract data for BloodHound. The same rule says the snapshot doesn't contain password hashes, but notes administrators have sometimes put passwords in comment fields.

Practical takeaways for defenders:

• Treat snapshot files as sensitive data, and keep them off shared or user-writable paths.
• Consider alerting on ADExplorer process launches with -snapshot in the command line, especially from unusual locations.
• Review attributes such as description and comment fields for secrets. This is a good habit whether or not you use AD Explorer.
• Whitelist your own scheduled capture task so it doesn't bury real alerts.

Bottom line​

Use AD Explorer when ADUC can't explain what you're seeing. Capture snapshots before significant changes, or on a schedule. Compare them to narrow an incident to a window, then confirm cause and attribution through auditing and logs. Keep your accounts least-privileged and your snapshot files locked down.