From 076f41df747ae9d04a49e12e5933fd87c55aec7c Mon Sep 17 00:00:00 2001
From: Rohan Vazarkar <rvazarkar@specterops.io>
Date: Mon, 9 Dec 2024 10:41:05 -0500
Subject: [PATCH 1/5] feat: initial NTLM commit

---
 src/CommonLib/Enums/CollectionMethod.cs       |  12 +-
 src/CommonLib/Enums/LdapErrorCodes.cs         |   4 +-
 src/CommonLib/Enums/LdapOption.cs             |  14 +
 src/CommonLib/Enums/LdapOptionValue.cs        |  15 +
 .../Enums/LdapSupportedSaslMechansims.cs      |  16 +
 src/CommonLib/LdapConnectionPool.cs           |   2 +-
 src/CommonLib/LdapProducerQueryGenerator.cs   |   4 +-
 src/CommonLib/LdapUtils.cs                    | 224 +++---
 src/CommonLib/Ntlm/HttpClientFactory.cs       |  45 ++
 .../Ntlm/HttpNtlmAuthenticationService.cs     | 205 ++++++
 src/CommonLib/Ntlm/HttpTransport.cs           |  69 ++
 src/CommonLib/Ntlm/INtlmTransport.cs          |  10 +
 src/CommonLib/Ntlm/LdapException.cs           |  16 +
 src/CommonLib/Ntlm/LdapNative.cs              | 346 +++++++++
 src/CommonLib/Ntlm/LdapTransport.cs           | 119 +++
 .../Ntlm/NtlmAuthenticationHandler.cs         |  64 ++
 src/CommonLib/OutputTypes/APIResult.cs        |  46 +-
 src/CommonLib/OutputTypes/CAHttpEndpoint.cs   |  67 ++
 src/CommonLib/OutputTypes/Computer.cs         |  56 +-
 src/CommonLib/OutputTypes/EnterpriseCA.cs     |   1 +
 src/CommonLib/OutputTypes/NtlmSession.cs      | 113 +++
 .../Processors/CAEnrollmentProcessor.cs       | 235 ++++++
 .../Processors/ComputerSessionProcessor.cs    |   2 +-
 src/CommonLib/Processors/DCLdapProcessor.cs   | 291 ++++++++
 src/CommonLib/Processors/EventLogProcessor.cs | 332 +++++++++
 src/CommonLib/Processors/SmbProcessor.cs      | 429 +++++++++++
 .../UserRightsAssignmentProcessor.cs          |   2 +-
 .../Processors/WebClientServiceProcessor.cs   |  99 +++
 src/CommonLib/Properties/launchSettings.json  |   8 +
 src/CommonLib/SharpHoundCommonLib.csproj      |   4 +-
 .../ThirdParty/PSOpenAD/Authentication.cs     | 515 +++++++++++++
 src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs     | 676 ++++++++++++++++++
 32 files changed, 3941 insertions(+), 100 deletions(-)
 create mode 100644 src/CommonLib/Enums/LdapOption.cs
 create mode 100644 src/CommonLib/Enums/LdapOptionValue.cs
 create mode 100644 src/CommonLib/Enums/LdapSupportedSaslMechansims.cs
 create mode 100644 src/CommonLib/Ntlm/HttpClientFactory.cs
 create mode 100644 src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
 create mode 100644 src/CommonLib/Ntlm/HttpTransport.cs
 create mode 100644 src/CommonLib/Ntlm/INtlmTransport.cs
 create mode 100644 src/CommonLib/Ntlm/LdapException.cs
 create mode 100644 src/CommonLib/Ntlm/LdapNative.cs
 create mode 100644 src/CommonLib/Ntlm/LdapTransport.cs
 create mode 100644 src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
 create mode 100644 src/CommonLib/OutputTypes/CAHttpEndpoint.cs
 create mode 100644 src/CommonLib/OutputTypes/NtlmSession.cs
 create mode 100644 src/CommonLib/Processors/CAEnrollmentProcessor.cs
 create mode 100644 src/CommonLib/Processors/DCLdapProcessor.cs
 create mode 100644 src/CommonLib/Processors/EventLogProcessor.cs
 create mode 100644 src/CommonLib/Processors/SmbProcessor.cs
 create mode 100644 src/CommonLib/Processors/WebClientServiceProcessor.cs
 create mode 100644 src/CommonLib/Properties/launchSettings.json
 create mode 100644 src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
 create mode 100644 src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs

diff --git a/src/CommonLib/Enums/CollectionMethod.cs b/src/CommonLib/Enums/CollectionMethod.cs
index 0b5959e1..76bbd402 100644
--- a/src/CommonLib/Enums/CollectionMethod.cs
+++ b/src/CommonLib/Enums/CollectionMethod.cs
@@ -25,10 +25,14 @@ public enum CollectionMethod
         CARegistry = 1 << 16,
         DCRegistry = 1 << 17,
         CertServices = 1 << 18,
+        LdapServices = 1 << 19,
+        WebClientService = 1 << 21,
+        SmbInfo = 1 << 22,
+        EventLogs = 1 << 23,
         LocalGroups = DCOM | RDP | LocalAdmin | PSRemote,
-        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry,
-        DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup | CertServices,
-        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices,
-        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry
+        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry | WebClientService | SmbInfo | EventLogs,
+        DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup | CertServices | LdapServices | SmbInfo,
+        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices | LdapServices | SmbInfo,
+        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry | WebClientService | LdapServices | EventLogs
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapErrorCodes.cs b/src/CommonLib/Enums/LdapErrorCodes.cs
index becf71c4..65a52ac6 100644
--- a/src/CommonLib/Enums/LdapErrorCodes.cs
+++ b/src/CommonLib/Enums/LdapErrorCodes.cs
@@ -3,10 +3,12 @@
     public enum LdapErrorCodes : int
     {
         Success = 0,
+        StrongAuthRequired = 8,
+        SaslBindInProgress = 14,
         InvalidCredentials = 49,
         Busy = 51,
         ServerDown = 81,
         LocalError = 82,
-        KerberosAuthType = 83
+        KerberosAuthType = 83,
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapOption.cs b/src/CommonLib/Enums/LdapOption.cs
new file mode 100644
index 00000000..084cbff2
--- /dev/null
+++ b/src/CommonLib/Enums/LdapOption.cs
@@ -0,0 +1,14 @@
+namespace SharpHoundCommonLib.Enums
+{
+    public enum LdapOption : int
+    {
+        Ssl = 0x0A,
+        ProtocolVersion = 0x11,
+        ResultCode = 0x31,
+        ServerError = 0x33,
+        ServerCertificate = 0x81,
+        Sign = 0x95,
+        Encrypt = 0x96,
+        Timeout = 0x5002,
+    }
+}
diff --git a/src/CommonLib/Enums/LdapOptionValue.cs b/src/CommonLib/Enums/LdapOptionValue.cs
new file mode 100644
index 00000000..857c9b92
--- /dev/null
+++ b/src/CommonLib/Enums/LdapOptionValue.cs
@@ -0,0 +1,15 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Enums
+{
+    public enum LdapOptionValue : int
+    {
+        Off = 0,
+        On = 1,
+        Version3 = 3,
+    };
+}
diff --git a/src/CommonLib/Enums/LdapSupportedSaslMechansims.cs b/src/CommonLib/Enums/LdapSupportedSaslMechansims.cs
new file mode 100644
index 00000000..c2f84fbc
--- /dev/null
+++ b/src/CommonLib/Enums/LdapSupportedSaslMechansims.cs
@@ -0,0 +1,16 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Enums
+{
+    public static class LdapSupportedSaslMechansims
+    {
+        public const string GSSAPI = "GSSAPI";
+        public const string GSS_SPNEGO = "GSS-SPNEGO";
+        public const string EXTERNAL = "EXTERNAL";
+        public const string DIGEST_MD5 = "DIGEST_MD5";
+    }
+}
diff --git a/src/CommonLib/LdapConnectionPool.cs b/src/CommonLib/LdapConnectionPool.cs
index fe0cb5a7..3f6ee8ab 100644
--- a/src/CommonLib/LdapConnectionPool.cs
+++ b/src/CommonLib/LdapConnectionPool.cs
@@ -19,7 +19,7 @@ namespace SharpHoundCommonLib {
     internal class LdapConnectionPool : IDisposable{
         private readonly ConcurrentBag<LdapConnectionWrapper> _connections;
         private readonly ConcurrentBag<LdapConnectionWrapper> _globalCatalogConnection;
-        private readonly SemaphoreSlim _semaphore;
+        private readonly SemaphoreSlim _semaphore = null;
         private readonly string _identifier;
         private readonly string _poolIdentifier;
         private readonly LdapConfig _ldapConfig;
diff --git a/src/CommonLib/LdapProducerQueryGenerator.cs b/src/CommonLib/LdapProducerQueryGenerator.cs
index 0d6580f8..fb0be38b 100644
--- a/src/CommonLib/LdapProducerQueryGenerator.cs
+++ b/src/CommonLib/LdapProducerQueryGenerator.cs
@@ -46,7 +46,7 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
             if (methods.HasFlag(CollectionMethod.SPNTargets))
                 properties.AddRange(CommonProperties.SPNTargetProps);
 
-            if (methods.HasFlag(CollectionMethod.DCRegistry))
+            if (methods.HasFlag(CollectionMethod.DCRegistry) || methods.HasFlag(CollectionMethod.LdapServices))
                 properties.AddRange(CommonProperties.ComputerMethodProps);
 
             if (methods.HasFlag(CollectionMethod.SPNTargets)) {
@@ -79,7 +79,7 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
             properties.AddRange(CommonProperties.GPOLocalGroupProps);
         }
 
-        if (methods.HasFlag(CollectionMethod.DCRegistry)) {
+        if (methods.HasFlag(CollectionMethod.DCRegistry) || methods.HasFlag(CollectionMethod.LdapServices)) {
             filter = filter.AddComputers(CommonFilters.DomainControllers);
             properties.AddRange(CommonProperties.ComputerMethodProps);
         }
diff --git a/src/CommonLib/LdapUtils.cs b/src/CommonLib/LdapUtils.cs
index a9166aff..68123258 100644
--- a/src/CommonLib/LdapUtils.cs
+++ b/src/CommonLib/LdapUtils.cs
@@ -1143,8 +1143,10 @@ internal static bool ResolveLabel(string objectIdentifier, string distinguishedN
         }
 
         public static async Task<(bool Success, ResolvedSearchResult ResolvedResult)> ResolveSearchResult(
-            IDirectoryObject directoryObject, ILdapUtils utils) {
-            if (!directoryObject.GetObjectIdentifier(out var objectIdentifier)) {
+            IDirectoryObject directoryObject, ILdapUtils utils)
+        {
+            if (!directoryObject.GetObjectIdentifier(out var objectIdentifier))
+            {
                 return (false, default);
             }
 
@@ -1153,14 +1155,17 @@ internal static bool ResolveLabel(string objectIdentifier, string distinguishedN
             };
 
             //If the object is deleted, we can short circuit the rest of this logic as we don't really care about anything else
-            if (directoryObject.IsDeleted()) {
+            if (directoryObject.IsDeleted())
+            {
                 res.Deleted = true;
                 return (true, res);
             }
 
-            if (directoryObject.TryGetLongProperty(LDAPProperties.UserAccountControl, out var rawUac)) {
+            if (directoryObject.TryGetLongProperty(LDAPProperties.UserAccountControl, out var rawUac))
+            {
                 var flags = (UacFlags)rawUac;
-                if (flags.HasFlag(UacFlags.ServerTrustAccount)) {
+                if (flags.HasFlag(UacFlags.ServerTrustAccount))
+                {
                     res.IsDomainController = true;
                     utils.AddDomainController(objectIdentifier);
                 }
@@ -1168,24 +1173,35 @@ internal static bool ResolveLabel(string objectIdentifier, string distinguishedN
 
             string domain;
 
-            if (directoryObject.TryGetDistinguishedName(out var distinguishedName)) {
+            if (directoryObject.TryGetDistinguishedName(out var distinguishedName))
+            {
                 domain = Helpers.DistinguishedNameToDomain(distinguishedName);
-            } else {
+            }
+            else
+            {
                 if (objectIdentifier.StartsWith("S-1-5") &&
-                    await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName)) {
+                    await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName))
+                {
                     domain = domainName;
-                } else {
+                }
+                else
+                {
                     return (false, default);
                 }
             }
 
             string domainSid;
             var match = SIDRegex.Match(objectIdentifier);
-            if (match.Success) {
+            if (match.Success)
+            {
                 domainSid = match.Groups[1].Value;
-            } else if (await utils.GetDomainSidFromDomainName(domain) is (true, var sid)) {
+            }
+            else if (await utils.GetDomainSidFromDomainName(domain) is (true, var sid))
+            {
                 domainSid = sid;
-            } else {
+            }
+            else
+            {
                 Logging.Logger.LogWarning("Failed to resolve domain sid for object {Identifier}", objectIdentifier);
                 domainSid = null;
             }
@@ -1193,112 +1209,160 @@ await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName)) {
             res.Domain = domain;
             res.DomainSid = domainSid;
 
-            if (WellKnownPrincipal.GetWellKnownPrincipal(objectIdentifier, out var wellKnownPrincipal)) {
+            if (WellKnownPrincipal.GetWellKnownPrincipal(objectIdentifier, out var wellKnownPrincipal))
+            {
                 res.DisplayName = $"{wellKnownPrincipal.ObjectIdentifier}@{domain}";
                 res.ObjectType = wellKnownPrincipal.ObjectType;
-                if (await utils.GetWellKnownPrincipal(objectIdentifier, domain) is (true, var convertedPrincipal)) {
+                if (await utils.GetWellKnownPrincipal(objectIdentifier, domain) is (true, var convertedPrincipal))
+                {
                     res.ObjectId = convertedPrincipal.ObjectIdentifier;
                 }
 
                 return (true, res);
             }
 
-            if (!directoryObject.GetLabel(out var label)) {
-                if (await utils.ResolveIDAndType(objectIdentifier, domain) is (true, var typedPrincipal)) {
+            res.ObjectType = await ComputeLabel(directoryObject, objectIdentifier, domain, utils);
+
+            directoryObject.TryGetProperty(LDAPProperties.SAMAccountName, out var samAccountName);
+            res.DisplayName = ComputeDisplayName(directoryObject, domain, res.ObjectType, samAccountName);
+            return (true, res);
+        }
+
+        private static async Task<Label> ComputeLabel(IDirectoryObject directoryObject, string objectIdentifier, string domain, ILdapUtils utils)
+        {
+            if (!directoryObject.GetLabel(out var label))
+            {
+                if (await utils.ResolveIDAndType(objectIdentifier, domain) is (true, var typedPrincipal))
+                {
                     label = typedPrincipal.ObjectType;
                 }
             }
 
-            if (directoryObject.IsMSA() || directoryObject.IsGMSA()) {
+            if (directoryObject.IsMSA() || directoryObject.IsGMSA())
+            {
                 label = Label.User;
             }
 
-            res.ObjectType = label;
-
-            directoryObject.TryGetProperty(LDAPProperties.SAMAccountName, out var samAccountName);
+            return label;
+        }
 
-            switch (label) {
+        private static string ComputeDisplayName(IDirectoryObject directoryObject, string domain, Label label, string samAccountName)
+        {
+            string displayName;
+            switch (label)
+            {
                 case Label.User:
                 case Label.Group:
                 case Label.Base:
-                    res.DisplayName = $"{samAccountName}@{domain}";
+                    displayName = $"{samAccountName}@{domain}";
                     break;
-                case Label.Computer: {
-                    var shortName = samAccountName?.TrimEnd('$');
-                    if (directoryObject.TryGetProperty(LDAPProperties.DNSHostName, out var dns)) {
-                        res.DisplayName = dns;
-                    } else if (!string.IsNullOrWhiteSpace(shortName)) {
-                        res.DisplayName = $"{shortName}.{domain}";
-                    } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
-                                   out var canonicalName)) {
-                        res.DisplayName = $"{canonicalName}.{domain}";
-                    } else if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}.{domain}";
-                    } else {
-                        res.DisplayName = $"UNKNOWN.{domain}";
-                    }
+                case Label.Computer:
+                    {
+                        var shortName = samAccountName?.TrimEnd('$');
+                        if (directoryObject.TryGetProperty(LDAPProperties.DNSHostName, out var dns))
+                        {
+                            displayName = dns;
+                        }
+                        else if (!string.IsNullOrWhiteSpace(shortName))
+                        {
+                            displayName = $"{shortName}.{domain}";
+                        }
+                        else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
+                                       out var canonicalName))
+                        {
+                            displayName = $"{canonicalName}.{domain}";
+                        }
+                        else if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
+                        {
+                            displayName = $"{name}.{domain}";
+                        }
+                        else
+                        {
+                            displayName = $"UNKNOWN.{domain}";
+                        }
 
-                    break;
-                }
-                case Label.GPO:
-                case Label.IssuancePolicy: {
-                    if (directoryObject.TryGetProperty(LDAPProperties.DisplayName, out var displayName)) {
-                        res.DisplayName = $"{displayName}@{domain}";
-                    } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
-                                   out var canonicalName)) {
-                        res.DisplayName = $"{canonicalName}@{domain}";
-                    } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
+                        break;
                     }
+                case Label.GPO:
+                case Label.IssuancePolicy:
+                    {
+                        if (directoryObject.TryGetProperty(LDAPProperties.DisplayName, out var ldapDisplayName))
+                        {
+                            displayName = $"{ldapDisplayName}@{domain}";
+                        }
+                        else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
+                                       out var canonicalName))
+                        {
+                            displayName = $"{canonicalName}@{domain}";
+                        }
+                        else
+                        {
+                            displayName = $"UNKNOWN@{domain}";
+                        }
 
-                    break;
-                }
+                        break;
+                    }
                 case Label.Domain:
-                    res.DisplayName = domain;
+                    displayName = domain;
                     break;
-                case Label.OU: {
-                    if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}@{domain}";
-                    } else if (directoryObject.TryGetProperty(LDAPProperties.OU, out var ou)) {
-                        res.DisplayName = $"{ou}@{domain}";
-                    } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
-                    }
+                case Label.OU:
+                    {
+                        if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
+                        {
+                            displayName = $"{name}@{domain}";
+                        }
+                        else if (directoryObject.TryGetProperty(LDAPProperties.OU, out var ou))
+                        {
+                            displayName = $"{ou}@{domain}";
+                        }
+                        else
+                        {
+                            displayName = $"UNKNOWN@{domain}";
+                        }
 
-                    break;
-                }
-                case Label.Container: {
-                    if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}@{domain}";
-                    } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
-                                   out var canonicalName)) {
-                        res.DisplayName = $"{canonicalName}@{domain}";
-                    } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
+                        break;
                     }
+                case Label.Container:
+                    {
+                        if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
+                        {
+                            displayName = $"{name}@{domain}";
+                        }
+                        else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
+                                       out var canonicalName))
+                        {
+                            displayName = $"{canonicalName}@{domain}";
+                        }
+                        else
+                        {
+                            displayName = $"UNKNOWN@{domain}";
+                        }
 
-                    break;
-                }
+                        break;
+                    }
                 case Label.Configuration:
                 case Label.RootCA:
                 case Label.AIACA:
                 case Label.NTAuthStore:
                 case Label.EnterpriseCA:
-                case Label.CertTemplate: {
-                    if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}@{domain}";
-                    } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
-                    }
+                case Label.CertTemplate:
+                    {
+                        if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
+                        {
+                            displayName = $"{name}@{domain}";
+                        }
+                        else
+                        {
+                            displayName = $"UNKNOWN@{domain}";
+                        }
 
-                    break;
-                }
+                        break;
+                    }
                 default:
                     throw new ArgumentOutOfRangeException();
             }
 
-            res.DisplayName = res.DisplayName.ToUpper();
-            return (true, res);
+            return displayName.ToUpper();
         }
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/HttpClientFactory.cs b/src/CommonLib/Ntlm/HttpClientFactory.cs
new file mode 100644
index 00000000..227c168b
--- /dev/null
+++ b/src/CommonLib/Ntlm/HttpClientFactory.cs
@@ -0,0 +1,45 @@
+using System;
+using System.Net;
+using System.Net.Http;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public interface IHttpClientFactory
+{
+    HttpClient CreateUnauthenticatedClient();
+    HttpClient CreateAuthenticatedHttpClient(Uri Url, string authPackage = "Kerberos");
+}
+
+public class HttpClientFactory : IHttpClientFactory
+{
+    public HttpClient CreateUnauthenticatedClient()
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, cetChain, policyErrors) => true,
+            UseDefaultCredentials = false
+        };
+
+        return new HttpClient(handler);
+    }
+
+    public HttpClient CreateAuthenticatedHttpClient(Uri Url, string authPackage = "Kerberos")
+    {
+        var handler = new HttpClientHandler
+        {
+            Credentials = new CredentialCache()
+            {
+                { Url, authPackage, CredentialCache.DefaultNetworkCredentials }
+            },
+
+            PreAuthenticate = true,
+            ServerCertificateCustomValidationCallback =
+                (httpRequestMessage, cert, cetChain, policyErrors) =>
+                {
+                    return true;
+                },
+        };
+
+        return new HttpClient(handler);
+    }
+}
diff --git a/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
new file mode 100644
index 00000000..0f9924bc
--- /dev/null
+++ b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
@@ -0,0 +1,205 @@
+using Microsoft.Extensions.Logging;
+using System;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Security.Authentication;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class HttpNtlmAuthenticationService
+{
+    private readonly ILogger _logger;
+    private readonly IHttpClientFactory _httpClientFactory;
+    public Uri Url { get; set; }
+
+    public HttpNtlmAuthenticationService(ILogger logger, IHttpClientFactory httpClientFactory)
+    {
+        _logger = logger;
+        _httpClientFactory = httpClientFactory;
+    }
+
+    public async Task EnsureRequiresAuth(bool enableSigning, bool? useBadChannelBindings)
+    {
+        if (Url == null)
+            throw new ArgumentException("Url property is null");
+
+        if (useBadChannelBindings == null && Url.Scheme == "https")
+            throw new ArgumentException("When using HTTPS, useBadChannelBindings must be set");
+
+        var supportedAuthSchemes = await GetSupportedNtlmAuthSchemesAsync(Url);
+
+        _logger.LogDebug($"Supported NTLM auth schemes for {Url}: " + String.Join(",", supportedAuthSchemes));
+
+        foreach (var authScheme in supportedAuthSchemes)
+        {
+            if (useBadChannelBindings == null)
+            {
+                await AuthWithBadChannelBindings(Url, authScheme);
+            }
+            else
+            {
+                if((bool)useBadChannelBindings)
+                {
+                    await AuthWithBadChannelBindings(Url, authScheme);
+                }
+                else
+                {
+                    await AuthWithChannelBindingAsync(Url, authScheme);
+                }
+                    
+            }
+
+            // If we've got here, everything has worked and it's accessible, so return
+            return;
+        }
+    }
+
+    private async Task<string[]> GetSupportedNtlmAuthSchemesAsync(Uri url)
+    {
+        var httpClient = _httpClientFactory.CreateUnauthenticatedClient();
+
+        using var getRequest = new HttpRequestMessage(HttpMethod.Get, url);
+        using var getResponse = await httpClient.SendAsync(getRequest);
+        return ExtractAuthSchemes(getResponse);
+    }
+
+    private string[] ExtractAuthSchemes(HttpResponseMessage response)
+    {
+        if (response.StatusCode == HttpStatusCode.OK)
+        {
+            throw new AuthNotRequiredException("Authorization was not solicited when enumerating Authentication schemes");
+        }
+
+        // We expect to get an Unauthorized. If not, something is off
+        if (response.StatusCode != HttpStatusCode.Unauthorized)
+        {
+            if (response.StatusCode == HttpStatusCode.Forbidden)
+            {
+                throw new HttpForbiddenException("Forbidden when enumerating Auth schemes");
+            }
+            else if (response.StatusCode == HttpStatusCode.InternalServerError)
+            {
+                throw new HttpServerErrorException("Server Error when enumerating Auth schemes");
+            }
+            else
+            {
+                // Use .NET's exceptions to make things easy
+                response.EnsureSuccessStatusCode();
+            }
+        }
+
+        if (response.Headers.WwwAuthenticate == null)
+        {
+            throw new InvalidOperationException("WWW-Authenticate header is missing");
+        }
+
+        var schemes = response.Headers.WwwAuthenticate
+            .Select(header => header.Scheme)
+            .Where(scheme => scheme == "NTLM" || scheme == "Negotiate")
+            .Distinct()
+            .ToArray();
+
+        return schemes;
+    }
+
+    private async Task AuthWithBadChannelBindings(Uri url, string authScheme)
+    {
+        var httpClient = _httpClientFactory.CreateUnauthenticatedClient();
+        var transport = new HttpTransport(_logger, httpClient, url, authScheme);
+        var ntlmAuthHandler = new NtlmAuthenticationHandler(_logger, url.Host, $"HTTP/{url.Host}");
+
+        var response = (HttpResponseMessage)await ntlmAuthHandler.PerformNtlmAuthenticationAsync(transport);
+
+        if (response.StatusCode == HttpStatusCode.OK)
+        {
+            return;
+        }
+        else if(response.StatusCode == HttpStatusCode.Unauthorized)
+        {
+            throw new HttpUnauthorizedException($"401 Unauthorized when accessing {url} with {authScheme} and no signing");
+        }
+        else if(response.StatusCode == HttpStatusCode.Forbidden)
+        {
+            throw new HttpForbiddenException($"403 Forbidden when accessing {url} with {authScheme} and no signing");
+        }
+
+        response.EnsureSuccessStatusCode();
+    }
+
+    private async Task<bool> AuthWithChannelBindingAsync(Uri url, string authScheme)
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, cetChain, policyErrors) => true,
+        };
+
+        var credentialCache = new CredentialCache();
+        credentialCache.Add(url, authScheme, CredentialCache.DefaultNetworkCredentials);
+
+        handler.Credentials = credentialCache;
+        handler.PreAuthenticate = true;
+
+        using var client = new HttpClient(handler);
+
+        try
+        {
+            HttpResponseMessage response = await client.GetAsync(url);
+            return response.StatusCode == HttpStatusCode.OK;
+        }
+        catch (AuthenticationException ex)
+        {
+            _logger.LogWarning(ex, $"Authentication failed for {url} with {authScheme}");
+            return false;
+        }
+    }
+}
+
+[Serializable]
+internal class HttpUnauthorizedException : Exception
+{
+    public HttpUnauthorizedException()
+    {
+    }
+
+    public HttpUnauthorizedException(string message) : base(message)
+    {
+    }
+}
+
+[Serializable]
+internal class HttpForbiddenException : Exception
+{
+    public HttpForbiddenException()
+    {
+    }
+
+    public HttpForbiddenException(string message) : base(message)
+    {
+    }
+}
+
+[Serializable]
+internal class HttpServerErrorException : Exception
+{
+    public HttpServerErrorException()
+    {
+    }
+
+    public HttpServerErrorException(string message) : base(message)
+    {
+    }
+}
+
+[Serializable]
+internal class AuthNotRequiredException : Exception
+{
+    public AuthNotRequiredException()
+    {
+    }
+
+    public AuthNotRequiredException(string message) : base(message)
+    {
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/HttpTransport.cs b/src/CommonLib/Ntlm/HttpTransport.cs
new file mode 100644
index 00000000..4c84739e
--- /dev/null
+++ b/src/CommonLib/Ntlm/HttpTransport.cs
@@ -0,0 +1,69 @@
+using Microsoft.Extensions.Logging;
+using System;
+using System.Linq;
+using System.Net.Http;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class HttpTransport : INtlmTransport
+{
+    private readonly ILogger _logger;
+    private readonly HttpClient _httpClient;
+    private readonly Uri _url;
+    private readonly string _authScheme;
+
+    public HttpTransport(ILogger logger, HttpClient httpClient, Uri url, string authScheme)
+    {
+        _logger = logger;
+        _httpClient = httpClient;
+        _url = url;
+        _authScheme = authScheme;
+    }
+
+    public async Task<byte[]> NegotiateAsync(byte[] negotiateMessage)
+    {
+        var requestMessage = new HttpRequestMessage(HttpMethod.Get, _url);
+        var messageBase64 = Convert.ToBase64String(negotiateMessage);
+        requestMessage.Headers.Add("Authorization", $"{_authScheme} {messageBase64}");
+
+        var response = await _httpClient.SendAsync(requestMessage);
+
+        if (!response.Headers.Contains("WWW-Authenticate"))
+        {
+            throw new InvalidOperationException("No WWW-Authenticate header found in response");
+        }
+
+        var authHeaders = response.Headers.WwwAuthenticate.Where(a => a.Scheme == _authScheme);
+        if (!authHeaders.Any())
+        {
+            throw new InvalidOperationException($"No WWW-Authenticate header found in response. Auth Scheme: {_authScheme}");
+        }
+
+        var challengeMessageB64 = authHeaders.First().Parameter;
+        if (challengeMessageB64 == null)
+        {
+            throw new MissingChallengeException($"No challenge received from the server. Auth Scheme: {_authScheme}");
+        }
+
+        return Convert.FromBase64String(challengeMessageB64);
+    }
+
+    public async Task<Object> AuthenticateAsync(byte[] authenticateMessage)
+    {
+        var requestMessage = new HttpRequestMessage(HttpMethod.Get, _url);
+        var messageBase64 = Convert.ToBase64String(authenticateMessage);
+        requestMessage.Headers.Add("Authorization", $"{_authScheme} {messageBase64}");
+
+        var response = await _httpClient.SendAsync(requestMessage);
+        return response;
+    }
+}
+
+public class MissingChallengeException : Exception
+{
+    public MissingChallengeException(string message): base(message)
+    {
+    }
+}
+
diff --git a/src/CommonLib/Ntlm/INtlmTransport.cs b/src/CommonLib/Ntlm/INtlmTransport.cs
new file mode 100644
index 00000000..6b88ba99
--- /dev/null
+++ b/src/CommonLib/Ntlm/INtlmTransport.cs
@@ -0,0 +1,10 @@
+using System;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public interface INtlmTransport
+{
+    Task<byte[]> NegotiateAsync(byte[] negotiateMessage);
+    Task<Object> AuthenticateAsync(byte[] authenticateMessage);
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/LdapException.cs b/src/CommonLib/Ntlm/LdapException.cs
new file mode 100644
index 00000000..e75a76e3
--- /dev/null
+++ b/src/CommonLib/Ntlm/LdapException.cs
@@ -0,0 +1,16 @@
+using System;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class LdapException : Exception
+{
+    public int ErrorCode { get; }
+    public string ServerErrorMessage { get; }
+
+    public LdapException(string message, int errorCode, string serverErrorMessage = null)
+        : base($"{message}. LDAP error code: {errorCode}{(string.IsNullOrEmpty(serverErrorMessage) ? "" : $". Server error: {serverErrorMessage}")}")
+    {
+        ErrorCode = errorCode;
+        ServerErrorMessage = serverErrorMessage;
+    }
+}
diff --git a/src/CommonLib/Ntlm/LdapNative.cs b/src/CommonLib/Ntlm/LdapNative.cs
new file mode 100644
index 00000000..8b34574f
--- /dev/null
+++ b/src/CommonLib/Ntlm/LdapNative.cs
@@ -0,0 +1,346 @@
+#nullable enable
+
+using Microsoft.Win32.SafeHandles;
+using SharpHoundCommonLib.Enums;
+using System;
+using System.Runtime.InteropServices;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class SafeLdapHandle : SafeHandleZeroOrMinusOneIsInvalid
+{
+    internal SafeLdapHandle(IntPtr handle) : base(true)
+    {
+        this.handle = handle;
+    }
+
+    protected override bool ReleaseHandle()
+    {
+        if (!IsInvalid)
+        {
+            int result = NativeMethods.ldap_unbind_s(handle);
+            return result == 0;
+        }
+        return true;
+    }
+}
+
+public class LdapConnection : IDisposable
+{
+    private SafeLdapHandle? _handle;
+    private bool _disposed;
+
+    public SafeLdapHandle Handle
+    {
+        get
+        {
+            ThrowIfDisposed();
+            return _handle ?? throw new InvalidOperationException("LDAP connection not initialized");
+        }
+    }
+
+    private void ThrowIfDisposed()
+    {
+        if (_disposed)
+        {
+            throw new ObjectDisposedException(nameof(LdapConnection));
+        }
+    }
+
+    private string? GetServerError()
+    {
+        ThrowIfDisposed();
+
+        try
+        {
+            IntPtr errorMessagePtr;
+            int result = NativeMethods.ldap_get_option(
+                Handle,
+                LdapOption.ServerError,
+                out errorMessagePtr
+            );
+
+            if (result != 0 || errorMessagePtr == IntPtr.Zero)
+                return null;
+
+            try
+            {
+                return Marshal.PtrToStringAnsi(errorMessagePtr);
+            }
+            finally
+            {
+                NativeMethods.ldap_memfree(errorMessagePtr);
+            }
+        }
+        catch
+        {
+            // If anything goes wrong getting the server error,
+            // return null rather than throw since we're already
+            // in error handling code
+            return null;
+        }
+    }
+
+    public void CheckError(int result, string operation)
+    {
+        if (result != 0)
+        {
+            int lastError = NativeMethods.LdapGetLastError();
+            string? serverError = GetServerError();
+            throw new LdapException(
+                $"LDAP operation failed. Operation: {operation}. API error code: {result}",
+                lastError,
+                serverError
+            );
+        }
+    }
+
+    public void Initialize(string hostName, int port)
+    {
+        ThrowIfDisposed();
+
+        var handle = NativeMethods.ldap_init(hostName, port);
+        if (handle == IntPtr.Zero)
+        {
+            int lastError = NativeMethods.LdapGetLastError();
+            throw new LdapException($"Failed to initialize LDAP connection", lastError);
+        }
+
+        _handle = new SafeLdapHandle(handle);
+    }
+
+    public void Connect(int timeout = -1)
+    {
+        ThrowIfDisposed();
+
+        var timeoutPtr = IntPtr.Zero;
+        try
+        {
+            if (timeout >= 0)
+            {
+                var ldapTimeout = new LDAP_TIMEVAL
+                {
+                    tv_sec = (int)(new TimeSpan(0, 0, timeout).Ticks / TimeSpan.TicksPerSecond),
+                };
+                timeoutPtr = Marshal.AllocHGlobal(Marshal.SizeOf(ldapTimeout));
+                Marshal.StructureToPtr(ldapTimeout, timeoutPtr, false);
+            }
+
+            int result = NativeMethods.ldap_connect(Handle, timeoutPtr);
+            CheckError(result, "Connecting to LDAP server");
+        }
+        finally
+        {
+            if (timeoutPtr != IntPtr.Zero)
+            {
+                Marshal.FreeHGlobal(timeoutPtr);
+            }
+        }
+    }
+
+    private T GetOption<T>(LdapOption option) where T : struct
+    {
+        ThrowIfDisposed();
+
+        if (typeof(T) == typeof(int))
+        {
+            int value;
+            int result = NativeMethods.ldap_get_option(Handle, option, out value);
+            CheckError(result, $"Getting LDAP option {option}");
+            return (T)(object)value;
+        }
+
+        throw new ArgumentException($"Unsupported option type: {typeof(T).Name}");
+    }
+
+    public void SetOption(LdapOption option, LdapOptionValue value)
+    {
+        ThrowIfDisposed();
+
+        // Get current value
+        int currentValue = GetOption<int>(option);
+        int newValue = (int)value;
+
+        // Only set if different
+        if (currentValue != newValue)
+        {
+#pragma warning disable CS8604 // Possible null reference argument.
+            int result = NativeMethods.ldap_set_option(_handle, option, ref newValue);
+#pragma warning restore CS8604 // Possible null reference argument.
+            CheckError(result, $"Setting LDAP option {option}");
+
+            // Verify the change
+            int verifyValue = GetOption<int>(option);
+            if (verifyValue != newValue)
+            {
+                throw new LdapException($"Failed to verify option change for {option}. Expected {newValue} but got {verifyValue}",
+                    NativeMethods.LdapGetLastError());
+            }
+        }
+    }
+
+    public void SetOption(LdapOption option, IntPtr value)
+    {
+#pragma warning disable CS8604 // Possible null reference argument.
+        int result = NativeMethods.ldap_set_option(_handle, option, value);
+#pragma warning restore CS8604 // Possible null reference argument.
+        CheckError(result, $"Setting LDAP option {option}");
+    }
+
+    private int GetResultCode()
+    {
+        ThrowIfDisposed();
+
+        int resultCode;
+        int result = NativeMethods.ldap_get_option(
+            Handle,
+            LdapOption.ResultCode,
+            out resultCode
+        );
+
+        CheckError(result, "Getting LDAP result code");
+        return resultCode;
+    }
+
+    public byte[] SaslBind(string distinguishedName, string mechanism, byte[] credential)
+    {
+        ThrowIfDisposed();
+
+        IntPtr credPtr = IntPtr.Zero;
+        try
+        {
+            // Create berval structure for credentials
+            var berval = new BERVAL
+            {
+                bv_len = credential.Length,
+                bv_val = Marshal.AllocHGlobal(credential.Length)
+            };
+
+            Marshal.Copy(credential, 0, berval.bv_val, credential.Length);
+
+            credPtr = Marshal.AllocHGlobal(Marshal.SizeOf<BERVAL>());
+            Marshal.StructureToPtr(berval, credPtr, false);
+
+            // Perform SASL bind
+            int result = NativeMethods.ldap_sasl_bind_s(
+                Handle,
+                distinguishedName,
+                mechanism,
+                credPtr,
+                IntPtr.Zero,  // No server controls
+                IntPtr.Zero,  // No client controls
+                out IntPtr response
+            );
+
+            if (result != (int)LdapErrorCodes.Success &&
+                result != (int)LdapErrorCodes.SaslBindInProgress)
+            {
+                throw new LdapException("SASL bind failed", result, GetServerError());
+            }
+
+            int bindResultCode = GetResultCode();
+
+            if (bindResultCode != (int)LdapErrorCodes.Success &&
+                bindResultCode != (int)LdapErrorCodes.SaslBindInProgress)
+            {
+                throw new LdapException("SASL bind result failed", bindResultCode, GetServerError());
+            }
+
+            if (response == IntPtr.Zero)
+                throw new InvalidOperationException("Server did return a challenge");
+
+            var responseBerval = Marshal.PtrToStructure<BERVAL>(response);
+            byte[] responseData = new byte[responseBerval.bv_len];
+            Marshal.Copy(responseBerval.bv_val, responseData, 0, responseBerval.bv_len);
+            return responseData;
+        }
+        finally
+        {
+            if (credPtr != IntPtr.Zero)
+            {
+                var berval = Marshal.PtrToStructure<BERVAL>(credPtr);
+                if (berval.bv_val != IntPtr.Zero)
+                {
+                    Marshal.FreeHGlobal(berval.bv_val);
+                }
+                Marshal.FreeHGlobal(credPtr);
+            }
+
+            // Freeing the memory always results in crashes. Is it managed by something else?
+            //if (response != IntPtr.Zero)
+            //{
+            //    var responseBerval = Marshal.PtrToStructure<NativeMethods.berval>(response);
+            //    if (responseBerval.bv_val != IntPtr.Zero)
+            //    {
+            //        Marshal.FreeHGlobal(responseBerval.bv_val);
+            //    }
+            //    Marshal.FreeHGlobal(response);
+            //}
+        }
+    }
+    public void Dispose()
+    {
+        if (!_disposed)
+        {
+            _handle?.Dispose();
+            _handle = null;
+            _disposed = true;
+        }
+    }
+}
+
+
+[StructLayout(LayoutKind.Sequential)]
+public struct LDAP_TIMEVAL
+{
+    public int tv_sec;
+    public int tv_usec;
+}
+
+[StructLayout(LayoutKind.Sequential)]
+public struct BERVAL
+{
+    public int bv_len;
+    public IntPtr bv_val;
+}
+public class NativeMethods
+{
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern IntPtr ldap_init(string Host, int Port);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_connect(SafeLdapHandle ld, IntPtr timeout);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_set_option(SafeLdapHandle ld, LdapOption option, ref int value);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_set_option(SafeLdapHandle ld, LdapOption option, IntPtr value);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_get_option(SafeLdapHandle ld, LdapOption option, out int value);
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_get_option(SafeLdapHandle ld, LdapOption option, out IntPtr value);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern void ldap_memfree(IntPtr ptr);
+
+    [DllImport("Wldap32.dll", EntryPoint = "ldap_sasl_bind_s", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_sasl_bind_s(
+        SafeLdapHandle ld,
+        string dn,
+        string mechanism,
+        IntPtr cred,
+        IntPtr serverctrls,
+        IntPtr clientctrls,
+        out IntPtr msgidp);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_unbind_s(IntPtr ld);
+
+    [DllImport("wldap32.dll", EntryPoint = "LdapGetLastError")]
+    public static extern int LdapGetLastError();
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/LdapTransport.cs b/src/CommonLib/Ntlm/LdapTransport.cs
new file mode 100644
index 00000000..e8827a62
--- /dev/null
+++ b/src/CommonLib/Ntlm/LdapTransport.cs
@@ -0,0 +1,119 @@
+#nullable enable
+
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Enums;
+using System;
+using System.Runtime.InteropServices;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class LdapTransport(ILogger logger, Uri ldapEndpoint) : INtlmTransport, IDisposable
+{
+    private LdapConnection? _ldap;
+    private bool _disposed;
+
+    [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+    public delegate bool VerifyServerCert(
+       IntPtr Connection,
+       IntPtr pServerCert
+    );
+
+    public bool IsLdaps
+    {
+        get { return ldapEndpoint.Scheme == "ldaps"; }
+    }
+
+    private void ThrowIfDisposed()
+    {
+        if (_disposed)
+        {
+            throw new ObjectDisposedException(nameof(LdapConnection));
+        }
+    }
+
+    private void ThrowIfHandleNull()
+    {
+        if (_ldap == null)
+        {
+            throw new NullReferenceException("LDAP handle is null");
+        }
+    }
+
+    public void InitializeConnectionAsync(int timeout = -1)
+    {
+        if (_ldap == null)
+        {
+            _ldap = new LdapConnection();
+            try
+            {
+                _ldap.Initialize(ldapEndpoint.Host, ldapEndpoint.Port);
+                _ldap.SetOption(LdapOption.ProtocolVersion, LdapOptionValue.Version3);
+
+                if (IsLdaps)
+                {
+                    _ldap.SetOption(
+                        LdapOption.ServerCertificate,
+                        Marshal.GetFunctionPointerForDelegate<VerifyServerCert>((connection, serverCert) => true)
+                    );
+
+                    // Not necessary to call. Internally, it automagically sets it via the LDAPS port specified
+                    //_ldap.SetOption(LdapOption.Ssl, LdapOptionValue.On);
+
+                    // Not setting Signing/Encryption since the API returns LDAP_UNWILLING_TO_PERFORM when SSL is enabled
+                    //_ldap.SetOption(LdapOption.Sign, LdapOptionValue.On);
+                    //_ldap.SetOption(LdapOption.Encrypt, LdapOptionValue.On);
+                }
+
+                _ldap.Connect(timeout);
+                logger.LogDebug($"LDAP connection established to {ldapEndpoint.Host}:{ldapEndpoint.Port}");
+            }
+            catch (Exception)
+            {
+                _ldap.Dispose();
+                _ldap = null;
+                throw;
+            }
+        }
+    }
+
+    public Task<byte[]> NegotiateAsync(byte[] negotiateMessage)
+    {
+        ThrowIfDisposed();
+        ThrowIfHandleNull();
+
+        return Task.Run(() =>
+        {
+            return _ldap!.SaslBind("", LdapSupportedSaslMechansims.GSS_SPNEGO, negotiateMessage);
+        });
+
+    }
+
+    public async Task<Object> AuthenticateAsync(byte[] authenticateMessage)
+    {
+        ThrowIfDisposed();
+        ThrowIfHandleNull();
+
+        return await Task.Run(() =>
+        {
+            InitializeConnectionAsync();
+            var bytes = _ldap!.SaslBind("", LdapSupportedSaslMechansims.GSS_SPNEGO, authenticateMessage);
+            return bytes;
+        });
+    }
+
+    public void Dispose()
+    {
+        if (!_disposed)
+        {
+            if (_ldap != null)
+            {
+                _ldap.Dispose();
+                _ldap = null;
+            }
+            _disposed = true;
+        }
+    }
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
new file mode 100644
index 00000000..78b9397c
--- /dev/null
+++ b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
@@ -0,0 +1,64 @@
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Processors;
+using SharpHoundCommonLib.ThirdParty.PSOpenAD;
+using System;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+interface INtlmAuthenticationHandler
+{
+    Task<object> PerformNtlmAuthenticationAsync(INtlmTransport transport);
+}
+
+public class NtlmAuthenticationHandler : INtlmAuthenticationHandler
+{
+    private readonly ILogger _logger;
+    private readonly string _host;
+    private readonly string _targetService;
+    private const string NtlmAuthPackageName = "NTLM";
+    public LdapAuthOptions Options { get; set; }
+
+    public NtlmAuthenticationHandler(ILogger logger, string host, string targetService)
+    {
+        _logger = logger;
+        _host = host;
+        _targetService = targetService;
+
+        Options = new LdapAuthOptions()
+        {
+            Signing = false,
+            Bindings = null
+        };
+    }
+
+    public async Task<Object> PerformNtlmAuthenticationAsync(INtlmTransport transport)
+    {
+        using var context = new SspiContext(
+                null,
+                null,
+                AuthenticationMethod.NTLM,
+                _targetService,
+                Options.Bindings,
+                Options.Signing,
+                Options.Signing
+            );
+
+        // NEGOTIATE
+        var negotiateMsgBytes = context.Step();
+        //_logger.LogDebug($"NTLM-NEGOTIATE message: {Convert.ToBase64String(negotiateMsgBytes)}");
+
+        // CHALLENGE
+        var challengeMessageBytes = await transport.NegotiateAsync(negotiateMsgBytes);
+        //_logger.LogDebug($"NTLM-CHALLENGE message: {Convert.ToBase64String(challengeMessageBytes)}");
+
+        // AUTHENTICATE
+        var authenticateMsgBytes = context.Step(challengeMessageBytes);
+        //_logger.LogDebug($"NTLM-AUTHENTICATE message: {Convert.ToBase64String(authenticateMsgBytes)}");
+
+        // Perform final authentication
+        var response = await transport.AuthenticateAsync(authenticateMsgBytes);
+
+        return response;
+    }
+}
diff --git a/src/CommonLib/OutputTypes/APIResult.cs b/src/CommonLib/OutputTypes/APIResult.cs
index 81c65b29..e859f56f 100644
--- a/src/CommonLib/OutputTypes/APIResult.cs
+++ b/src/CommonLib/OutputTypes/APIResult.cs
@@ -1,8 +1,52 @@
 namespace SharpHoundCommonLib.OutputTypes
 {
-    public class APIResult
+    public class BaseAPIResult<T>
     {
         public bool Collected { get; set; }
         public string FailureReason { get; set; }
     }
+
+#nullable enable
+    public class APIResult
+    {
+        public bool Collected { get; set; }
+        public string? FailureReason { get; set; }
+    }
+    public class ApiResult<T> : APIResult
+    {
+        public T? Results { get; set; }
+
+        public ApiResult()
+        {
+            Results = default(T);
+            Collected = false;
+            FailureReason = null;
+        }
+
+        public ApiResult(T? data)
+        {
+            Results = data;
+            Collected = data != null;
+            FailureReason = null;
+        }
+
+        public static ApiResult<T> CreateSuccess(T result)
+        {
+            return new ApiResult<T>(result)
+            {
+                Collected = true,
+                FailureReason = null
+            };
+        }
+
+        public static ApiResult<T> CreateError(string message)
+        {
+            return new ApiResult<T>(default)
+            {
+                Collected = false,
+                FailureReason = message
+            };
+        }
+    }
+#nullable disable
 }
\ No newline at end of file
diff --git a/src/CommonLib/OutputTypes/CAHttpEndpoint.cs b/src/CommonLib/OutputTypes/CAHttpEndpoint.cs
new file mode 100644
index 00000000..58520a0f
--- /dev/null
+++ b/src/CommonLib/OutputTypes/CAHttpEndpoint.cs
@@ -0,0 +1,67 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.OutputTypes
+{
+    public enum CAEnrollmentEndpointType
+    {
+        // The Certificate Authority Web Enrollment server role, an ASP web application
+        WebEnrollmentApplication,
+
+        // The Certificate Enrollment Web Service (CES) server role, a SOAP-based web service
+        EnrollmentWebService,
+
+        // The Network Device Enrollment Service (NDES), which uses the SCEP protocol to obtain certificates.
+        NDES,                     // NDES
+
+        // ICertPassage Remote Protocol (MS-ICPR), an RPC protcol
+        RPC,                      // 
+
+        // The Windows Client Certificate Enrollment Protocol (MS-WCCE), a set of DCOM interfaces for certificate enrollment
+        DCOM,
+    }
+    public enum CAEnrollmentEndpointScanResult
+    {
+        // Endpoint is vulnerable due to using HTTP (not HTTPS) with NTLM auth (ESC8)
+        Vulnerable_NtlmHttpEndpoint,
+
+        // Endpoint is vulnerable due to using HTTP (not HTTPS) with Kerberos auth
+        Vulnerable_KerberosHttpEndpoint,
+
+        // Endpoint is vulnerable due to not requiring channel binding for the HTTPS endpoint (ESC8)
+        Vulnerable_NtlmHttpsNoChannelBinding,
+
+
+        // Offset the not vulnerable conditions in case we want to add additional
+
+        // Endpoint is not vulnerable due to not existing
+        NotVulnerable_PortInaccessible = 0x100,
+        
+        // The server did not return an NTLM challenge (e.g., when Negotiate:Kerberos is enabled)
+        NotVulnerable_NoNtlmChallenge,
+
+        // 404 NotFound when accessing the endpoint
+        NotVulnerable_PathNotFound,
+
+        // Returned if the IIS is configured to require SSL (so no HTTP possible)
+        NotVulnerable_PathForbidden,
+
+        // 500 Server Error when visiting a Url
+        NotVulnerable_ServerError,
+
+        // Endpoint is not vulnerable due requiring ChannelBinding or only supporting Kerberos authentication (or both)
+        NotVulnerable_NtlmChannelBindingRequired,
+
+        Error = 0xFFFF
+    }
+    public class CAEnrollmentEndpoint(Uri url, CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult status)
+    {
+        public Uri Url { get; set; } = url;
+        public CAEnrollmentEndpointType Type { get; set; } = type;
+        public CAEnrollmentEndpointScanResult Status { get; set; } = status;
+
+    }
+}
diff --git a/src/CommonLib/OutputTypes/Computer.cs b/src/CommonLib/OutputTypes/Computer.cs
index 879013d5..35d84f85 100644
--- a/src/CommonLib/OutputTypes/Computer.cs
+++ b/src/CommonLib/OutputTypes/Computer.cs
@@ -1,4 +1,4 @@
-using System;
+using System.Collections.Generic;
 
 namespace SharpHoundCommonLib.OutputTypes
 {
@@ -8,20 +8,60 @@ namespace SharpHoundCommonLib.OutputTypes
     public class Computer : OutputBase
     {
         public string PrimaryGroupSID { get; set; }
-        public TypedPrincipal[] AllowedToDelegate { get; set; } = Array.Empty<TypedPrincipal>();
-        public TypedPrincipal[] AllowedToAct { get; set; } = Array.Empty<TypedPrincipal>();
-        public TypedPrincipal[] HasSIDHistory { get; set; } = Array.Empty<TypedPrincipal>();
-        public TypedPrincipal[] DumpSMSAPassword { get; set; } = Array.Empty<TypedPrincipal>();
+        public TypedPrincipal[] AllowedToDelegate { get; set; } = [];
+        public TypedPrincipal[] AllowedToAct { get; set; } = [];
+        public TypedPrincipal[] HasSIDHistory { get; set; } = [];
+        public TypedPrincipal[] DumpSMSAPassword { get; set; } = [];
         public SessionAPIResult Sessions { get; set; } = new();
         public SessionAPIResult PrivilegedSessions { get; set; } = new();
         public SessionAPIResult RegistrySessions { get; set; } = new();
-        public LocalGroupAPIResult[] LocalGroups { get; set; } = Array.Empty<LocalGroupAPIResult>();
-        public UserRightsAssignmentAPIResult[] UserRights { get; set; } = Array.Empty<UserRightsAssignmentAPIResult>();
+        public LocalGroupAPIResult[] LocalGroups { get; set; } = [];
+        public UserRightsAssignmentAPIResult[] UserRights { get; set; } = [];
         public DCRegistryData DCRegistryData { get; set; } = new();
         public ComputerStatus Status { get; set; }
         public bool IsDC { get; set; }
         public bool UnconstrainedDelegation { get; set; }
         public string DomainSID { get; set; }
+
+#pragma warning disable CS8632 // The annotation for nullable reference types should only be used in code within a '#nullable' annotations context.
+        public ApiResult<bool> IsWebClientRunning { get; set; }
+        public LdapService? LdapServices { get; set; } 
+        public ApiResult<SmbInfo>? SmbInfo { get; set; }
+        public ApiResult<NtlmSessionResult>? NtlmSessions { get; set; } 
+#pragma warning restore CS8632 // The annotation for nullable reference types should only be used in code within a '#nullable' annotations context.
+
+    }
+
+    public class LdapService(bool hasLdap, bool hasLdaps, ApiResult<bool> isSigningRequired, ApiResult<bool> isChannelBindingRequired)
+    {
+        // Is the LDAP port accesible?
+        public bool HasLdap { get; set; } = hasLdap;
+
+        // Is the LDAPS port accessible?
+        public bool HasLdaps { get; set; } = hasLdaps;
+
+        // For LDAP, is signing required?
+        public ApiResult<bool> IsSigningRequired { get; set; } = isSigningRequired;
+
+        // For LDAPS, is EPA(ChannelBinding) required?
+        public ApiResult<bool> IsChannelBindingDisabled { get; set; } = isChannelBindingRequired;
+
+        public override string ToString()
+        {
+            return $@"HasLdap: {HasLdap}
+HasLdaps: {HasLdaps}
+IsSigningRequired: {IsSigningRequired}
+IsChannelBindingDisabled: {IsChannelBindingDisabled}";
+        }
+    }
+
+
+    public class SmbInfo
+    {
+        public bool? SigningEnabled;
+        public string OsVersion;
+        public string OsBuild;
+        public string DnsComputerName { get; internal set; }
     }
 
     public class DCRegistryData
@@ -50,4 +90,4 @@ public CSVComputerStatus GetCSVStatus(string computerName)
             };
         }
     }
-}
\ No newline at end of file
+}
diff --git a/src/CommonLib/OutputTypes/EnterpriseCA.cs b/src/CommonLib/OutputTypes/EnterpriseCA.cs
index 658f38a6..50268a33 100644
--- a/src/CommonLib/OutputTypes/EnterpriseCA.cs
+++ b/src/CommonLib/OutputTypes/EnterpriseCA.cs
@@ -5,5 +5,6 @@ public class EnterpriseCA : OutputBase
         public string HostingComputer { get; set; }
         public CARegistryData CARegistryData { get; set; }
         public TypedPrincipal[] EnabledCertTemplates { get; set; }
+        public ApiResult<CAEnrollmentEndpoint>[] HttpEnrollmentEndpoints { get; set; }
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/OutputTypes/NtlmSession.cs b/src/CommonLib/OutputTypes/NtlmSession.cs
new file mode 100644
index 00000000..ab6c77a6
--- /dev/null
+++ b/src/CommonLib/OutputTypes/NtlmSession.cs
@@ -0,0 +1,113 @@
+#nullable enable
+using SharpHoundCommonLib.Processors;
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Eventing.Reader;
+
+namespace SharpHoundCommonLib.OutputTypes
+{
+    public class NtlmSessionResult
+    {
+        public List<NtlmSession>? Sessions { get; set; }
+        public long CollectionDurationMs { get; set; }
+    }
+    public class NtlmSession(
+        string host,
+        DateTime? timeCreatedUtc,
+        SecurityLogId id,
+        string? accountSid,
+        string accountName,
+        string? accountDomain,
+        string sourceHost,
+        string? sourceIp,
+        string? sourcePort,
+        string packageName
+        )
+    {
+        public string Host { get; set; } = host;   // Hostname the sessions occurred on
+        public DateTime? TimeCreatedUtc { get; set; } = timeCreatedUtc;
+        public SecurityLogId Id { get; set; } = id;
+        public string? AccountSid { get; set; } = accountSid;
+        public string AccountName { get; set; } = accountName;
+        public string? AccountDomain { get; set; } = accountDomain;
+        public string SourceHost { get; set; } = sourceHost;   // The host the auth originated from
+        public string? SourceIp { get; set; } = sourceIp;
+        public string? SourcePort { get; set; } = sourcePort;
+        public string? PackageName { get; set; } = packageName;
+
+        public override string ToString()
+        {
+            var targetUser = AccountDomain + "\\" + AccountName;
+            var source = (SourceIp != null || SourcePort != null) ? $"{SourceIp}:{SourcePort}" : "";
+
+            return ($"  {TimeCreatedUtc?.ToLocalTime()},{Id},{targetUser},{AccountSid},{SourceHost},,{PackageName}");
+        }
+
+        public static NtlmSession FromLogonEvent(string host, EventRecord evnt)
+        {
+            if (evnt.Id != 4624)
+                throw new ArgumentException("Not a logon event");
+
+            //var subjectUserSid = eventDetail.Properties[0].Value.ToString();
+            //var subjectUserName = eventDetail.Properties[1].Value.ToString();
+            //var subjectDomainName = eventDetail.Properties[2].Value.ToString();
+            //var subjectLogonId = eventDetail.Properties[3].Value.ToString();
+            var targetUserSid = evnt.Properties[4].Value.ToString();
+            var targetUserName = evnt.Properties[5].Value.ToString();
+            var targetDomainName = evnt.Properties[6].Value.ToString();
+            //var targetLogonId = eventDetail.Properties[7].Value.ToString();
+            //var logonType = eventDetail.Properties[8].Value.ToString();
+            //var logonType = $"{(SECURITY_LOGON_TYPE)(int.Parse(eventDetail.Properties[8].Value.ToString()))}";
+            //var logonProcessName = eventDetail.Properties[9].Value.ToString();
+            //var authenticationPackageName = eventDetail.Properties[10].Value.ToString();
+            var workstationName = evnt.Properties[11].Value.ToString();
+            //var logonGuid = eventDetail.Properties[12].Value.ToString();
+            //var transmittedServices = eventDetail.Properties[13].Value.ToString();
+            var lmPackageName = evnt.Properties[14].Value.ToString();
+            //var keyLength = eventDetail.Properties[15].Value.ToString();
+            //var processId = eventDetail.Properties[16].Value.ToString();
+            //var processName = eventDetail.Properties[17].Value.ToString();
+            var ipAddress = evnt.Properties[18].Value.ToString();
+            var ipPort = evnt.Properties[19].Value.ToString();
+
+
+            return new NtlmSession(
+                host,
+                evnt.TimeCreated?.ToUniversalTime(),
+                SecurityLogId.Logon,
+                targetUserSid,
+                targetUserName,
+                targetDomainName,
+                workstationName,
+                ipAddress,
+                ipPort,
+                lmPackageName
+            );
+        }
+
+        public static NtlmSession FromValidateCredentialEvent(string host, EventRecord evnt)
+        {
+            if (evnt.Id != 4776)
+                throw new ArgumentException("Not a validate credential event");
+
+            var packageName = evnt.Properties[0].Value.ToString();
+            var targetUserName = evnt.Properties[1].Value.ToString();
+            var workstation = evnt.Properties[2].Value.ToString();
+            //var status = evt.Properties[3].Value.ToString();
+
+            return new NtlmSession(
+                host,
+                evnt.TimeCreated?.ToUniversalTime(),
+                SecurityLogId.Logon,
+                null,
+                targetUserName,
+                null,
+                workstation,
+                null,
+                null,
+                packageName
+            );
+        }
+    }
+}
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/CAEnrollmentProcessor.cs b/src/CommonLib/Processors/CAEnrollmentProcessor.cs
new file mode 100644
index 00000000..3ce9c6ab
--- /dev/null
+++ b/src/CommonLib/Processors/CAEnrollmentProcessor.cs
@@ -0,0 +1,235 @@
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Ntlm;
+using SharpHoundCommonLib.OutputTypes;
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Http;
+using System.Net.Sockets;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors
+{
+    public class CAEnrollmentProcessor
+    {
+        private readonly string _caDnsHostname;
+        private readonly string _caName;
+        private readonly ILogger _logger;
+        private readonly IHttpClientFactory _httpClientFactory;
+
+        public CAEnrollmentProcessor(string caDnsHostname, string caName, ILogger log = null)
+        {
+            ServicePointManager.SecurityProtocol |=
+                SecurityProtocolType.Ssl3
+                | SecurityProtocolType.Tls12
+                | SecurityProtocolType.Tls11
+                | SecurityProtocolType.Tls;
+
+            _caDnsHostname = caDnsHostname;
+            _caName = caName;
+            _logger = log ?? Logging.LogProvider.CreateLogger("CAEnrollmentProcessor");
+
+            _httpClientFactory = new HttpClientFactory();
+        }
+
+
+        public async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanAsync()
+        {
+            var endpoints = new List<ApiResult<CAEnrollmentEndpoint>>();
+
+            try
+            {
+                var webEnrollmentTask = ScanHttpEndpoint(CAEnrollmentEndpointType.WebEnrollmentApplication);
+                var webServiceTask = ScanHttpEndpoint(CAEnrollmentEndpointType.EnrollmentWebService);
+                // var rpcServiceTask = CheckEnrollmentRpcAsync();
+                // var dcomServiceTask = CheckEnrollmentDcomAsync();
+
+                await Task.WhenAll(
+                    webEnrollmentTask,
+                    webServiceTask
+                    //rpcServiceTask,
+                    //dcomServiceTask,
+                );
+
+                endpoints.AddRange(await webEnrollmentTask);
+                endpoints.AddRange(await webServiceTask);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "An error occurred while scanning enrollment endpoints");
+            }
+
+            return endpoints;
+        }
+
+        private async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanHttpEndpoint(CAEnrollmentEndpointType type)
+        {
+            var endpoints = new List<ApiResult<CAEnrollmentEndpoint>>();
+            var (httpUrl, httpsUrl) = BuildEnrollmentUrls(type);
+
+
+            // Check 1 - ESC8 via HTTP
+            // Is the HTTP URL accessible via NTLM? If so, it's vulnerable to NTLM relay
+            var endpoint = await GetNtlmEndpoint(httpUrl, null, type, CAEnrollmentEndpointScanResult.Vulnerable_NtlmHttpEndpoint);
+            endpoints.Add(endpoint);
+
+            // Check 2 - ESC8 via HTTPS w/o channel binding (EPA)
+            // Is the HTTPS URL accessible via NTLM with bad channel bindings? (i.e. channel binding is not enforced)
+            var esc8Https = await GetNtlmEndpoint(
+                httpsUrl,
+                useBadChannelBinding: true,
+                type,
+                CAEnrollmentEndpointScanResult.Vulnerable_NtlmHttpsNoChannelBinding
+            );
+            endpoints.Add(esc8Https);
+
+            // TODO: For completeness/awareness, check if the endpoint is accessible via NTLM with valid Channel Bindings?
+
+            return endpoints;
+        }
+
+        private (Uri httpUrl, Uri httpsUrl) BuildEnrollmentUrls(CAEnrollmentEndpointType type)
+        {
+            switch (type)
+            {
+                case CAEnrollmentEndpointType.WebEnrollmentApplication:
+                    return (new Uri($"http://{_caDnsHostname}/certsrv/"),
+                            new Uri($"https://{_caDnsHostname}/certsrv/"));
+
+                case CAEnrollmentEndpointType.EnrollmentWebService:
+                    return (new Uri($"http://{_caDnsHostname}/{_caName}_CES_Kerberos/service.svc"),
+                            new Uri($"https://{_caDnsHostname}/{_caName}_CES_Kerberos/service.svc"));
+
+                default:
+                    throw new ArgumentException("Unhandled enrollment endpoint type");
+            }
+        }
+
+
+        private async Task<ApiResult<CAEnrollmentEndpoint>> GetNtlmEndpoint(Uri url, bool? useBadChannelBinding, CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult scanResult)
+        {
+            var authService = new HttpNtlmAuthenticationService(
+                    _logger,
+                    new HttpClientFactory()
+                )
+            {
+                Url = url
+            };
+
+            var output = new CAEnrollmentEndpoint(url, type, scanResult);
+
+            try
+            {
+                await authService.EnsureRequiresAuth(false, useBadChannelBinding);
+                return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+            }
+            catch (HttpRequestException ex)
+            {
+                if (ex.InnerException is WebException)
+                {
+                    var webEx = (WebException)ex.InnerException;
+
+
+                    if (webEx.InnerException is SocketException)
+                    {
+                        output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PortInaccessible;
+                        return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+                    }
+                    else if (webEx.Status == WebExceptionStatus.NameResolutionFailure)
+                    {
+                        return ApiResult<CAEnrollmentEndpoint>.CreateError("Could not resolve hostname");
+                    }
+                    else if (webEx.Response is HttpWebResponse httpResponse)
+                    {
+                        HttpStatusCode statusCode = httpResponse.StatusCode;
+
+                        switch (statusCode)
+                        {
+                            case HttpStatusCode.NotFound:
+                                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathNotFound;
+                                break;
+                            case HttpStatusCode.Forbidden:
+                                // Returned if the IIS is configured to require SSL (so no HTTP possible)
+                                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathForbidden;
+                                break;
+                            default:
+                                return ApiResult<CAEnrollmentEndpoint>
+                                    .CreateError($"Unexpected status code '{statusCode}' for the URL {url}. UseBadChannelBindings: {useBadChannelBinding}");
+                        }
+
+                        return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+                    }
+                    else
+                    {
+                        Console.WriteLine($"WebException occurred: {ex}");
+                    }
+
+                    return ApiResult<CAEnrollmentEndpoint>
+                        .CreateError($"Unhandled WebException. Url: {url}. Exception: {webEx}. Inner: {webEx.InnerException}  Data: {webEx.Data}");
+                }
+                else
+                {
+                    return ApiResult<CAEnrollmentEndpoint>
+                            .CreateError($"HttpRequestException occured checking NTLM accessibility for URL: {url}. Exception: {ex}");
+                }
+            }
+            catch (HttpUnauthorizedException ex)
+            {
+                if (useBadChannelBinding == true)
+                {
+                    output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_NtlmChannelBindingRequired;
+                    return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+                }
+                else
+                {
+                    return ApiResult<CAEnrollmentEndpoint>
+                    .CreateError($"401 Unauthorized exception checking NTLM accessibility for URL: {url}. Exception: {ex}");
+                }
+            }
+            catch(HttpForbiddenException)
+            {
+                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathForbidden;
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateSuccess(output);
+            }
+            catch(HttpServerErrorException)
+            {
+                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathNotFound;
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateSuccess(output);
+            }
+            catch (MissingChallengeException)
+            {
+                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_NoNtlmChallenge;
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateSuccess(output);
+            }
+            catch (Exception ex)
+            {
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateError($"Unhandled exception checking NTLM accessibility for URL: {url}. BadChannelBindings: {useBadChannelBinding}.  Exception: {ex}");
+            }
+        }
+
+        private async Task<bool> CanAccessUrlWithKerberosAsync(string url, bool useBadChannelBinding)
+        {
+            using (var client = _httpClientFactory.CreateAuthenticatedHttpClient(new Uri(url)))
+            {
+                try
+                {
+                    HttpResponseMessage response = await client.GetAsync(url);
+
+                    return true;
+                }
+                catch (HttpRequestException e)
+                {
+                    Console.WriteLine($"Error: {e.Message}");
+
+                    return false;
+                }
+            }
+        }
+
+    }
+
+}
diff --git a/src/CommonLib/Processors/ComputerSessionProcessor.cs b/src/CommonLib/Processors/ComputerSessionProcessor.cs
index 2c9a4673..d76933d9 100644
--- a/src/CommonLib/Processors/ComputerSessionProcessor.cs
+++ b/src/CommonLib/Processors/ComputerSessionProcessor.cs
@@ -138,7 +138,7 @@ await SendComputerStatus(new CSVComputerStatus {
                     continue;
                 }
 
-                var (matchSuccess, sids) = await _utils.GetGlobalCatalogMatches(username, computerDomain);
+                (bool matchSuccess, string[] sids) = await _utils.GetGlobalCatalogMatches(username, computerDomain);
                 if (matchSuccess) {
                     results.AddRange(
                         sids.Select(s => new Session { ComputerSID = resolvedComputerSID, UserSID = s }));
diff --git a/src/CommonLib/Processors/DCLdapProcessor.cs b/src/CommonLib/Processors/DCLdapProcessor.cs
new file mode 100644
index 00000000..25e898ed
--- /dev/null
+++ b/src/CommonLib/Processors/DCLdapProcessor.cs
@@ -0,0 +1,291 @@
+#nullable enable
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Enums;
+using SharpHoundCommonLib.Ntlm;
+using SharpHoundCommonLib.OutputTypes;
+using SharpHoundCommonLib.ThirdParty.PSOpenAD;
+using System;
+using System.Diagnostics.CodeAnalysis;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors;
+
+public class LdapAuthOptions
+{
+    public bool Signing { get; set; }
+    public ChannelBindings? Bindings { get; set; }
+}
+
+public class DCLdapProcessor
+{
+    private readonly ILogger _log;
+    private readonly PortScanner _scanner;
+    private readonly int _portScanTimeout;
+    private readonly int _ldapTimeout;
+    private readonly Uri _ldapEndpoint;
+    private readonly Uri _ldapSslEndpoint;
+
+    private readonly string SEC_E_UNSUPPORTED_FUNCTION = "80090302";
+    private readonly string SEC_E_BAD_BINDINGS = "80090346";
+
+
+    public DCLdapProcessor(int portScanTimeout, string dcHostname, ILogger log)
+    {
+        _log = log;
+        _scanner = new PortScanner();
+        _portScanTimeout = portScanTimeout;
+        _ldapTimeout = portScanTimeout / 1000;
+        _ldapEndpoint = new Uri($"ldap://{dcHostname}:389");
+        _ldapSslEndpoint = new Uri($"ldaps://{dcHostname}:636");
+    }
+
+    public async Task<LdapService> Scan()
+    {
+        var hasLdap = await TestLdapPort();
+        var hasLdaps = await TestLdapsPort();
+        ApiResult<bool> isSigningRequired = new(),
+            isChannelBindingDisabled = new();
+
+        if (hasLdap)
+        {
+            isSigningRequired = await CheckIsNtlmSigningRequired();
+        }
+
+        if (hasLdaps)
+        {
+            isChannelBindingDisabled = await CheckIsChannelBindingDisabled();
+        }
+
+        return new LdapService(
+            hasLdap,
+            hasLdaps,
+            isSigningRequired,
+            isChannelBindingDisabled
+        );
+    }
+
+    /// <summary>
+    /// Tests if the specified Ldap port is open
+    /// </summary>
+    /// <param name="target">Hostname of the machine</param>
+    /// <param name="target">TCP port being tested</param>
+    /// <returns>bool</returns>
+    [ExcludeFromCodeCoverage]
+    public async Task<bool> TestLdapPort()
+    {
+        return await _scanner.CheckPort(_ldapEndpoint.Host, _ldapEndpoint.Port, _portScanTimeout);
+    }
+
+    [ExcludeFromCodeCoverage]
+    public async Task<bool> TestLdapsPort()
+    {
+        return await _scanner.CheckPort(_ldapSslEndpoint.Host, _ldapSslEndpoint.Port, _portScanTimeout);
+    }
+
+    public async Task<ApiResult<bool>> CheckIsNtlmSigningRequired()
+    {
+        try
+        {
+            var options = new LdapAuthOptions()
+            {
+                Signing = false
+            };
+            var accessibleWithoutSigning = await Authenticate(_ldapEndpoint, options);
+
+            return ApiResult<bool>.CreateSuccess(accessibleWithoutSigning == false);
+        }
+        catch (Exception ex)
+        {
+            return ApiResult<bool>.CreateError($"CheckIsNtlmSigningRequired failed: {ex}");
+        }
+    }
+
+    // Checks if EPA is enabled. Does so by trying to auth with wrong channel bingings.
+    // If auth is successful despite the wrong bindings, then EPA is not required.
+    // Note: Ideally we'd check if it works under 3 conditions:
+    // 1) No channel bindings to check if configured to "Never"
+    // 2) Invalid bindings to check if configured to "Always" (would error)
+    // 3) Correct bindings to ensure NTLM auth is enabled
+    // However, as of right now we only do #2. We can't do #1 right now since the
+    // Window's SSPI APIs (InitSecurityContext) always add channel bindings.
+    public async Task<ApiResult<bool>> CheckIsChannelBindingDisabled()
+    {
+        try
+        {
+            // 1) Can we connect with *invalid* bindings
+
+            var bindings = new ChannelBindings
+            {
+                ApplicationData = [0, 0, 0, 0]
+            };
+            var accessibleWithNoBindings = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions()
+            {
+                Signing = false,
+                Bindings = bindings
+            });
+
+            return ApiResult<bool>.CreateSuccess(accessibleWithNoBindings == true);
+
+            //// Second, check if we can connect, but with *INVALID* bindings
+            //// This is to check if it's configured for "When Supported"
+            //var bindings = new ChannelBindings();
+            //bindings.ApplicationData = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+            //var accessibleWithBadBindings = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions()
+            //{
+            //    Signing = true,
+            //    Bindings = bindings
+            //});
+
+            //if (accessibleWithBadBindings)
+            //    return ApiResult<bool>.CreateSuccess(false);
+
+            // Third, check if we can connect with *CORRECT* bindings to see if NTLM is enabled
+            //var cert = await SslUtils.GetServerCertificate(_ldapSslEndpoint.Host);
+            //var bindings = SslUtils.GetTlsChannelBindings(cert);
+            //var accessible = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions()
+            //{
+            //    Signing = true,
+            //    Bindings = bindings
+            //});
+
+            //if (accessible)
+            //    return ApiResult<bool>.CreateSuccess(true);
+
+            //throw new InvalidOperationException("Could not access any LDAP endpoints");
+        }
+        catch (Exception ex)
+        {
+            return ApiResult<bool>.CreateError($"CheckIsNtlmSigningRequired failed: {ex}");
+        }
+    }
+
+    private async Task<bool> Authenticate(Uri endpoint, LdapAuthOptions options)
+    {
+        var host = endpoint.Host;
+        var auth = new NtlmAuthenticationHandler(_log, host, $"LDAP/{host.ToUpper()}")
+        {
+            Options = options
+        };
+        var transport = new LdapTransport(_log, endpoint);
+
+        try
+        {
+            transport.InitializeConnectionAsync(_ldapTimeout);
+            var bytes = (byte[])await auth.PerformNtlmAuthenticationAsync(transport);
+            return true;
+        }
+        catch (LdapException ex)
+        {
+            switch (ex.ErrorCode)
+            {
+                case (int)LdapErrorCodes.InvalidCredentials:
+                    // If NTLM is blocked via GPO, the server returns the following error message:
+                    //   "80090302: LdapErr: DSID-0C090816, comment: AcceptSecurityContext error, data 1, v6673"
+                    //   0x80090302 == SEC_E_UNSUPPORTED_FUNCTION
+                    if (ex.ServerErrorMessage.StartsWith(SEC_E_UNSUPPORTED_FUNCTION))
+                    {
+                        _log.LogDebug("LDAP endpoint '{endpoint}' does not support NTLM", endpoint);
+                        return false;
+                    }
+                    if (ex.ServerErrorMessage.StartsWith(SEC_E_BAD_BINDINGS))
+                    {
+                        _log.LogDebug("Bad bindings with the LDAPS endpoint '{endpoint}'. Server error: {serverError}", endpoint, ex.ServerErrorMessage);
+                        return false;
+                    }
+                    else
+                    {
+                        _log.LogError("Unhandled LDAP InvalidCred error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
+                        break;
+                    }
+                case (int)LdapErrorCodes.StrongAuthRequired:
+                    _log.LogDebug("LDAP requires signing. Endpoint: {endpoint}", endpoint);
+                    return false;
+                case (int)LdapErrorCodes.ServerDown:
+                    _log.LogDebug("LDAP endpoint '{endpoint}' not accessible", endpoint);
+                    return false;
+                default:
+                    _log.LogError("Unhandled LdapException error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
+                    break;
+            }
+        }
+        catch (Exception ex)
+        {
+            _log.LogError("An unhandled error occurred during the LDAP test: {ex}", ex);
+        }
+
+        return false;
+    }
+
+    //private Task<bool> CanAccessWithChannelBindings()
+    //{
+    //    return Task.Run(() =>
+    //    {
+    //        var timeout = TimeSpan.FromSeconds(5);
+
+    //        try
+    //        {
+    //            using var conn = new System.DirectoryServices.Protocols.LdapConnection(
+    //                new LdapDirectoryIdentifier(_ldapEndpoint.Host, _ldapEndpoint.Port, false, false),
+    //                null,
+    //                AuthType.Ntlm
+    //                )
+    //            {
+    //                AuthType = AuthType.Ntlm,
+    //                AutoBind = false,
+    //                Timeout = timeout,
+    //                SessionOptions =
+    //                {
+    //                    SspiFlag = (int)InitiatorContextRequestFlags.ISC_REQ_CONNECTION,
+    //                    RootDseCache = false,
+    //                    Signing = false,
+    //                    Sealing = false,
+    //                    SendTimeout = timeout,
+    //                    VerifyServerCertificate =
+    //                        (connection, certificate) =>
+    //                        {
+    //                            return true;
+    //                        }
+    //                }
+    //            };
+
+    //            conn.Bind();
+
+    //            return true;
+    //        }
+    //        catch (System.DirectoryServices.Protocols.LdapException ex)
+    //        {
+    //            switch (ex.ErrorCode)
+    //            {
+    //                case (int)LdapErrorCodes.InvalidCredentials:
+    //                    // If NTLM is blocked via GPO, the server returns the following error message:
+    //                    //   "80090302: LdapErr: DSID-0C090816, comment: AcceptSecurityContext error, data 1, v6673"
+    //                    //   0x80090302 == SEC_E_UNSUPPORTED_FUNCTION
+    //                    if (ex.ServerErrorMessage.StartsWith(SEC_E_UNSUPPORTED_FUNCTION))
+    //                    {
+    //                        _log.LogDebug("LDAP endpoint '{endpoint}' does not support NTLM", _ldapEndpoint);
+    //                        return false;
+    //                    }
+    //                    else
+    //                    {
+    //                        _log.LogError("Unhandled LDAP InvalidCred error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
+    //                        break;
+    //                    }
+    //                case (int)LdapErrorCodes.ServerDown:
+    //                    _log.LogDebug("LDAP endpoint '{endpoint}' not accessible", _ldapEndpoint);
+    //                    return false;
+    //                default:
+    //                    _log.LogError("Unhandled LdapException error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
+    //                    break;
+    //            }
+    //        }
+    //        catch (Exception ex)
+    //        {
+    //            _log.LogError("An unhandled error occurred during the LDAP test: {ex}", ex);
+    //        }
+
+    //        return false;
+    //    });
+    //}
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/EventLogProcessor.cs b/src/CommonLib/Processors/EventLogProcessor.cs
new file mode 100644
index 00000000..30858ec6
--- /dev/null
+++ b/src/CommonLib/Processors/EventLogProcessor.cs
@@ -0,0 +1,332 @@
+#nullable enable
+using Microsoft.Extensions.Logging;
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Eventing.Reader;
+using System.Diagnostics;
+using System.Threading.Tasks;
+using SharpHoundCommonLib.OutputTypes;
+using System.Net;
+
+namespace SharpHoundCommonLib.Processors
+{
+    [Flags]
+    public enum EventLogCollection
+    {
+        InboundNtlmSessions,
+        DomainControllerNtlmAuth,
+    }
+
+    public class EventLogProcessor(
+         ILdapUtils utils,
+         ILogger log,
+         string host,
+         string domain,
+         EventLogCollection collectionType,
+         int numDays = 7,
+         int readEventDelayMs = 5,
+         int readEventTimeoutMs = 10000,
+         NetworkCredential? localAdminCredential = null
+         )
+    {
+        private readonly ILdapUtils _utils = utils;
+        private readonly string _host = host;
+        private readonly string _domain = domain;
+        private readonly EventLogCollection _collectType = collectionType;
+        private readonly int _numDays = numDays;
+        private readonly TimeSpan _readEventTimeoutMs = TimeSpan.FromMilliseconds(readEventTimeoutMs);
+        private readonly int _readDelay = readEventDelayMs;
+        private readonly ILogger _log = log;
+        private NetworkCredential? _localAdminCred = localAdminCredential;
+
+        #region Event Log XPath Queries
+        /* Logic for non-DC machines:
+         * - Collect from the Security event log
+         * - Get 4624 events (Logon Events) in the last X days
+         * - Filter where LogonType=3 (Network Logon) since for NTLM we're interested in inbound network auth attempts
+         * - Filter on either of these:
+         *   - NTLMv2 and KeyLength=0 (indicates signing is disabled)
+         *   - NTLMV1 (doesn't support signing)
+         *   
+         * Example event XML data:
+         * <EventData>
+         *   <Data Name="SubjectUserSid">S-1-0-0</Data> 
+         *   <Data Name="SubjectUserName">-</Data> 
+         *   <Data Name="SubjectDomainName">-</Data> 
+         *   <Data Name="SubjectLogonId">0x0</Data> 
+         *   <Data Name="TargetUserSid">S-1-5-21-3821320868-1508310791-3575676346-1103</Data> 
+         *   <Data Name="TargetUserName">itadmin</Data> 
+         *   <Data Name="TargetDomainName">CORP</Data> 
+         *   <Data Name="TargetLogonId">0x21eacfe9</Data> 
+         *   <Data Name="LogonType">3</Data> 
+         *   <Data Name="LogonProcessName">NtLmSsp</Data> 
+         *   <Data Name="AuthenticationPackageName">NTLM</Data> 
+         *   <Data Name="WorkstationName">WIN11</Data> 
+         *   <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data> 
+         *   <Data Name="TransmittedServices">-</Data> 
+         *   <Data Name="LmPackageName">NTLM V2</Data> 
+         *   <Data Name="KeyLength">0</Data> 
+         *   <Data Name="ProcessId">0x0</Data> 
+         *   <Data Name="ProcessName">-</Data> 
+         *   <Data Name="IpAddress">192.168.230.101</Data> 
+         *   <Data Name="IpPort">54303</Data> 
+         *   <Data Name="ImpersonationLevel">%%1833</Data> 
+         *   <Data Name="RestrictedAdminMode">-</Data> 
+         *   <Data Name="RemoteCredentialGuard">-</Data> 
+         *   <Data Name="TargetOutboundUserName">-</Data> 
+         *   <Data Name="TargetOutboundDomainName">-</Data> 
+         *   <Data Name="VirtualAccount">%%1843</Data> 
+         *   <Data Name="TargetLinkedLogonId">0x0</Data> 
+         *   <Data Name="ElevatedToken">%%1842</Data> 
+         * </EventData>
+         */
+        private readonly string _noSigningXpathEvents = @"
+<QueryList>
+  <Query Id='0' Path='Security'>
+    <Select Path='Security'>
+      *[System[
+        (EventID=4624)
+        and
+        (TimeCreated[timediff(@SystemTime) &lt;= {0}])
+      ]]
+      and
+      *[EventData[
+        (
+          (Data[@Name='LogonType']=3)
+          and
+          (
+            (Data[@Name='LmPackageName']='NTLM V2' and Data[@Name='KeyLength']=0)
+            or
+            (Data[@Name='LmPackageName']='NTLM V1')
+          )
+        )
+      ]]
+    </Select>
+  </Query>
+</QueryList>
+".Trim();
+
+        /* Logic for DC machines:
+         * - Collect from the Security event log
+         * - Get 4776 events (Logon Events) in the last X days. This event is only generated for NTLM auth.
+         * - Filter on:
+         *      Status=0 (Successful auth)
+         *   
+         * - Example event XML data:
+          <Event>
+            <EventData>
+              <Data Name="PackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data> 
+              <Data Name="TargetUserName">lowpriv</Data> 
+              <Data Name="Workstation">DESKTOP-P8UDQ3B</Data> 
+              <Data Name="Status">0x0</Data> 
+            </EventData>
+          </Event>
+        */
+        private readonly string _dcNtlmAuthXpathEvents = @"
+<QueryList>
+  <Query Id=""0"" Path=""Security"">
+    <Select Path=""Security"">
+      *[System[
+        (EventID=4776)
+        and
+        (TimeCreated[timediff(@SystemTime) &lt;= {0}])
+      ]]
+      and
+      *[EventData[
+        (
+          (Data[@Name='Status']=""0x0"")
+        )
+      ]]
+    </Select>
+  </Query>
+</QueryList>
+";
+        #endregion // Event Log XPath Queries
+        public ApiResult<NtlmSessionResult> ReadEvents()
+        {
+            var result = new NtlmSessionResult();
+            string query;
+            var timeFilterMs = TimeSpan.FromDays(_numDays).TotalMilliseconds;
+
+            switch (_collectType)
+            {
+                case EventLogCollection.DomainControllerNtlmAuth:
+                    query = String.Format(_dcNtlmAuthXpathEvents, timeFilterMs);
+                    break;
+                case EventLogCollection.InboundNtlmSessions:
+                    query = String.Format(_noSigningXpathEvents, timeFilterMs);
+                    break;
+                default:
+                    throw new InvalidOperationException("Invalid option");
+            }
+
+
+            try
+            {
+                var sw = Stopwatch.StartNew();
+                result.Sessions = CollectEvents(query);
+                sw.Stop();
+
+                result.CollectionDurationMs = sw.ElapsedMilliseconds;
+
+                _log.LogDebug($"Processed {result.Sessions.Count} event logs in {sw.Elapsed}. Event Log Collection Type: {_collectType}");
+
+                return ApiResult<NtlmSessionResult>.CreateSuccess(result);
+            }
+            catch (UnauthorizedAccessException)
+            {
+                return ApiResult<NtlmSessionResult>.CreateError("Access Denied");
+            }
+            catch (Exception ex)
+            {
+                return ApiResult<NtlmSessionResult>.CreateError($"Unexpected exception: {ex}");
+            }
+        }
+
+        private List<NtlmSession> CollectEvents(string query)
+        {
+            var ntlmSessions = new List<NtlmSession>();
+            var dupCheck = new HashSet<string>();
+
+            using EventLogReader logReader = GetEventLogReader(_host, "Security", query);
+
+            int count = 0;
+
+            for (var evnt = logReader.ReadEvent(_readEventTimeoutMs);
+                evnt != null;
+                evnt = logReader.ReadEvent())
+            {
+                count++;
+                var eventId = (SecurityLogId)evnt.Id;
+                var parsed = ProcessSecurityEvent(evnt, eventId).Result;
+                // Don't return another if we've already got the info
+                if (dupCheck.Add(GetHashString(parsed)))
+                {
+                    ntlmSessions.Add(parsed);
+                }
+
+                if (_readDelay > 0)
+                {
+                    System.Threading.Thread.Sleep(_readDelay);
+                }
+            }
+
+            return ntlmSessions;
+        }
+
+        private string GetHashString(NtlmSession s)
+        {
+            return $"{s.AccountDomain}{s.AccountName}{s.AccountSid}{s.PackageName}{s.SourceIp}{s.SourceHost}";
+        }
+
+        private async Task<string?> ResolveNameToSid(string username, string domain)
+        {
+            var (matchSuccess, sids) = await _utils.GetGlobalCatalogMatches(username, domain);
+            if (matchSuccess)
+            {
+                if (sids.Length > 1)
+                {
+                    _log.LogError("More than one SID was returned for the user '{user}'. SIDs: {sids}", username, string.Join(",", sids));
+                    return null;
+                }
+
+                return sids[0];
+            }
+            else
+            {
+                var (success, principal) = await _utils.ResolveAccountName(username, domain);
+
+                if (!success) return null;
+
+                return principal.ObjectIdentifier;
+            }
+        }
+
+        private async Task<NtlmSession> ProcessSecurityEvent(EventRecord evnt, SecurityLogId eventId)
+        {
+            NtlmSession session;
+
+            switch (eventId)
+            {
+                case SecurityLogId.Logon:
+                    session = NtlmSession.FromLogonEvent(_host, evnt);
+                    return session;
+
+                case SecurityLogId.ValidateCredential:
+
+                    session = NtlmSession.FromValidateCredentialEvent(_host, evnt);
+
+                    // The Validate Credential event does not return the domain or account sid
+                    // so try and find those
+                    var sid = await ResolveNameToSid(session.AccountName, _domain);
+
+                    session.AccountSid = sid?.ToString();
+                    session.AccountDomain = _domain;
+
+                    return session;
+
+                default:
+                    throw new InvalidOperationException("Unhandled security event log ID");
+            }
+        }
+
+
+        private EventLogReader GetEventLogReader(string host, string path, string query)
+        {
+            var eventsQuery = new EventLogQuery(path, PathType.LogName, query) { ReverseDirection = true };
+            EventLogSession session;
+            if (!string.IsNullOrEmpty(host))
+            {
+
+                if (_localAdminCred == null)
+                {
+                    session = new EventLogSession(
+                        host,
+                        null,
+                        null,
+                        null,
+                        SessionAuthentication.Negotiate
+                    );
+                }
+                else
+                {
+                    session = new EventLogSession(
+                        host,
+                        _localAdminCred.Domain,
+                        _localAdminCred.UserName,
+                        _localAdminCred.SecurePassword,
+                        SessionAuthentication.Negotiate
+                    );
+                }
+
+                eventsQuery.Session = session;
+            }
+
+            var logReader = new EventLogReader(eventsQuery);
+            return logReader;
+        }
+    }
+
+    public enum SecurityLogId
+    {
+        Logon = 4624,
+        ValidateCredential = 4776
+    }
+
+    public enum SecurityLogLogonType : uint
+    {
+        Interactive = 2,        // logging on interactively.
+        Network,                // logging using a network.
+        Batch,                  // logon for a batch process.
+        Service,                // logon for a service account.
+        Proxy,                  // Not supported.
+        Unlock,                 // Tattempt to unlock a workstation.
+        NetworkCleartext,       // network logon with cleartext credentials
+        NewCredentials,         // caller can clone its current token and specify new credentials for outbound connections
+        RemoteInteractive,      // terminal server session that is both remote and interactive
+        CachedInteractive,      // attempt to use the cached credentials without going out across the network
+        CachedRemoteInteractive,// same as RemoteInteractive, except used internally for auditing purposes
+        CachedUnlock            // attempt to unlock a workstation
+    }
+}
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/SmbProcessor.cs b/src/CommonLib/Processors/SmbProcessor.cs
new file mode 100644
index 00000000..0bec2b42
--- /dev/null
+++ b/src/CommonLib/Processors/SmbProcessor.cs
@@ -0,0 +1,429 @@
+#nullable enable
+
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.OutputTypes;
+using System;
+using System.Collections.Specialized;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors
+{
+    public class SmbProcessor(int timeoutMs, ILogger? log = null)
+    {
+        private readonly ILogger _log = log ?? Logging.LogProvider.CreateLogger("SmbProcessor");
+        int _timeoutMs = timeoutMs;
+
+        public async Task<ApiResult<SmbInfo>> Scan(string host)
+        {
+            var scanner = new SmbScanner();
+            var result = await scanner.Scan(host, 445, _timeoutMs);
+
+            if (result.Success && result.Info != null)
+            {
+                var info = new SmbInfo()
+                {
+                    SigningEnabled = result.Info.SmbSigning,
+                    OsVersion = result.Info.OsVersion,
+                    OsBuild = result.Info.OsBuildNumber.ToString(),
+                    DnsComputerName = result.Info.DnsComputerName,
+                };
+
+                return ApiResult<SmbInfo>.CreateSuccess(info);
+            }
+            else
+            {
+                return ApiResult<SmbInfo>.CreateError(result.ErrorMessage ?? "Unknown error");
+            }
+        }
+
+    }
+
+
+    public enum SmbVersion
+    {
+        Unknown,
+        SMBv1,
+        SMBv2
+    }
+
+    public class SmbScanResult
+    {
+        public SmbScanResult(string host)
+        {
+            Host = host;
+        }
+
+        public string Host { get; set; }
+        public bool Success { get; set; }
+        public string? ErrorMessage { get; set; }
+        public NTLMInfo? Info { get; set; }
+        public SmbVersion SmbVersion { get; set; }
+    }
+
+    public class SMBPacket
+    {
+        public SMBPacket(bool signingEnabled)
+        {
+            if (signingEnabled)
+            {
+                SMB_Signing = signingEnabled;
+                SMB_Session_Key_Length = [0x00, 0x00];
+                SMB_Negotiate_Flags = [0x15, 0x82, 0x08, 0xa0];
+            }
+            else
+            {
+                SMB_Signing = signingEnabled;
+                SMB_Session_Key_Length = [0x00, 0x00];
+                SMB_Negotiate_Flags = [0x05, 0x80, 0x08, 0xa0];
+            }
+        }
+
+        public OrderedDictionary? Packet_SMB_Header { get; set; }
+        public OrderedDictionary? Packet_SMB2_Header { get; set; }
+        public OrderedDictionary? Packet_SMB_Data { get; set; }
+        public OrderedDictionary? Packet_SMB2_Data { get; set; }
+        public OrderedDictionary? Packet_NTLMSSP_Negotiate { get; set; }
+        public OrderedDictionary? Packet_NTLMSSP_Auth { get; set; }
+        public OrderedDictionary? Packet_RPC_Data { get; set; }
+        public OrderedDictionary? Packet_SCM_Data { get; set; }
+        public bool SMB_Signing { get; set; }
+        public byte[]? SMB_Session_ID { get; set; }
+        public byte[] SMB_Session_Key_Length { get; set; }
+        public byte[] SMB_Negotiate_Flags { get; set; }
+        public byte[]? Session_Key { get; set; }
+    }
+
+    public class NTLMInfo
+    {
+        public string? NativeOs { get; set; }
+        public string? NativeLanManager { get; set; }
+        public string? NbtDomainName { get; set; }
+        public string? NbtComputer { get; set; }
+        public string? DomainName { get; set; }
+        public short OsBuildNumber { get; set; }
+        public string? OsVersion { get; set; }
+        public string? DnsComputerName { get; set; }
+        public string? DnsDomainName { get; set; }
+        public string? DnsTreeName { get; set; }
+        public DateTime TimeStamp { get; set; }
+        public bool SmbSigning { get; set; }
+
+        public static NTLMInfo FromBytes(byte[] buf)
+        {
+            NTLMInfo ntlminfo = new NTLMInfo();
+            string NTLMSSP_Negotiate = BitConverter.ToString(buf).Replace("-", "");
+            int off;
+            off = NTLMSSP_Negotiate.IndexOf("4E544C4D53535000") / 2;
+            int NTLMSSP_Negotiate_Len = (NTLMSSP_Negotiate.Length - NTLMSSP_Negotiate.IndexOf("4E544C4D53535000")) / 2;
+            byte[] ntlm = new byte[NTLMSSP_Negotiate_Len];
+            Array.Copy(buf, off, ntlm, 0, NTLMSSP_Negotiate_Len);
+
+            NTLMSSP_Negotiate_Len = BitConverter.ToInt16(ntlm, 0xc);
+            off = BitConverter.ToInt16(ntlm, 0x10);
+            ntlminfo.OsBuildNumber = BitConverter.ToInt16(ntlm, off - 6);
+            ntlminfo.OsVersion = $@"{ntlm[off - 8]}.{ntlm[off - 7]}";
+
+            off += NTLMSSP_Negotiate_Len;
+            int type = BitConverter.ToInt16(ntlm, off);
+
+            while (type != 0)
+            {
+                off += 2;
+                NTLMSSP_Negotiate_Len = BitConverter.ToInt16(ntlm, off);
+                off += 2;
+                switch (type)
+                {
+                    case 1:
+                        ntlminfo.NbtComputer = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        break;
+                    case 2:
+                        ntlminfo.NbtDomainName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        break;
+                    case 3:
+                        ntlminfo.DnsComputerName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        break;
+                    case 4:
+                        ntlminfo.DnsDomainName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        break;
+                    case 5:
+                        ntlminfo.DnsTreeName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        break;
+                    case 7:
+                        ntlminfo.TimeStamp = DateTime.FromFileTime(BitConverter.ToInt64(ntlm, off));
+                        break;
+                }
+                off += NTLMSSP_Negotiate_Len;
+                type = BitConverter.ToInt16(ntlm, off);
+            }
+
+            return ntlminfo;
+        }
+    }
+    
+    public class SmbScanner
+    { 
+        public async Task<SmbScanResult> Scan(string host, int port, int timeoutMs = 10000)
+        {
+            var result = new SmbScanResult(host)
+            {
+                Success = false,
+                SmbVersion = SmbVersion.Unknown
+            };
+
+            var SMBClientReceive = new byte[2048];
+            TcpClient? SMB_Client = null;
+            NetworkStream? SMB_Client_Stream = null;
+
+            try
+            {
+                SMB_Client = await ConnectAsync(host, port, timeoutMs);
+
+                if (!SMB_Client.Connected)
+                {
+                    result.ErrorMessage = "SMBInfo can't connect!";
+                    return result;
+                }
+
+                SMB_Client_Stream = SMB_Client.GetStream();
+
+                using var operationCts = new System.Threading.CancellationTokenSource(timeoutMs);
+
+                if (port == 139)
+                {
+                    await SendStreamAsync(SMB_Client_Stream, GetNtbiosTCPData(), operationCts.Token);
+                }
+
+                try
+                {
+                    // Try SMBv1 first
+                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNegotiateSMBv1Data(), operationCts.Token);
+
+                    bool singingEnabled = BitConverter.ToString(SMBClientReceive).Replace("-", "").Substring(78, 2) == "0F";
+
+                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNTLMSSPNegotiatev1Data(), operationCts.Token);
+
+                    int len = BitConverter.ToInt16(SMBClientReceive, 43);
+                    string[]? ss = null;
+
+                    if (Encoding.Unicode.GetString(SMBClientReceive, len + 47, SMBClientReceive.Length - len - 47).Split('\0')[0].ToLower().Contains("windows"))
+                    {
+                        ss = Encoding.Unicode.GetString(SMBClientReceive, len + 47, SMBClientReceive.Length - len - 47).Split('\0');
+                    }
+                    else
+                    {
+                        ss = Encoding.Unicode.GetString(SMBClientReceive, len + 48, SMBClientReceive.Length - len - 48).Split('\0');
+                    }
+
+                    if (ss.Length >= 2)
+                    {
+                        result.Info = NTLMInfo.FromBytes(SMBClientReceive);
+                        result.Info.NativeOs = ss[0];
+                        result.Info.NativeLanManager = ss[1];
+                        result.Info.SmbSigning = singingEnabled;
+                    }
+
+                    result.SmbVersion = SmbVersion.SMBv1;
+                    result.Success = true;
+                }
+                catch
+                {
+                    // If SMBv1 fails, try SMBv2 with a new connection
+                    if (SMB_Client != null)
+                    {
+                        SMB_Client.Close();
+                    }
+
+                    SMB_Client = await ConnectAsync(host, port, 10000);
+                    SMB_Client_Stream = SMB_Client.GetStream();
+
+                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNegotiateSMBv2Data1(), operationCts.Token);
+                    if (BitConverter.ToString([SMBClientReceive[4], SMBClientReceive[5], SMBClientReceive[6], SMBClientReceive[7]]).ToLower() == "ff-53-4d-42")
+                    {
+                        result.ErrorMessage = "Could not connect with SMBv2";
+                        return result;
+                    }
+
+                    bool signingEnabled = BitConverter.ToString(new byte[] { SMBClientReceive[70] }) == "03";
+                    var SMBPackets = new SMBPacket(signingEnabled);
+                    
+                    
+
+                    await SendStreamAsync(SMB_Client_Stream, GetNegotiateSMBv2Data2(), operationCts.Token);
+                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNTLMSSPNegotiatev2Data(SMBPackets), operationCts.Token);
+
+                    result.Info = NTLMInfo.FromBytes(SMBClientReceive);
+                    result.Info.SmbSigning = SMBPackets.SMB_Signing;
+
+                    result.SmbVersion = SmbVersion.SMBv2;
+                    result.Success = true;
+                }
+            }
+            catch (Exception ex)
+            {
+                result.ErrorMessage = ex.Message;
+            }
+            finally
+            {
+                SMB_Client?.Close();
+            }
+
+            return result;
+        }
+
+        private static async Task<TcpClient> ConnectAsync(string host, int port, int timeoutMs)
+        {
+            using var connectCts = new System.Threading.CancellationTokenSource(timeoutMs + 100);
+            var client = new TcpClient();
+
+            client.Client.SendTimeout = timeoutMs;
+            client.Client.ReceiveTimeout = timeoutMs;
+
+            try
+            {
+                var connectTask = client.ConnectAsync(host, port);
+                if (await Task.WhenAny(connectTask, Task.Delay(timeoutMs, connectCts.Token)) != connectTask)
+                {
+                    client.Close();
+                    throw new TimeoutException($"Connection to {host}:{port} timed out after {timeoutMs}ms");
+                }
+
+                await connectTask;
+                return client;
+            }
+            catch (Exception ex) when (ex is SocketException || ex is TimeoutException)
+            {
+                client.Close();
+                throw new TimeoutException($"Connection to {host}:{port} timed out after {timeoutMs}ms", ex);
+            }
+            catch
+            {
+                client.Close();
+                throw;
+            }
+        }
+
+        private static async Task<byte[]> SendStreamAsync(NetworkStream stream, byte[] BytesToSend, System.Threading.CancellationToken cancellationToken)
+        {
+            byte[] BytesReceived = new byte[2048];
+            await stream.WriteAsync(BytesToSend, 0, BytesToSend.Length, cancellationToken);
+            await stream.FlushAsync(cancellationToken);
+            await stream.ReadAsync(BytesReceived, 0, BytesReceived.Length, cancellationToken);
+            return BytesReceived;
+        }
+
+        private static byte[] GetNtbiosTCPData()
+        {
+            byte[] NtbiosTCPData = {
+                0x81,0x00,0x00,0x44,0x20,0x43,0x4b,0x46,0x44,0x45,0x4e,0x45,0x43,0x46,0x44,0x45
+                ,0x46,0x46,0x43,0x46,0x47,0x45,0x46,0x46,0x43,0x43,0x41,0x43,0x41,0x43,0x41,0x43
+                ,0x41,0x43,0x41,0x43,0x41,0x00,0x20,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43
+                ,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43
+                ,0x41,0x43,0x41,0x43,0x41,0x41,0x41,0x00
+            };
+            return NtbiosTCPData;
+        }
+
+        private static byte[] GetNegotiateSMBv1Data()
+        {
+            byte[] NegotiateSMBv1Data = {
+                0x00, 0x00, 0x00, 0x85, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xC8,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4E, 0x45, 0x54, 0x57, 0x4F,
+                0x52, 0x4B, 0x20, 0x50, 0x52, 0x4F, 0x47, 0x52, 0x41, 0x4D, 0x20, 0x31, 0x2E, 0x30, 0x00, 0x02,
+                0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x31, 0x2E, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6E, 0x64, 0x6F,
+                0x77, 0x73, 0x20, 0x66, 0x6F, 0x72, 0x20, 0x57, 0x6F, 0x72, 0x6B, 0x67, 0x72, 0x6F, 0x75, 0x70,
+                0x73, 0x20, 0x33, 0x2E, 0x31, 0x61, 0x00, 0x02, 0x4C, 0x4D, 0x31, 0x2E, 0x32, 0x58, 0x30, 0x30,
+                0x32, 0x00, 0x02, 0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x32, 0x2E, 0x31, 0x00, 0x02, 0x4E, 0x54,
+                0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32, 0x00
+            };
+            return NegotiateSMBv1Data;
+        }
+
+        private static byte[] GetNTLMSSPNegotiatev1Data()
+        {
+            byte[] NTLMSSPNegotiatev1Data = {
+                0x00, 0x00, 0x01, 0x0A, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
+                0x00, 0x00, 0x40, 0x00, 0x0C, 0xFF, 0x00, 0x0A, 0x01, 0x04, 0x41, 0x32, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x4A, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0xA0, 0xCF, 0x00, 0x60,
+                0x48, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x02, 0xA0, 0x3E, 0x30, 0x3C, 0xA0, 0x0E, 0x30,
+                0x0C, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0A, 0xA2, 0x2A, 0x04,
+                0x28, 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x82, 0x08,
+                0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x05, 0x02, 0xCE, 0x0E, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00,
+                0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
+                0x76, 0x00,0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,
+                0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00,
+                0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00,
+                0x50, 0x00, 0x61, 0x00, 0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00,
+                0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00, 0x20, 0x00,
+                0x35, 0x00, 0x2E, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00
+            };
+            return NTLMSSPNegotiatev1Data;
+        }
+
+        private static byte[] GetNegotiateSMBv2Data1()
+        {
+            byte[] NegotiateSMBData = {
+                0x00, 0x00, 0x00, 0x45, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00,
+                0x00, 0x00, 0x00, 0x18, 0x01, 0x48, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF,
+                0xAC, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x22, 0x00, 0x02,
+                0x4E, 0x54, 0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32,
+                0x00, 0x02, 0x53, 0x4D, 0x42, 0x20, 0x32, 0x2E, 0x30, 0x30,
+                0x32, 0x00, 0x02, 0x53, 0x4D, 0x42, 0x20, 0x32, 0x2E, 0x3F,
+                0x3F, 0x3F, 0x00
+            };
+            return NegotiateSMBData;
+        }
+
+        private static byte[] GetNegotiateSMBv2Data2()
+        {
+            byte[] NegotiateSMB2Data = {
+                0x00, 0x00, 0x00, 0x68, 0xFE, 0x53, 0x4D, 0x42, 0x40, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x00,
+                0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x02, 0x02, 0x10, 0x02
+            };
+            return NegotiateSMB2Data;
+        }
+
+        private static byte[] GetNTLMSSPNegotiatev2Data(SMBPacket SMBPackets)
+        {
+            byte[] NTLMSSPNegotiateData = {
+                0x00, 0x00, 0x00, 0x9A, 0xFE, 0x53, 0x4D, 0x42, 0x40, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00,
+                0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x58, 0x00, 0x42, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x60, 0x40, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05,
+                0x05, 0x02, 0xA0, 0x36, 0x30, 0x34, 0xA0, 0x0E, 0x30, 0x0C,
+                0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02,
+                0x02, 0x0A, 0xA2, 0x22, 0x04, 0x20, 0x4E, 0x54, 0x4C, 0x4D,
+                0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00,
+                SMBPackets.SMB_Negotiate_Flags[0], SMBPackets.SMB_Negotiate_Flags[1],
+                SMBPackets.SMB_Negotiate_Flags[2], SMBPackets.SMB_Negotiate_Flags[3],
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+            };
+            return NTLMSSPNegotiateData;
+        }
+    }
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs b/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
index b9b582fb..c7cb74b0 100644
--- a/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
+++ b/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
@@ -18,7 +18,7 @@ public class UserRightsAssignmentProcessor
         private readonly ILogger _log;
         private readonly ILdapUtils _utils;
 
-        public UserRightsAssignmentProcessor(ILdapUtils  utils, ILogger log = null)
+        public UserRightsAssignmentProcessor(ILdapUtils utils, ILogger log = null)
         {
             _utils = utils;
             _log = log ?? Logging.LogProvider.CreateLogger("UserRightsAssignmentProcessor");
diff --git a/src/CommonLib/Processors/WebClientServiceProcessor.cs b/src/CommonLib/Processors/WebClientServiceProcessor.cs
new file mode 100644
index 00000000..4deebbbc
--- /dev/null
+++ b/src/CommonLib/Processors/WebClientServiceProcessor.cs
@@ -0,0 +1,99 @@
+using Microsoft.Extensions.Logging;
+using Microsoft.Win32.SafeHandles;
+using SharpHoundCommonLib.OutputTypes;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors
+{
+    public class WebClientServiceProcessor(ILogger log = null)
+    {
+        private readonly ILogger _log = log ?? Logging.LogProvider.CreateLogger("WebClientServiceProcessor");
+
+        // Define constants
+        public const uint MAXIMUM_ALLOWED = 0x02000000;
+        public const uint FILE_SHARE_READ = 0x00000001;
+        public const uint FILE_SHARE_WRITE = 0x00000002;
+        public const uint FILE_SHARE_DELETE = 0x00000004;
+        public const uint OPEN_EXISTING = 3;
+
+        // Error constants
+        public const uint ERROR_FILE_NOT_FOUND = 0x80070002;
+        public const uint ERROR_ACCESS_DENIED = 0x80070005;
+        public const uint ERROR_BAD_NETPATH = 0x80070035;
+        public const uint ERROR_NETNAME_DELETED = 0x80070040;
+        public const uint ERROR_NETWORK_ACCESS_DENIED = 0x80070041;
+        public const uint ERROR_LOGON_FAILURE = 0x8007052E;
+
+        [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
+        public static extern SafeFileHandle CreateFile(
+            string lpFileName,
+            uint dwDesiredAccess,
+            uint dwShareMode,
+            IntPtr lpSecurityAttributes,
+            uint dwCreationDisposition,
+            uint dwFlagsAndAttributes,
+            IntPtr hTemplateFile);
+
+        public bool TestPathExists(string path)
+        {
+            using SafeFileHandle handle = CreateFile(
+                path,
+                MAXIMUM_ALLOWED,  // Request maximum allowed access
+                FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,  // Allow all share modes
+                IntPtr.Zero,
+                OPEN_EXISTING,
+                0,
+                IntPtr.Zero
+            );
+
+            var result = Marshal.GetHRForLastWin32Error();
+
+            if (handle.IsInvalid)
+            {
+                switch ((uint)result)
+                {
+                    case ERROR_ACCESS_DENIED:
+                        return true;
+                    case ERROR_BAD_NETPATH:
+                    case ERROR_FILE_NOT_FOUND:
+                    case ERROR_NETNAME_DELETED:
+                    case ERROR_NETWORK_ACCESS_DENIED:
+                        return false;
+                    default:
+                        Marshal.ThrowExceptionForHR(result);
+                        break;
+                }
+            }
+
+            return true;
+        }
+
+        public async Task<ApiResult<bool>> IsWebClientRunning(string computerName)
+        {
+            // When the service is running, this named pipe is present
+            var pipePath = @$"\\{computerName}\pipe\DAV RPC SERVICE";
+
+            return await Task.Run(() =>
+            {
+                try
+                {
+                    bool exists = TestPathExists(pipePath);
+
+                    return ApiResult<bool>.CreateSuccess(exists);
+
+                }
+                catch (Exception ex)
+                {
+                    return ApiResult<bool>.CreateError(ex.ToString());
+
+                }
+            });
+        }
+    }
+}
diff --git a/src/CommonLib/Properties/launchSettings.json b/src/CommonLib/Properties/launchSettings.json
new file mode 100644
index 00000000..59fd23c6
--- /dev/null
+++ b/src/CommonLib/Properties/launchSettings.json
@@ -0,0 +1,8 @@
+{
+  "profiles": {
+    "SharpHoundCommonLib": {
+      "commandName": "Project",
+      "commandLineArgs": "-C CertServices"
+    }
+  }
+}
\ No newline at end of file
diff --git a/src/CommonLib/SharpHoundCommonLib.csproj b/src/CommonLib/SharpHoundCommonLib.csproj
index fd5d7aa0..f6d04117 100644
--- a/src/CommonLib/SharpHoundCommonLib.csproj
+++ b/src/CommonLib/SharpHoundCommonLib.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
-        <TargetFramework>net462</TargetFramework>
+        <TargetFramework>net472</TargetFramework>
         <OutputType>library</OutputType>
         <PackageId>SharpHoundCommon</PackageId>
         <LangVersion>default</LangVersion>
@@ -26,6 +26,7 @@
         <Reference Include="System.DirectoryServices" />
         <Reference Include="System.DirectoryServices.AccountManagement" />
         <Reference Include="System.DirectoryServices.Protocols" />
+        <Reference Include="System.Net.Http" />
     </ItemGroup>
     <ItemGroup>
         <Folder Include="Properties" />
@@ -35,6 +36,7 @@
     </ItemGroup>
     <PropertyGroup>
         <TargetsForTfmSpecificBuildOutput>$(TargetsForTfmSpecificBuildOutput);CopyProjectReferencesToPackage</TargetsForTfmSpecificBuildOutput>
+        <AllowUnsafeBlocks>True</AllowUnsafeBlocks>
     </PropertyGroup>
     <Target Name="CopyProjectReferencesToPackage" DependsOnTargets="BuildOnlySettings;ResolveReferences">
         <ItemGroup>
diff --git a/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs b/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
new file mode 100644
index 00000000..68594ff3
--- /dev/null
+++ b/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
@@ -0,0 +1,515 @@
+#nullable enable
+using System;
+using System.Buffers;
+using System.Runtime.InteropServices;
+
+namespace SharpHoundCommonLib.ThirdParty.PSOpenAD;
+
+public enum AuthenticationMethod
+{
+    /// <summary>Selects the best auth mechanism available.</summary>
+    Default,
+
+    /// <summary>No authentication.</summary>
+    Anonymous,
+
+    /// <summary>
+    /// Simple auth with a plaintext username and password, should only be used with LDAPS or StartTLS.
+    /// </summary>
+    Simple,
+
+    /// <summary>GSSAPI/SSPI Negotiate (SASL GSS-SPNEGO) authentication.</summary>
+    Negotiate,
+
+    /// <summary>GSSAPI/SSPI Kerberos (SASL GSSAPI) authentication</summary>
+    Kerberos,
+
+    /// <summary>Authentication using a client provided X.509 Certificate for LDAP or StartTLS.</summary>
+    Certificate,
+
+    // <summary>Authentication using NTLM</summary>
+    NTLM
+}
+
+/// <summary>Details on an authentication mechanism for the local client.</summary>
+public sealed class AuthenticationProvider
+{
+    /// <summary>The authentication mechanism this represents.</summary>
+    public AuthenticationMethod Method { get; }
+
+    /// <summary>The SASL mechanism identifier for this provider.</summary>
+    public string SaslId { get; }
+
+    /// <summary>Whether the client can use this provider.</summary>
+    public bool Available { get; }
+
+    /// <summary>Whether this authentication mechanism can sign/encrypt data over a non-TLS connection.</summary>
+    public bool CanSign { get; }
+
+    /// <summary>Further details on why the mechanism is not available.</summary>
+    public string Details { get; }
+
+    public AuthenticationProvider(AuthenticationMethod method, string saslId, bool available, bool canSign,
+        string details)
+    {
+        Method = method;
+        SaslId = saslId;
+        Available = available;
+        CanSign = canSign;
+        Details = details;
+    }
+}
+
+internal enum GssapiProvider
+{
+    None,
+    MIT,
+    Heimdal,
+    GSSFramework,
+    SSPI,
+}
+
+[Flags]
+internal enum SASLSecurityFlags : byte
+{
+    None = 0,
+    NoSecurity = 1,
+    Integrity = 2,
+    Confidentiality = 4,
+}
+
+public class ChannelBindings
+{
+    public int InitiatorAddrType { get; set; }
+    public byte[]? InitiatorAddr { get; set; }
+    public int AcceptorAddrType { get; set; }
+    public byte[]? AcceptorAddr { get; set; }
+    public byte[]? ApplicationData { get; set; }
+}
+
+internal abstract class SecurityContext : IDisposable
+{
+    public bool Complete { get; internal set; }
+    public bool IntegrityAvailable { get; internal set; }
+    public bool ConfidentialityAvailable { get; internal set; }
+
+    public abstract byte[] Step(byte[]? inputToken = null);
+    public abstract byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt);
+    public abstract byte[] Unwrap(ReadOnlySpan<byte> data);
+
+    public abstract UInt32 MaxWrapSize(UInt32 outputSize, bool confReq);
+
+    public abstract void Dispose();
+    ~SecurityContext() => Dispose();
+}
+
+internal class ExternalContext : SecurityContext
+{
+    private bool _called;
+
+    public override byte[] Step(byte[]? inputToken = null)
+    {
+        // No actual tokens are exchanged but we need to return at least 1 empty array and set it to be completed
+        // on the next call
+        Complete = _called;
+        _called = true; // Next call with set Complete = true
+
+        return Array.Empty<byte>();
+    }
+
+    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt) => Array.Empty<byte>();
+    public override byte[] Unwrap(ReadOnlySpan<byte> data) => Array.Empty<byte>();
+    public override uint MaxWrapSize(uint outputSize, bool confReq) => 0;
+    public override void Dispose()
+    { }
+}
+
+//internal class GssapiContext : SecurityContext
+//{
+//    private readonly SafeGssapiCred? _credential;
+//    private readonly SafeGssapiName _targetSpn;
+//    private readonly ChannelBindings? _bindingData;
+//    private readonly byte[]? _mech;
+//    private readonly GssapiContextFlags _flags = GssapiContextFlags.GSS_C_MUTUAL_FLAG |
+//        GssapiContextFlags.GSS_C_SEQUENCE_FLAG;
+//    private SafeGssapiSecContext? _context;
+
+//    public GssapiContext(string? username, string? password, AuthenticationMethod method, string target,
+//        ChannelBindings? channelBindings, bool integrity, bool confidentiality)
+//    {
+//        _bindingData = channelBindings;
+//        _mech = method == AuthenticationMethod.Negotiate ? GSSAPI.SPNEGO : GSSAPI.KERBEROS;
+//        _targetSpn = GSSAPI.ImportName(target, GSSAPI.GSS_C_NT_HOSTBASED_SERVICE);
+
+//        bool isHeimdal = GlobalState.GssapiProvider != GssapiProvider.MIT;
+//        List<byte[]> mechList = new() { _mech };
+//        if (isHeimdal && method == AuthenticationMethod.Negotiate)
+//        {
+//            mechList.AddRange(new[] { GSSAPI.KERBEROS, GSSAPI.NTLM });
+//        }
+
+//        if (!string.IsNullOrEmpty(username) && !string.IsNullOrEmpty(password))
+//        {
+//            using SafeGssapiName name = GSSAPI.ImportName(username, GSSAPI.GSS_C_NT_USER_NAME);
+//            _credential = GSSAPI.AcquireCredWithPassword(name, password, 0, mechList,
+//                GssapiCredUsage.GSS_C_INITIATE).Creds;
+
+//            if (GlobalState.GssapiProvider != GssapiProvider.MIT)
+//            {
+//                _mech = null;
+//            }
+//        }
+//        else
+//        {
+//            SafeGssapiName? name = null;
+//            if (!string.IsNullOrEmpty(username))
+//                name = GSSAPI.ImportName(username, GSSAPI.GSS_C_NT_USER_NAME);
+
+//            using (name)
+//                _credential = GSSAPI.AcquireCred(name, 0, mechList, GssapiCredUsage.GSS_C_INITIATE).Creds;
+//        }
+
+//        if (integrity)
+//            _flags |= GssapiContextFlags.GSS_C_INTEG_FLAG;
+
+//        if (confidentiality)
+//            _flags |= GssapiContextFlags.GSS_C_INTEG_FLAG | GssapiContextFlags.GSS_C_CONF_FLAG;
+
+//        if (method == AuthenticationMethod.Kerberos)
+//        {
+//            // Kerberos uses a special SASL wrapping mechanism and always requires integrity
+//            _flags |= GssapiContextFlags.GSS_C_INTEG_FLAG;
+//        }
+//        else if (!integrity && !confidentiality)
+//        {
+//            // GSSAPI always sets INTEG | CONF unless this flag is set. When using GSS-SPNEGO over TLS Windows
+//            // will reject the auth as you cannot nested wrapping within TLS. By setting this flag GSSAPI will no
+//            // longer add the integrity of conf flags to the auth mechanism allowing it to work with Windows.
+//            // Note: This does not apply to Kerberos (SASL GSSAPI) as there are futher token exchanges after the
+//            // auth to negotiate the integrity/conf options.
+//            GSSAPI.SetCredOption(_credential, GSSAPI.GSS_KRB5_CRED_NO_CI_FLAGS_X);
+//        }
+//    }
+
+//    public override byte[] Step(byte[]? inputToken = null)
+//    {
+//        var res = GSSAPI.InitSecContext(_credential, _context, _targetSpn, _mech, _flags, 0, _bindingData,
+//            inputToken);
+//        _context = res.Context;
+
+//        if (!res.MoreNeeded)
+//        {
+//            Complete = true;
+//            IntegrityAvailable = (res.Flags & GssapiContextFlags.GSS_C_INTEG_FLAG) != 0;
+//            ConfidentialityAvailable = (res.Flags & GssapiContextFlags.GSS_C_CONF_FLAG) != 0;
+//        }
+
+//        return res.OutputToken ?? Array.Empty<byte>();
+//    }
+
+//    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt)
+//    {
+//        if (_context == null || !Complete)
+//            throw new InvalidOperationException("Cannot wrap without a completed context");
+
+//        (byte[] wrappedData, bool _) = GSSAPI.Wrap(_context, encrypt, 0, data);
+//        return wrappedData;
+//    }
+
+//    public override byte[] Unwrap(ReadOnlySpan<byte> data)
+//    {
+//        if (_context == null || !Complete)
+//            throw new InvalidOperationException("Cannot unwrap without a completed context");
+
+//        (byte[] unwrappedData, bool _1, int _2) = GSSAPI.Unwrap(_context, data);
+//        return unwrappedData;
+//    }
+
+//    public override uint MaxWrapSize(uint outputSize, bool confReq)
+//    {
+//        if (_context == null || !Complete)
+//            throw new InvalidOperationException("Cannot get max wrap size without a completed context");
+
+//        return GSSAPI.WrapSizeLimit(_context, confReq, 0, outputSize);
+//    }
+
+//    public override void Dispose()
+//    {
+//        _credential?.Dispose();
+//        _context?.Dispose();
+//        _targetSpn?.Dispose();
+//    }
+//}
+
+internal class SspiContext : SecurityContext
+{
+    private readonly SafeSspiCredentialHandle _credential;
+    private readonly byte[]? _bindingData;
+    private readonly string _targetSpn;
+    private readonly InitiatorContextRequestFlags _flags = InitiatorContextRequestFlags.ISC_REQ_MUTUAL_AUTH;
+    private SafeSspiContextHandle? _context;
+    private UInt32 _blockSize = 0;
+    private UInt32 _trailerSize = 0;
+    private UInt32 _seqNo = 0;
+
+    public SspiContext(string? username, string? password, AuthenticationMethod method, string target,
+        ChannelBindings? channelBindings, bool integrity, bool confidentiality)
+    {
+        _bindingData = CreateChannelBindings(channelBindings);
+        _targetSpn = target;
+
+        string package = Enum.GetName(typeof(AuthenticationMethod), method);
+        WinNTAuthIdentity? identity = null;
+        if (!string.IsNullOrEmpty(username) || !string.IsNullOrEmpty(password))
+        {
+            string? domain = null;
+            if (username?.Contains("\\") == true)
+            {
+                string[] stringSplit = username.Split(['\\'], 2);
+                domain = stringSplit[0];
+                username = stringSplit[1];
+            }
+
+            identity = new WinNTAuthIdentity(username, domain, password);
+        }
+        _credential = SSPI.AcquireCredentialsHandle(null, package, CredentialUse.SECPKG_CRED_OUTBOUND,
+            identity).Creds;
+
+        const InitiatorContextRequestFlags integrityFlags = InitiatorContextRequestFlags.ISC_REQ_INTEGRITY |
+            InitiatorContextRequestFlags.ISC_REQ_SEQUENCE_DETECT;
+
+        if (integrity)
+            _flags |= integrityFlags;
+
+        if (confidentiality)
+            _flags |= integrityFlags | InitiatorContextRequestFlags.ISC_REQ_CONFIDENTIALITY;
+
+        if (method == AuthenticationMethod.Kerberos)
+        {
+            // Kerberos uses a special SASL wrapping mechanism and always requires integrity
+            _flags |= integrityFlags;
+        }
+        else if (!integrity && !confidentiality)
+        {
+            // GSS-SPNEGO uses the context flags to determine the protection applied and Kerberos always sets
+            // INTEG by default. By setting this flag we unset INTEG allowing it to be used without any protection.
+            _flags |= InitiatorContextRequestFlags.ISC_REQ_NO_INTEGRITY;
+        }
+    }
+
+    public override byte[] Step(byte[]? inputToken = null)
+    {
+        int bufferCount = 0;
+        if (inputToken != null)
+            bufferCount++;
+
+        if (_bindingData != null)
+            bufferCount++;
+
+        unsafe
+        {
+            fixed (byte* input = inputToken, cbBuffer = _bindingData)
+            {
+                Span<Helpers.SecBuffer> inputBuffers = stackalloc Helpers.SecBuffer[bufferCount];
+                int idx = 0;
+
+                if (inputToken != null)
+                {
+                    inputBuffers[idx].cbBuffer = (UInt32)inputToken.Length;
+                    inputBuffers[idx].BufferType = (UInt32)SecBufferType.SECBUFFER_TOKEN;
+                    inputBuffers[idx].pvBuffer = (IntPtr)input;
+                    idx++;
+                }
+
+                if (_bindingData != null)
+                {
+                    inputBuffers[idx].cbBuffer = (UInt32)_bindingData.Length;
+                    inputBuffers[idx].BufferType = (UInt32)SecBufferType.SECBUFFER_CHANNEL_BINDINGS;
+                    inputBuffers[idx].pvBuffer = (IntPtr)cbBuffer;
+                }
+
+                SspiSecContext context = SSPI.InitializeSecurityContext(_credential, _context, _targetSpn, _flags,
+                    TargetDataRep.SECURITY_NATIVE_DREP, inputBuffers, new[] { SecBufferType.SECBUFFER_TOKEN, });
+                _context = context.Context;
+
+                if (!context.MoreNeeded)
+                {
+                    Complete = true;
+                    IntegrityAvailable =
+                        (context.Flags & InitiatorContextReturnFlags.ISC_RET_INTEGRITY) != 0;
+                    ConfidentialityAvailable =
+                        (context.Flags & InitiatorContextReturnFlags.ISC_RET_CONFIDENTIALITY) != 0;
+
+                    Span<Helpers.SecPkgContext_Sizes> sizes = stackalloc Helpers.SecPkgContext_Sizes[1];
+                    fixed (Helpers.SecPkgContext_Sizes* sizesPtr = sizes)
+                    {
+                        SSPI.QueryContextAttributes(_context, SecPkgAttribute.SECPKG_ATTR_SIZES,
+                            (IntPtr)sizesPtr);
+
+                        _trailerSize = sizes[0].cbSecurityTrailer;
+                        _blockSize = sizes[0].cbBlockSize;
+                    }
+                }
+
+                return context.OutputBuffers.Length > 0 ? context.OutputBuffers[0] : Array.Empty<byte>();
+            }
+        }
+    }
+
+    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt)
+    {
+        if (_context == null || !Complete)
+            throw new InvalidOperationException("Cannot wrap without a completed context");
+
+        unsafe
+        {
+            ArrayPool<byte> shared = ArrayPool<byte>.Shared;
+            byte[] token = shared.Rent((int)_trailerSize);
+            byte[] padding = shared.Rent((int)_blockSize);
+
+            try
+            {
+                fixed (byte* tokenPtr = token, dataPtr = data, paddingPtr = padding)
+                {
+                    Span<Helpers.SecBuffer> buffers = stackalloc Helpers.SecBuffer[3];
+                    buffers[0].BufferType = (UInt32)SecBufferType.SECBUFFER_TOKEN;
+                    buffers[0].cbBuffer = _trailerSize;
+                    buffers[0].pvBuffer = (IntPtr)tokenPtr;
+
+                    buffers[1].BufferType = (UInt32)SecBufferType.SECBUFFER_DATA;
+                    buffers[1].cbBuffer = (UInt32)data.Length;
+                    buffers[1].pvBuffer = (IntPtr)dataPtr;
+
+                    buffers[2].BufferType = (UInt32)SecBufferType.SECBUFFER_PADDING;
+                    buffers[2].cbBuffer = _blockSize;
+                    buffers[2].pvBuffer = (IntPtr)paddingPtr;
+
+                    UInt32 qop = encrypt ? 0 : 0x80000001; // SECQOP_WRAP_NO_ENCRYPT
+                    SSPI.EncryptMessage(_context, qop, buffers, NextSeqNo());
+
+                    byte[] wrapped = new byte[buffers[0].cbBuffer + buffers[1].cbBuffer + buffers[2].cbBuffer];
+                    int offset = 0;
+                    if (buffers[0].cbBuffer > 0)
+                    {
+                        Buffer.BlockCopy(token, 0, wrapped, offset, (int)buffers[0].cbBuffer);
+                        offset += (int)buffers[0].cbBuffer;
+                    }
+
+                    Marshal.Copy((IntPtr)dataPtr, wrapped, offset, (int)buffers[1].cbBuffer);
+                    offset += (int)buffers[1].cbBuffer;
+
+                    if (buffers[2].cbBuffer > 0)
+                    {
+                        Buffer.BlockCopy(padding, 0, wrapped, offset, (int)buffers[2].cbBuffer);
+                        offset += (int)buffers[2].cbBuffer;
+                    }
+
+                    return wrapped;
+                }
+            }
+            finally
+            {
+                shared.Return(token);
+                shared.Return(padding);
+            }
+        }
+    }
+
+    public override byte[] Unwrap(ReadOnlySpan<byte> data)
+    {
+        if (_context == null || !Complete)
+            throw new InvalidOperationException("Cannot wrap without a completed context");
+
+        unsafe
+        {
+            fixed (byte* dataPtr = data)
+            {
+                Span<Helpers.SecBuffer> buffers = stackalloc Helpers.SecBuffer[2];
+                buffers[0].BufferType = (UInt32)SecBufferType.SECBUFFER_STREAM;
+                buffers[0].cbBuffer = (UInt32)data.Length;
+                buffers[0].pvBuffer = (IntPtr)dataPtr;
+
+                buffers[1].BufferType = (UInt32)SecBufferType.SECBUFFER_DATA;
+                buffers[1].cbBuffer = 0;
+                buffers[1].pvBuffer = IntPtr.Zero;
+
+                SSPI.DecryptMessage(_context, buffers, NextSeqNo());
+
+                byte[] unwrapped = new byte[buffers[1].cbBuffer];
+                Marshal.Copy(buffers[1].pvBuffer, unwrapped, 0, unwrapped.Length);
+
+                return unwrapped;
+            }
+        }
+    }
+
+    public override UInt32 MaxWrapSize(UInt32 outputSize, bool confReq)
+    {
+        throw new NotImplementedException(); // Not used in SSPI.
+    }
+
+    private byte[]? CreateChannelBindings(ChannelBindings? bindings)
+    {
+        if (bindings == null)
+            return null;
+
+        int structOffset = Marshal.SizeOf<Helpers.SEC_CHANNEL_BINDINGS>();
+        int binaryLength = bindings.InitiatorAddr?.Length ?? 0 + bindings.AcceptorAddr?.Length ?? 0 +
+            bindings.ApplicationData?.Length ?? 0;
+        byte[] bindingData = new byte[structOffset + binaryLength];
+        unsafe
+        {
+            fixed (byte* bindingPtr = bindingData)
+            {
+                Helpers.SEC_CHANNEL_BINDINGS* bindingStruct = (Helpers.SEC_CHANNEL_BINDINGS*)bindingPtr;
+
+                bindingStruct->dwInitiatorAddrType = (UInt32)bindings.InitiatorAddrType;
+                if (bindings.InitiatorAddr != null)
+                {
+                    bindingStruct->cbInitiatorLength = (UInt32)bindings.InitiatorAddr.Length;
+                    bindingStruct->dwInitiatorOffset = (UInt32)structOffset;
+                    Buffer.BlockCopy(bindings.InitiatorAddr, 0, bindingData, structOffset,
+                        bindings.InitiatorAddr.Length);
+
+                    structOffset += bindings.InitiatorAddr.Length;
+                }
+
+                bindingStruct->dwAcceptorAddrType = (UInt32)bindings.AcceptorAddrType;
+                if (bindings.AcceptorAddr != null)
+                {
+                    bindingStruct->cbAcceptorLength = (UInt32)bindings.AcceptorAddr.Length;
+                    bindingStruct->dwAcceptorOffset = (UInt32)structOffset;
+                    Buffer.BlockCopy(bindings.AcceptorAddr, 0, bindingData, structOffset,
+                        bindings.AcceptorAddr.Length);
+
+                    structOffset += bindings.AcceptorAddr.Length;
+                }
+
+                if (bindings.ApplicationData != null)
+                {
+                    bindingStruct->cbApplicationDataLength = (UInt32)bindings.ApplicationData.Length;
+                    bindingStruct->dwApplicationDataOffset = (UInt32)structOffset;
+                    Buffer.BlockCopy(bindings.ApplicationData, 0, bindingData, structOffset,
+                        bindings.ApplicationData.Length);
+                }
+            }
+        }
+
+        return bindingData;
+    }
+
+    private UInt32 NextSeqNo()
+    {
+        UInt32 seqNo = _seqNo;
+        _seqNo++;
+
+        return seqNo;
+    }
+
+    public override void Dispose()
+    {
+        _credential.Dispose();
+        _context?.Dispose();
+    }
+}
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs b/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs
new file mode 100644
index 00000000..ab606a12
--- /dev/null
+++ b/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs
@@ -0,0 +1,676 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.Authentication;
+
+namespace SharpHoundCommonLib.ThirdParty.PSOpenAD;
+
+internal static partial class Helpers
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SEC_CHANNEL_BINDINGS
+    {
+        public UInt32 dwInitiatorAddrType;
+        public UInt32 cbInitiatorLength;
+        public UInt32 dwInitiatorOffset;
+        public UInt32 dwAcceptorAddrType;
+        public UInt32 cbAcceptorLength;
+        public UInt32 dwAcceptorOffset;
+        public UInt32 cbApplicationDataLength;
+        public UInt32 dwApplicationDataOffset;
+    }
+
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    public struct SEC_WINNT_AUTH_IDENTITY_W
+    {
+        public unsafe char* User;
+        public UInt32 UserLength;
+        public unsafe char* Domain;
+        public UInt32 DomainLength;
+        public unsafe char* Password;
+        public UInt32 PasswordLength;
+        public WinNTAuthIdentityFlags Flags;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SECURITY_INTEGER
+    {
+        public UInt32 LowPart;
+        public Int32 HighPart;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecBufferDesc
+    {
+        public UInt32 ulVersion;
+        public UInt32 cBuffers;
+        public IntPtr pBuffers;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecBuffer
+    {
+        public UInt32 cbBuffer;
+        public UInt32 BufferType;
+        public IntPtr pvBuffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecHandle
+    {
+        public UIntPtr dwLower;
+        public UIntPtr dwUpper;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecPkgContext_Sizes
+    {
+        public UInt32 cbMaxToken;
+        public UInt32 cbMaxSignature;
+        public UInt32 cbBlockSize;
+        public UInt32 cbSecurityTrailer;
+    }
+}
+
+/// <summary>Result of <c>AcquireCredentialsHandle</c>.</summary>
+internal class SspiCredential
+{
+    /// <summary>The handle to the SSPI credential.</summary>
+    public SafeSspiCredentialHandle Creds { get; }
+
+    /// <summary>The number of ticks (100s of nanoseconds) since 1601-01-01 until the credential expires.</summary>
+    public UInt64 Expiry { get; }
+
+    public SspiCredential(SafeSspiCredentialHandle creds, UInt64 expiry)
+    {
+        Creds = creds;
+        Expiry = expiry;
+    }
+}
+
+/// <summary>Result of <c>InitializeSecurityContext</c>.</summary>
+internal class SspiSecContext
+{
+    /// <summary>The handle to the SSPI security context.</summary>
+    public SafeSspiContextHandle Context { get; }
+
+    /// <summary>The return buffer values from the SSPI call.</summary>
+    public byte[][] OutputBuffers { get; }
+
+    /// <summary>The number of ticks (100s of nanoseconds) since 1601-01-01 until the context expires.</summary>
+    public UInt64 Expiry { get; }
+
+    /// <summary>The attributes used to describe the functionality available on the context.</summary>
+    public InitiatorContextReturnFlags Flags { get; }
+
+    /// <summary>Whether more data is needed from the acceptor to complete the context.</summary>
+    public bool MoreNeeded { get; }
+
+    public SspiSecContext(SafeSspiContextHandle context, byte[][] outputBuffers, UInt64 expiry,
+        InitiatorContextReturnFlags flags, bool moreNeeded)
+    {
+        Context = context;
+        OutputBuffers = outputBuffers;
+        Expiry = expiry;
+        Flags = flags;
+        MoreNeeded = moreNeeded;
+    }
+}
+
+internal static class SSPI
+{
+    private const Int32 SEC_I_CONTINUE_NEEDED = 0x00090312;
+
+    [DllImport("Secur32.dll", CharSet = CharSet.Unicode)]
+    private static unsafe extern Int32 AcquireCredentialsHandleW(
+        [MarshalAs(UnmanagedType.LPWStr)] string? pszPrincipal,
+        [MarshalAs(UnmanagedType.LPWStr)] string pPackage,
+        CredentialUse fCredentialUse,
+        IntPtr pvLogonId,
+        Helpers.SEC_WINNT_AUTH_IDENTITY_W* pAuthData,
+        IntPtr pGetKeyFn,
+        IntPtr pvGetKeyArgument,
+        SafeSspiCredentialHandle phCredential,
+        out Helpers.SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("Secur32.dll", EntryPoint = "DecryptMessage")]
+    private static extern Int32 DecryptMessageNative(
+        SafeSspiContextHandle phContext,
+        ref Helpers.SecBufferDesc pMessage,
+        UInt32 MessageSeqNo,
+        out UInt32 pfQOP);
+
+    [DllImport("Secur32.dll")]
+    public static extern Int32 DeleteSecurityContext(
+        IntPtr phContext);
+
+    [DllImport("Secur32.dll", EntryPoint = "EncryptMessage")]
+    private static extern Int32 EncryptMessageNative(
+        SafeSspiContextHandle phContext,
+        UInt32 fQOP,
+        ref Helpers.SecBufferDesc pMessage,
+        UInt32 MessageSeqNo);
+
+    [DllImport("Secur32.dll")]
+    public static extern Int32 FreeContextBuffer(
+        IntPtr pvContextBuffer);
+
+    [DllImport("Secur32.dll")]
+    public static extern Int32 FreeCredentialsHandle(
+        IntPtr phCredential);
+
+    [DllImport("Secur32.dll", CharSet = CharSet.Unicode)]
+    private static unsafe extern Int32 InitializeSecurityContextW(
+        Helpers.SecHandle* phCredential,
+        Helpers.SecHandle* phContext,
+        [MarshalAs(UnmanagedType.LPWStr)] string pszTargetName,
+        InitiatorContextRequestFlags fContextReq,
+        UInt32 Reserved1,
+        TargetDataRep TargetDataRep,
+        Helpers.SecBufferDesc* pInput,
+        UInt32 Reserved2,
+        Helpers.SecHandle* phNewContext,
+        Helpers.SecBufferDesc* pOutput,
+        out InitiatorContextReturnFlags pfContextAttr,
+        out Helpers.SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("Secur32.dll", EntryPoint = "QueryContextAttributes")]
+    private static extern Int32 QueryContextAttributesNative(
+        SafeSspiContextHandle phContext,
+        SecPkgAttribute ulAttribute,
+        IntPtr pBuffer);
+
+    /// <summary>Acquire SSPI credential.</summary>
+    /// <param name="principal">The name of the principal whose credentials the handle will reference.</param>
+    /// <param name="package">The name of the SSPI security provide the credentials will be used for.</param>
+    /// <param name="usage">How the credentials will be used.</param>
+    /// <param name="identity">
+    /// The credential logon information or <c>null</c> to use the current user's credentials.
+    /// </param>
+    /// <returns>Credential information including the handle to the credential itself.</returns>
+    /// <exception href="SspiException">Error when retrieving the credential.</exception>
+    /// <see cref="https://docs.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--general">AcquireCredentialsHandle</see>
+    public static SspiCredential AcquireCredentialsHandle(string? principal, string package, CredentialUse usage,
+        WinNTAuthIdentity? identity)
+    {
+        string? user = identity?.Username;
+        string? domain = identity?.Domain;
+        string? pass = identity?.Password;
+
+        unsafe
+        {
+            Helpers.SEC_WINNT_AUTH_IDENTITY_W authData = new();
+            Helpers.SEC_WINNT_AUTH_IDENTITY_W* authDataPtr = null;
+            fixed (char* userPtr = user, domainPtr = domain, passPtr = pass)
+            {
+                if (identity != null)
+                {
+                    authDataPtr = &authData;
+                    authData.User = userPtr;
+                    authData.UserLength = (UInt16)(identity.Username?.Length ?? 0);
+                    authData.Domain = domainPtr;
+                    authData.DomainLength = (UInt16)(identity.Domain?.Length ?? 0);
+                    authData.Password = passPtr;
+                    authData.PasswordLength = (UInt16)(identity.Password?.Length ?? 0);
+                    authData.Flags = WinNTAuthIdentityFlags.SEC_WINNT_AUTH_IDENTITY_UNICODE;
+                }
+
+                SafeSspiCredentialHandle cred = new();
+                int res = AcquireCredentialsHandleW(principal, package, usage, IntPtr.Zero, authDataPtr, IntPtr.Zero,
+                    IntPtr.Zero, cred, out var expiryStruct);
+
+                if (res != 0)
+                    throw new SspiException(res, "AcquireCredentialsHandle");
+
+                cred.SSPIFree = true;
+                UInt64 expiry = (UInt64)expiryStruct.HighPart << 32 | (UInt64)expiryStruct.LowPart;
+                return new SspiCredential(cred, expiry);
+            }
+        }
+    }
+
+    /// <summary>Decrypts the input message.</summary>
+    /// <remarks>
+    /// The message is decrypted in place, use the input message buffers to retrieve the decrypted value.
+    /// </remarks>
+    /// <param name="context">The SSPI security context to decrypt the message.</param>
+    /// <param name="message">The security buffers to decrypt.</param>
+    /// <param name="seqNo">The expected sequence number of the encrypted message.</param>
+    /// <returns>The quality of protection that had applied to the encrypted message.</returns>
+    /// <exception cref="SspiException">Failure trying to decrypt the message.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/decryptmessage--general">DecryptMessage</see>
+    public static UInt32 DecryptMessage(SafeSspiContextHandle context, Span<Helpers.SecBuffer> message, UInt32 seqNo)
+    {
+        unsafe
+        {
+            fixed (Helpers.SecBuffer* messagePtr = message)
+            {
+                Helpers.SecBufferDesc bufferDesc = new()
+                {
+                    ulVersion = 0,
+                    cBuffers = (UInt32)message.Length,
+                    pBuffers = (IntPtr)messagePtr,
+                };
+
+                int res = DecryptMessageNative(context, ref bufferDesc, seqNo, out var qop);
+                if (res != 0)
+                    throw new SspiException(res, "DecryptMessage");
+
+                return qop;
+            }
+        }
+    }
+
+    /// <summary>Encrypts the input message.</summary>
+    /// <remarks>
+    /// The message is encrypted in place, use the input message buffers to retrieve the encrypted value.
+    /// </remarks>
+    /// <param name="context">The SSPI security context to encrypt the message.</param>
+    /// <param name="qop">The quality of protection to apply to the message.</param>
+    /// <param name="message">The security buffers to encrypt.</param>
+    /// <param name="seqNo">The sequence number to apply to the encrypted message.</param>
+    /// <exception cref="SspiException">Failure trying to entry the message.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/encryptmessage--general">EncryptMessage</see>
+    public static void EncryptMessage(SafeSspiContextHandle context, UInt32 qop, Span<Helpers.SecBuffer> message,
+        UInt32 seqNo)
+    {
+        unsafe
+        {
+            fixed (Helpers.SecBuffer* messagePtr = message)
+            {
+                Helpers.SecBufferDesc bufferDesc = new()
+                {
+                    ulVersion = 0,
+                    cBuffers = (UInt32)message.Length,
+                    pBuffers = (IntPtr)messagePtr,
+                };
+
+                int res = EncryptMessageNative(context, qop, ref bufferDesc, seqNo);
+                if (res != 0)
+                    throw new SspiException(res, "EncryptMessage");
+            }
+        }
+    }
+
+    /// <summary>Initiates a security context or processes a new token on an existing context.</summary>
+    /// <param name="cred">The credential to use for the security context.</param>
+    /// <param name="context">
+    /// The context handle for the operation. The first call should be set to <c>null</c> while subsequent calls
+    /// use the context returned from the first call.
+    /// </param>
+    /// <param name="targetName">The target name of the acceptor, for Kerberos this is the SPN.</param>
+    /// <param name="contextReq">Request flags to set.</param>
+    /// <param name="dataRep">The data representation on the target.</param>
+    /// <param name="input">Optional token received from the acceptor or null for the first call.</param>
+    /// <param name="outputBufferTypes">List of types expected in the output buffer that is returned.</param>
+    /// <returns>Context information including the handle to the context itself.</returns>
+    /// <exception cref="SspiException">Failure initiating/continuing the security context.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/initializesecuritycontext--general">InitializeSecurityContext</see>
+    public static SspiSecContext InitializeSecurityContext(SafeSspiCredentialHandle cred,
+        SafeSspiContextHandle? context, string targetName, InitiatorContextRequestFlags contextReq,
+        TargetDataRep dataRep, ReadOnlySpan<Helpers.SecBuffer> input, IList<SecBufferType> outputBufferTypes)
+    {
+        contextReq |= InitiatorContextRequestFlags.ISC_REQ_ALLOCATE_MEMORY;
+
+        Span<Helpers.SecBuffer> output = stackalloc Helpers.SecBuffer[outputBufferTypes.Count];
+        for (int i = 0; i < output.Length; i++)
+            output[i].BufferType = (UInt32)outputBufferTypes[i];
+
+        unsafe
+        {
+            fixed (Helpers.SecBuffer* inputBuffers = input, outputBuffers = output)
+            {
+                Helpers.SecHandle* credPtr = null;
+                if (cred != null)
+                {
+                    credPtr = (Helpers.SecHandle*)cred.DangerousGetHandle();
+                }
+
+                Helpers.SecHandle* inputContextPtr = null;
+                Helpers.SecHandle* outputContextPtr = null;
+                SafeSspiContextHandle newContext;
+                if (context == null || context.DangerousGetHandle() == IntPtr.Zero)
+                {
+                    newContext = new();
+                    outputContextPtr = (Helpers.SecHandle*)newContext.DangerousGetHandle();
+                }
+                else
+                {
+                    newContext = context;
+                    inputContextPtr = (Helpers.SecHandle*)context.DangerousGetHandle();
+                    outputContextPtr = inputContextPtr;
+                }
+
+                Helpers.SecBufferDesc inputBuffer = new();
+                Helpers.SecBufferDesc* inputPtr = null;
+                if (input.Length > 0)
+                {
+                    inputBuffer.ulVersion = 0;
+                    inputBuffer.cBuffers = (UInt32)input.Length;
+                    inputBuffer.pBuffers = (IntPtr)inputBuffers;
+                    inputPtr = &inputBuffer;
+                }
+
+                Helpers.SecBufferDesc outputBuffer = new();
+                Helpers.SecBufferDesc* outputPtr = null;
+                if (output.Length > 0)
+                {
+                    outputBuffer.ulVersion = 0;
+                    outputBuffer.cBuffers = (UInt32)output.Length;
+                    outputBuffer.pBuffers = (IntPtr)outputBuffers;
+                    outputPtr = &outputBuffer;
+                }
+
+                int res = InitializeSecurityContextW(credPtr, inputContextPtr, targetName, contextReq, 0, dataRep,
+                    inputPtr, 0, outputContextPtr, outputPtr, out var contextattr, out var expiryStruct);
+
+                if (res != 0 && res != SEC_I_CONTINUE_NEEDED)
+                    throw new SspiException(res, "InitializeSecurityContext");
+
+                newContext.SSPIFree = true;
+
+                try
+                {
+                    bool moreNeeded = res == SEC_I_CONTINUE_NEEDED;
+                    UInt64 expiry = (UInt64)expiryStruct.HighPart << 32 | (UInt64)expiryStruct.LowPart;
+                    List<byte[]> outputTokens = new();
+                    foreach (Helpers.SecBuffer buffer in output)
+                    {
+                        if (buffer.cbBuffer == 0)
+                            continue;
+
+                        byte[] data = new byte[buffer.cbBuffer];
+                        Marshal.Copy(buffer.pvBuffer, data, 0, data.Length);
+                        outputTokens.Add(data);
+                    }
+
+                    return new SspiSecContext(newContext, outputTokens.ToArray(), expiry, contextattr,
+                        moreNeeded);
+                }
+                finally
+                {
+                    foreach (Helpers.SecBuffer buffer in output)
+                    {
+                        if (buffer.pvBuffer != IntPtr.Zero)
+                            FreeContextBuffer(buffer.pvBuffer);
+                    }
+                }
+            }
+        }
+    }
+
+    /// <summary>Query the security context for a specific value.</summary>
+    /// <remarks>The buffer supplied must be large enough to fill the requested attribute value.</remarks>
+    /// <param name="context">The security context to query.</param>
+    /// <param name="attribute">The type of value to query.</param>
+    /// <param name="buffer">The buffer that will store the queried value.</param>
+    /// <exception cref="SspiException">Failure trying to query the requested value.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/querycontextattributes--general">QueryContextAttributes</see>
+    public static void QueryContextAttributes(SafeSspiContextHandle context, SecPkgAttribute attribute, IntPtr buffer)
+    {
+        int res = QueryContextAttributesNative(context, attribute, buffer);
+        if (res != 0)
+            throw new SspiException(res, "QueryContextAttributesNative");
+    }
+}
+
+public class SspiException : AuthenticationException
+{
+    public int ErrorCode { get; } = -1;
+
+    public SspiException() { }
+
+    public SspiException(string message) : base(message) { }
+
+    public SspiException(string message, Exception innerException) :
+        base(message, innerException)
+    { }
+
+    public SspiException(int errorCode, string method)
+        : base(GetExceptionMessage(errorCode, method))
+    {
+        ErrorCode = errorCode;
+    }
+
+    private static string GetExceptionMessage(int errorCode, string? method)
+    {
+        method = String.IsNullOrWhiteSpace(method) ? "SSPI Call" : method;
+        string errMsg = new Win32Exception(errorCode).Message;
+
+        return String.Format("{0} failed ({1}, Win32ErrorCode {2} - 0x{2:X8})", method, errMsg, errorCode);
+    }
+}
+
+/// <summary>User identity information used to acquire a credential handle.</summary>
+internal class WinNTAuthIdentity
+{
+    /// <summary>The username of the identity.</summary>
+    public string? Username { get; }
+
+    /// <summary>The domain of the identity.</summary>
+    public string? Domain { get; }
+
+    /// <summary>The password of the identity.</summary>
+    public string? Password { get; }
+
+    public WinNTAuthIdentity(string? username, string? domain, string? password)
+    {
+        Username = username;
+        Domain = domain;
+        Password = password;
+    }
+}
+
+internal enum CredentialUse : uint
+{
+    SECPKG_CRED_INBOUND = 0x00000001,
+    SECPKG_CRED_OUTBOUND = 0x00000002,
+    SECPKG_CRED_BOTH = 0x00000003,
+    SECPKG_CRED_DEFAULT = 0x00000004,
+    SECPKG_CRED_AUTOLOGON_RESTRICTED = 0x00000010,
+    SECPKG_CRED_PROCESS_POLICY_ONLY = 0x00000020,
+}
+
+[Flags]
+internal enum InitiatorContextRequestFlags : uint
+{
+    ISC_REQ_DELEGATE = 0x00000001,
+    ISC_REQ_MUTUAL_AUTH = 0x00000002,
+    ISC_REQ_REPLAY_DETECT = 0x00000004,
+    ISC_REQ_SEQUENCE_DETECT = 0x00000008,
+    ISC_REQ_CONFIDENTIALITY = 0x00000010,
+    ISC_REQ_USE_SESSION_KEY = 0x00000020,
+    ISC_REQ_PROMPT_FOR_CREDS = 0x00000040,
+    ISC_REQ_USE_SUPPLIED_CREDS = 0x00000080,
+    ISC_REQ_ALLOCATE_MEMORY = 0x00000100,
+    ISC_REQ_USE_DCE_STYLE = 0x00000200,
+    ISC_REQ_DATAGRAM = 0x00000400,
+    ISC_REQ_CONNECTION = 0x00000800,
+    ISC_REQ_CALL_LEVEL = 0x00001000,
+    ISC_REQ_FRAGMENT_SUPPLIED = 0x00002000,
+    ISC_REQ_EXTENDED_ERROR = 0x00004000,
+    ISC_REQ_STREAM = 0x00008000,
+    ISC_REQ_INTEGRITY = 0x00010000,
+    ISC_REQ_IDENTIFY = 0x00020000,
+    ISC_REQ_NULL_SESSION = 0x00040000,
+    ISC_REQ_MANUAL_CRED_VALIDATION = 0x00080000,
+    ISC_REQ_RESERVED1 = 0x00100000,
+    ISC_REQ_FRAGMENT_TO_FIT = 0x00200000,
+    ISC_REQ_FORWARD_CREDENTIALS = 0x00400000,
+    ISC_REQ_NO_INTEGRITY = 0x00800000,
+    ISC_REQ_USE_HTTP_STYLE = 0x01000000,
+    ISC_REQ_UNVERIFIED_TARGET_NAME = 0x20000000,
+    ISC_REQ_CONFIDENTIALITY_ONLY = 0x40000000,
+}
+
+[Flags]
+internal enum InitiatorContextReturnFlags : uint
+{
+    ISC_RET_DELEGATE = 0x00000001,
+    ISC_RET_MUTUAL_AUTH = 0x00000002,
+    ISC_RET_REPLAY_DETECT = 0x00000004,
+    ISC_RET_SEQUENCE_DETECT = 0x00000008,
+    ISC_RET_CONFIDENTIALITY = 0x00000010,
+    ISC_RET_USE_SESSION_KEY = 0x00000020,
+    ISC_RET_USED_COLLECTED_CREDS = 0x00000040,
+    ISC_RET_USED_SUPPLIED_CREDS = 0x00000080,
+    ISC_RET_ALLOCATED_MEMORY = 0x00000100,
+    ISC_RET_USED_DCE_STYLE = 0x00000200,
+    ISC_RET_DATAGRAM = 0x00000400,
+    ISC_RET_CONNECTION = 0x00000800,
+    ISC_RET_INTERMEDIATE_RETURN = 0x00001000,
+    ISC_RET_CALL_LEVEL = 0x00002000,
+    ISC_RET_EXTENDED_ERROR = 0x00004000,
+    ISC_RET_STREAM = 0x00008000,
+    ISC_RET_INTEGRITY = 0x00010000,
+    ISC_RET_IDENTIFY = 0x00020000,
+    ISC_RET_NULL_SESSION = 0x00040000,
+    ISC_RET_MANUAL_CRED_VALIDATION = 0x00080000,
+    ISC_RET_RESERVED1 = 0x00100000,
+    ISC_RET_FRAGMENT_ONLY = 0x00200000,
+    ISC_RET_FORWARD_CREDENTIALS = 0x00400000,
+    ISC_RET_USED_HTTP_STYLE = 0x01000000,
+    ISC_RET_NO_ADDITIONAL_TOKEN = 0x02000000,
+    ISC_RET_REAUTHENTICATION = 0x08000000,
+    ISC_RET_CONFIDENTIALITY_ONLY = 0x40000000,
+}
+
+internal enum SecBufferFlags : uint
+{
+    SECBUFFER_READONLY_WITH_CHECKSUM = 0x10000000,
+    SECBUFFER_RESERVED = 0x60000000,
+    SECBUFFER_READONLY = 0x80000000,
+}
+
+internal enum SecBufferType : uint
+{
+    SECBUFFER_EMPTY = 0,
+    SECBUFFER_DATA = 1,
+    SECBUFFER_TOKEN = 2,
+    SECBUFFER_PKG_PARAMS = 3,
+    SECBUFFER_MISSING = 4,
+    SECBUFFER_EXTRA = 5,
+    SECBUFFER_STREAM_TRAILER = 6,
+    SECBUFFER_STREAM_HEADER = 7,
+    SECBUFFER_NEGOTIATION_INFO = 8,
+    SECBUFFER_PADDING = 9,
+    SECBUFFER_STREAM = 10,
+    SECBUFFER_MECHLIST = 11,
+    SECBUFFER_MECHLIST_SIGNATURE = 12,
+    SECBUFFER_TARGET = 13,
+    SECBUFFER_CHANNEL_BINDINGS = 14,
+    SECBUFFER_CHANGE_PASS_RESPONSE = 15,
+    SECBUFFER_TARGET_HOST = 16,
+    SECBUFFER_ALERT = 17,
+    SECBUFFER_APPLICATION_PROTOCOLS = 18,
+    SECBUFFER_SRTP_PROTECTION_PROFILES = 19,
+    SECBUFFER_SRTP_MASTER_KEY_IDENTIFIER = 20,
+    SECBUFFER_TOKEN_BINDING = 21,
+    SECBUFFER_PRESHARED_KEY = 22,
+    SECBUFFER_PRESHARED_KEY_IDENTITY = 23,
+}
+
+internal enum SecPkgAttribute : uint
+{
+    SECPKG_ATTR_SIZES = 0,
+    SECPKG_ATTR_NAMES = 1,
+    SECPKG_ATTR_LIFESPAN = 2,
+    SECPKG_ATTR_DCE_INFO = 3,
+    SECPKG_ATTR_STREAM_SIZES = 4,
+    SECPKG_ATTR_KEY_INFO = 5,
+    SECPKG_ATTR_AUTHORITY = 6,
+    SECPKG_ATTR_PROTO_INFO = 7,
+    SECPKG_ATTR_PASSWORD_EXPIRY = 8,
+    SECPKG_ATTR_SESSION_KEY = 9,
+    SECPKG_ATTR_PACKAGE_INFO = 10,
+    SECPKG_ATTR_USER_FLAGS = 11,
+    SECPKG_ATTR_NEGOTIATION_INFO = 12,
+    SECPKG_ATTR_NATIVE_NAMES = 13,
+    SECPKG_ATTR_FLAGS = 14,
+    SECPKG_ATTR_USE_VALIDATED = 15,
+    SECPKG_ATTR_CREDENTIAL_NAME = 16,
+    SECPKG_ATTR_TARGET_INFORMATION = 17,
+    SECPKG_ATTR_ACCESS_TOKEN = 18,
+    SECPKG_ATTR_TARGET = 19,
+    SECPKG_ATTR_AUTHENTICATION_ID = 20,
+    SECPKG_ATTR_LOGOFF_TIME = 21,
+    SECPKG_ATTR_NEGO_KEYS = 22,
+    SECPKG_ATTR_PROMPTING_NEEDED = 24,
+    SECPKG_ATTR_UNIQUE_BINDINGS = 25,
+    SECPKG_ATTR_ENDPOINT_BINDINGS = 26,
+    SECPKG_ATTR_CLIENT_SPECIFIED_TARGET = 27,
+    SECPKG_ATTR_LAST_CLIENT_TOKEN_STATUS = 30,
+    SECPKG_ATTR_NEGO_PKG_INFO = 31,
+    SECPKG_ATTR_NEGO_STATUS = 32,
+    SECPKG_ATTR_CONTEXT_DELETED = 33,
+    SECPKG_ATTR_DTLS_MTU = 34,
+    SECPKG_ATTR_DATAGRAM_SIZES = SECPKG_ATTR_STREAM_SIZES,
+    SECPKG_ATTR_SUBJECT_SECURITY_ATTRIBUTES = 128,
+    SECPKG_ATTR_APPLICATION_PROTOCOL = 35,
+    SECPKG_ATTR_NEGOTIATED_TLS_EXTENSIONS = 36,
+    SECPKG_ATTR_IS_LOOPBACK = 37,
+}
+
+internal enum TargetDataRep : uint
+{
+    SECURITY_NETWORK_DREP = 0x00000000,
+    SECURITY_NATIVE_DREP = 0x00000010,
+}
+
+internal enum WinNTAuthIdentityFlags : uint
+{
+    SEC_WINNT_AUTH_IDENTITY_ANSI = 1,
+    SEC_WINNT_AUTH_IDENTITY_UNICODE = 2,
+}
+
+internal class SafeSspiCredentialHandle : SafeHandle
+{
+    internal bool SSPIFree = false;
+
+    internal SafeSspiCredentialHandle()
+        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true)
+    { }
+
+    public override bool IsInvalid => handle == IntPtr.Zero;
+
+    protected override bool ReleaseHandle()
+    {
+        if (SSPIFree)
+        {
+            SSPI.FreeCredentialsHandle(handle);
+        }
+        Marshal.FreeHGlobal(handle);
+
+        return true;
+    }
+}
+
+internal class SafeSspiContextHandle : SafeHandle
+{
+    internal bool SSPIFree = false;
+
+    internal SafeSspiContextHandle()
+        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true)
+    { }
+
+    internal SafeSspiContextHandle(IntPtr handle, bool ownsHandle)
+        : base(handle, ownsHandle)
+    { }
+
+    public override bool IsInvalid => handle == IntPtr.Zero;
+
+    protected override bool ReleaseHandle()
+    {
+        if (SSPIFree)
+        {
+            SSPI.DeleteSecurityContext(handle);
+        }
+
+        Marshal.FreeHGlobal(handle);
+
+        return true;
+    }
+}
+#nullable disable
\ No newline at end of file

From 9a5eb07478bd040783de0aaed2f72d85fd091f3f Mon Sep 17 00:00:00 2001
From: Rohan Vazarkar <rvazarkar@specterops.io>
Date: Mon, 9 Dec 2024 11:58:17 -0500
Subject: [PATCH 2/5] chore: code formatter

---
 src/CommonLib/LdapUtils.cs | 218 ++++++++++++++-----------------------
 1 file changed, 82 insertions(+), 136 deletions(-)

diff --git a/src/CommonLib/LdapUtils.cs b/src/CommonLib/LdapUtils.cs
index 68123258..a805d54d 100644
--- a/src/CommonLib/LdapUtils.cs
+++ b/src/CommonLib/LdapUtils.cs
@@ -182,7 +182,7 @@ public IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParame
             } catch {
                 //pass
             }
-           
+
 
             return (false, Label.Base);
         }
@@ -227,7 +227,7 @@ public IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParame
             } catch {
                 //pass
             }
-            
+
 
             return (false, Label.Base);
         }
@@ -361,7 +361,7 @@ public IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParame
             } catch {
                 //pass
             }
-            
+
 
             return (false, string.Empty);
         }
@@ -904,7 +904,6 @@ public async Task<bool> IsDomainController(string computerObjectId, string domai
                 _unresolvablePrincipals.Add(distinguishedName);
                 return (false, default);
             }
-            
         }
 
         public async Task<(bool Success, string DSHeuristics)> GetDSHueristics(string domain, string dn) {
@@ -961,7 +960,7 @@ public async IAsyncEnumerable<OutputBase> GetWellKnownPrincipalOutput() {
                 yield return entdc;
             }
         }
-        
+
         private async IAsyncEnumerable<Group> GetEnterpriseDCGroups() {
             var grouped = new ConcurrentDictionary<string, List<string>>(StringComparer.OrdinalIgnoreCase);
             var forestSidToName = new ConcurrentDictionary<string, string>(StringComparer.OrdinalIgnoreCase);
@@ -985,6 +984,7 @@ await GetDomainSidFromDomainName(forestName) is (true, var forestDomainSid)) {
                 if (!forestSidToName.TryGetValue(f.Key, out var forestName)) {
                     continue;
                 }
+
                 var group = new Group { ObjectIdentifier = $"{forestName}-S-1-5-9" };
                 group.Properties.Add("name", $"ENTERPRISE DOMAIN CONTROLLERS@{forestName}".ToUpper());
                 group.Properties.Add("domainsid", f.Key);
@@ -1143,10 +1143,8 @@ internal static bool ResolveLabel(string objectIdentifier, string distinguishedN
         }
 
         public static async Task<(bool Success, ResolvedSearchResult ResolvedResult)> ResolveSearchResult(
-            IDirectoryObject directoryObject, ILdapUtils utils)
-        {
-            if (!directoryObject.GetObjectIdentifier(out var objectIdentifier))
-            {
+            IDirectoryObject directoryObject, ILdapUtils utils) {
+            if (!directoryObject.GetObjectIdentifier(out var objectIdentifier)) {
                 return (false, default);
             }
 
@@ -1155,17 +1153,14 @@ internal static bool ResolveLabel(string objectIdentifier, string distinguishedN
             };
 
             //If the object is deleted, we can short circuit the rest of this logic as we don't really care about anything else
-            if (directoryObject.IsDeleted())
-            {
+            if (directoryObject.IsDeleted()) {
                 res.Deleted = true;
                 return (true, res);
             }
 
-            if (directoryObject.TryGetLongProperty(LDAPProperties.UserAccountControl, out var rawUac))
-            {
+            if (directoryObject.TryGetLongProperty(LDAPProperties.UserAccountControl, out var rawUac)) {
                 var flags = (UacFlags)rawUac;
-                if (flags.HasFlag(UacFlags.ServerTrustAccount))
-                {
+                if (flags.HasFlag(UacFlags.ServerTrustAccount)) {
                     res.IsDomainController = true;
                     utils.AddDomainController(objectIdentifier);
                 }
@@ -1173,35 +1168,24 @@ internal static bool ResolveLabel(string objectIdentifier, string distinguishedN
 
             string domain;
 
-            if (directoryObject.TryGetDistinguishedName(out var distinguishedName))
-            {
+            if (directoryObject.TryGetDistinguishedName(out var distinguishedName)) {
                 domain = Helpers.DistinguishedNameToDomain(distinguishedName);
-            }
-            else
-            {
+            } else {
                 if (objectIdentifier.StartsWith("S-1-5") &&
-                    await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName))
-                {
+                    await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName)) {
                     domain = domainName;
-                }
-                else
-                {
+                } else {
                     return (false, default);
                 }
             }
 
             string domainSid;
             var match = SIDRegex.Match(objectIdentifier);
-            if (match.Success)
-            {
+            if (match.Success) {
                 domainSid = match.Groups[1].Value;
-            }
-            else if (await utils.GetDomainSidFromDomainName(domain) is (true, var sid))
-            {
+            } else if (await utils.GetDomainSidFromDomainName(domain) is (true, var sid)) {
                 domainSid = sid;
-            }
-            else
-            {
+            } else {
                 Logging.Logger.LogWarning("Failed to resolve domain sid for object {Identifier}", objectIdentifier);
                 domainSid = null;
             }
@@ -1209,12 +1193,10 @@ await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName))
             res.Domain = domain;
             res.DomainSid = domainSid;
 
-            if (WellKnownPrincipal.GetWellKnownPrincipal(objectIdentifier, out var wellKnownPrincipal))
-            {
+            if (WellKnownPrincipal.GetWellKnownPrincipal(objectIdentifier, out var wellKnownPrincipal)) {
                 res.DisplayName = $"{wellKnownPrincipal.ObjectIdentifier}@{domain}";
                 res.ObjectType = wellKnownPrincipal.ObjectType;
-                if (await utils.GetWellKnownPrincipal(objectIdentifier, domain) is (true, var convertedPrincipal))
-                {
+                if (await utils.GetWellKnownPrincipal(objectIdentifier, domain) is (true, var convertedPrincipal)) {
                     res.ObjectId = convertedPrincipal.ObjectIdentifier;
                 }
 
@@ -1228,136 +1210,100 @@ await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName))
             return (true, res);
         }
 
-        private static async Task<Label> ComputeLabel(IDirectoryObject directoryObject, string objectIdentifier, string domain, ILdapUtils utils)
-        {
-            if (!directoryObject.GetLabel(out var label))
-            {
-                if (await utils.ResolveIDAndType(objectIdentifier, domain) is (true, var typedPrincipal))
-                {
+        private static async Task<Label> ComputeLabel(IDirectoryObject directoryObject, string objectIdentifier,
+            string domain, ILdapUtils utils) {
+            if (!directoryObject.GetLabel(out var label)) {
+                if (await utils.ResolveIDAndType(objectIdentifier, domain) is (true, var typedPrincipal)) {
                     label = typedPrincipal.ObjectType;
                 }
             }
 
-            if (directoryObject.IsMSA() || directoryObject.IsGMSA())
-            {
+            if (directoryObject.IsMSA() || directoryObject.IsGMSA()) {
                 label = Label.User;
             }
 
             return label;
         }
 
-        private static string ComputeDisplayName(IDirectoryObject directoryObject, string domain, Label label, string samAccountName)
-        {
+        private static string ComputeDisplayName(IDirectoryObject directoryObject, string domain, Label label,
+            string samAccountName) {
             string displayName;
-            switch (label)
-            {
+            switch (label) {
                 case Label.User:
                 case Label.Group:
                 case Label.Base:
                     displayName = $"{samAccountName}@{domain}";
                     break;
-                case Label.Computer:
-                    {
-                        var shortName = samAccountName?.TrimEnd('$');
-                        if (directoryObject.TryGetProperty(LDAPProperties.DNSHostName, out var dns))
-                        {
-                            displayName = dns;
-                        }
-                        else if (!string.IsNullOrWhiteSpace(shortName))
-                        {
-                            displayName = $"{shortName}.{domain}";
-                        }
-                        else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
-                                       out var canonicalName))
-                        {
-                            displayName = $"{canonicalName}.{domain}";
-                        }
-                        else if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
-                        {
-                            displayName = $"{name}.{domain}";
-                        }
-                        else
-                        {
-                            displayName = $"UNKNOWN.{domain}";
-                        }
-
-                        break;
+                case Label.Computer: {
+                    var shortName = samAccountName?.TrimEnd('$');
+                    if (directoryObject.TryGetProperty(LDAPProperties.DNSHostName, out var dns)) {
+                        displayName = dns;
+                    } else if (!string.IsNullOrWhiteSpace(shortName)) {
+                        displayName = $"{shortName}.{domain}";
+                    } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
+                                   out var canonicalName)) {
+                        displayName = $"{canonicalName}.{domain}";
+                    } else if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
+                        displayName = $"{name}.{domain}";
+                    } else {
+                        displayName = $"UNKNOWN.{domain}";
                     }
-                case Label.GPO:
-                case Label.IssuancePolicy:
-                    {
-                        if (directoryObject.TryGetProperty(LDAPProperties.DisplayName, out var ldapDisplayName))
-                        {
-                            displayName = $"{ldapDisplayName}@{domain}";
-                        }
-                        else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
-                                       out var canonicalName))
-                        {
-                            displayName = $"{canonicalName}@{domain}";
-                        }
-                        else
-                        {
-                            displayName = $"UNKNOWN@{domain}";
-                        }
 
-                        break;
+                    break;
+                }
+                case Label.GPO:
+                case Label.IssuancePolicy: {
+                    if (directoryObject.TryGetProperty(LDAPProperties.DisplayName, out var ldapDisplayName)) {
+                        displayName = $"{ldapDisplayName}@{domain}";
+                    } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
+                                   out var canonicalName)) {
+                        displayName = $"{canonicalName}@{domain}";
+                    } else {
+                        displayName = $"UNKNOWN@{domain}";
                     }
+
+                    break;
+                }
                 case Label.Domain:
                     displayName = domain;
                     break;
-                case Label.OU:
-                    {
-                        if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
-                        {
-                            displayName = $"{name}@{domain}";
-                        }
-                        else if (directoryObject.TryGetProperty(LDAPProperties.OU, out var ou))
-                        {
-                            displayName = $"{ou}@{domain}";
-                        }
-                        else
-                        {
-                            displayName = $"UNKNOWN@{domain}";
-                        }
-
-                        break;
+                case Label.OU: {
+                    if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
+                        displayName = $"{name}@{domain}";
+                    } else if (directoryObject.TryGetProperty(LDAPProperties.OU, out var ou)) {
+                        displayName = $"{ou}@{domain}";
+                    } else {
+                        displayName = $"UNKNOWN@{domain}";
                     }
-                case Label.Container:
-                    {
-                        if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
-                        {
-                            displayName = $"{name}@{domain}";
-                        }
-                        else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
-                                       out var canonicalName))
-                        {
-                            displayName = $"{canonicalName}@{domain}";
-                        }
-                        else
-                        {
-                            displayName = $"UNKNOWN@{domain}";
-                        }
 
-                        break;
+                    break;
+                }
+                case Label.Container: {
+                    if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
+                        displayName = $"{name}@{domain}";
+                    } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
+                                   out var canonicalName)) {
+                        displayName = $"{canonicalName}@{domain}";
+                    } else {
+                        displayName = $"UNKNOWN@{domain}";
                     }
+
+                    break;
+                }
                 case Label.Configuration:
                 case Label.RootCA:
                 case Label.AIACA:
                 case Label.NTAuthStore:
                 case Label.EnterpriseCA:
-                case Label.CertTemplate:
-                    {
-                        if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name))
-                        {
-                            displayName = $"{name}@{domain}";
-                        }
-                        else
-                        {
-                            displayName = $"UNKNOWN@{domain}";
-                        }
-
-                        break;
+                case Label.CertTemplate: {
+                    if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
+                        displayName = $"{name}@{domain}";
+                    } else {
+                        displayName = $"UNKNOWN@{domain}";
                     }
+
+                    break;
+                }
                 default:
                     throw new ArgumentOutOfRangeException();
             }

From 52de0101bd2a238aeee3c30e1c0108f2efb62385 Mon Sep 17 00:00:00 2001
From: Rohan Vazarkar <rvazarkar@specterops.io>
Date: Wed, 11 Dec 2024 16:19:58 -0500
Subject: [PATCH 3/5] wip: initial cleanup commit

---
 src/CommonLib/Enums/CollectionMethod.cs       |  16 +-
 src/CommonLib/Enums/EventIds.cs               |   6 +
 src/CommonLib/Enums/LdapErrorCodes.cs         |   6 +-
 src/CommonLib/Enums/LdapOption.cs             |   8 +-
 src/CommonLib/Enums/LdapOptionValue.cs        |   8 +-
 ...sims.cs => LdapSupportedSaslMechanisms.cs} |   8 +-
 src/CommonLib/Extensions.cs                   |   2 +-
 src/CommonLib/Impersonate.cs                  |  18 +-
 src/CommonLib/LdapConnectionPool.cs           | 223 +++++++-----
 src/CommonLib/LdapProducerQueryGenerator.cs   |  18 +-
 src/CommonLib/Ntlm/HttpClientFactory.cs       |  28 +-
 .../Ntlm/HttpNtlmAuthenticationService.cs     | 131 +++----
 src/CommonLib/Ntlm/HttpTransport.cs           |   6 +-
 src/CommonLib/Ntlm/INtlmTransport.cs          |   5 +-
 src/CommonLib/Ntlm/LdapException.cs           |  16 -
 src/CommonLib/Ntlm/LdapNative.cs              | 205 +++++------
 src/CommonLib/Ntlm/LdapNativeException.cs     |  15 +
 src/CommonLib/Ntlm/LdapTransport.cs           |  65 ++--
 .../Ntlm/NtlmAuthenticationHandler.cs         |  12 +-
 src/CommonLib/OutputTypes/APIResult.cs        |  34 +-
 src/CommonLib/OutputTypes/CAHttpEndpoint.cs   |  23 +-
 src/CommonLib/OutputTypes/Computer.cs         |  48 ++-
 src/CommonLib/OutputTypes/NtlmSession.cs      |  30 +-
 .../Processors/CAEnrollmentProcessor.cs       | 156 +++-----
 .../Processors/CertAbuseProcessor.cs          |   2 +-
 .../Processors/ComputerSessionProcessor.cs    |  14 +-
 src/CommonLib/Processors/DCLdapProcessor.cs   | 198 ++---------
 src/CommonLib/Processors/EventLogProcessor.cs | 242 ++++++-------
 src/CommonLib/Processors/SmbProcessor.cs      | 260 ++++++--------
 .../UserRightsAssignmentProcessor.cs          | 105 +++---
 .../Processors/WebClientServiceProcessor.cs   |  40 +--
 .../ThirdParty/PSOpenAD/Authentication.cs     | 334 +++++-------------
 src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs     | 286 ++++++---------
 src/SharpHoundRPC/SharpHoundRPC.csproj        |   2 +-
 34 files changed, 970 insertions(+), 1600 deletions(-)
 create mode 100644 src/CommonLib/Enums/EventIds.cs
 rename src/CommonLib/Enums/{LdapSupportedSaslMechansims.cs => LdapSupportedSaslMechanisms.cs} (77%)
 delete mode 100644 src/CommonLib/Ntlm/LdapException.cs
 create mode 100644 src/CommonLib/Ntlm/LdapNativeException.cs

diff --git a/src/CommonLib/Enums/CollectionMethod.cs b/src/CommonLib/Enums/CollectionMethod.cs
index 76bbd402..84c8ec91 100644
--- a/src/CommonLib/Enums/CollectionMethod.cs
+++ b/src/CommonLib/Enums/CollectionMethod.cs
@@ -1,10 +1,8 @@
 using System;
 
-namespace SharpHoundCommonLib.Enums
-{
+namespace SharpHoundCommonLib.Enums {
     [Flags]
-    public enum CollectionMethod
-    {
+    public enum CollectionMethod {
         None = 0,
         Group = 1,
         LocalAdmin = 1 << 1,
@@ -30,9 +28,13 @@ public enum CollectionMethod
         SmbInfo = 1 << 22,
         EventLogs = 1 << 23,
         LocalGroups = DCOM | RDP | LocalAdmin | PSRemote,
-        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry | WebClientService | SmbInfo | EventLogs,
+        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry | WebClientService | SmbInfo,
         DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup | CertServices | LdapServices | SmbInfo,
-        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices | LdapServices | SmbInfo,
-        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry | WebClientService | LdapServices | EventLogs
+
+        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices |
+                  LdapServices | SmbInfo,
+
+        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry | WebClientService |
+              LdapServices
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Enums/EventIds.cs b/src/CommonLib/Enums/EventIds.cs
new file mode 100644
index 00000000..ee93ed5c
--- /dev/null
+++ b/src/CommonLib/Enums/EventIds.cs
@@ -0,0 +1,6 @@
+namespace SharpHoundCommonLib.Enums;
+
+public class EventIds {
+    public static int LogonEvent = 4624;
+    public static int ValidateCredentialsEvent = 4776;
+}
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapErrorCodes.cs b/src/CommonLib/Enums/LdapErrorCodes.cs
index 65a52ac6..c6f81b62 100644
--- a/src/CommonLib/Enums/LdapErrorCodes.cs
+++ b/src/CommonLib/Enums/LdapErrorCodes.cs
@@ -1,7 +1,5 @@
-namespace SharpHoundCommonLib.Enums
-{
-    public enum LdapErrorCodes : int
-    {
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapErrorCodes : int {
         Success = 0,
         StrongAuthRequired = 8,
         SaslBindInProgress = 14,
diff --git a/src/CommonLib/Enums/LdapOption.cs b/src/CommonLib/Enums/LdapOption.cs
index 084cbff2..a0403253 100644
--- a/src/CommonLib/Enums/LdapOption.cs
+++ b/src/CommonLib/Enums/LdapOption.cs
@@ -1,7 +1,5 @@
-namespace SharpHoundCommonLib.Enums
-{
-    public enum LdapOption : int
-    {
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapOption : int {
         Ssl = 0x0A,
         ProtocolVersion = 0x11,
         ResultCode = 0x31,
@@ -11,4 +9,4 @@ public enum LdapOption : int
         Encrypt = 0x96,
         Timeout = 0x5002,
     }
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapOptionValue.cs b/src/CommonLib/Enums/LdapOptionValue.cs
index 857c9b92..16e5fb9a 100644
--- a/src/CommonLib/Enums/LdapOptionValue.cs
+++ b/src/CommonLib/Enums/LdapOptionValue.cs
@@ -4,12 +4,10 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace SharpHoundCommonLib.Enums
-{
-    public enum LdapOptionValue : int
-    {
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapOptionValue : int {
         Off = 0,
         On = 1,
         Version3 = 3,
     };
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapSupportedSaslMechansims.cs b/src/CommonLib/Enums/LdapSupportedSaslMechanisms.cs
similarity index 77%
rename from src/CommonLib/Enums/LdapSupportedSaslMechansims.cs
rename to src/CommonLib/Enums/LdapSupportedSaslMechanisms.cs
index c2f84fbc..37736c70 100644
--- a/src/CommonLib/Enums/LdapSupportedSaslMechansims.cs
+++ b/src/CommonLib/Enums/LdapSupportedSaslMechanisms.cs
@@ -4,13 +4,11 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace SharpHoundCommonLib.Enums
-{
-    public static class LdapSupportedSaslMechansims
-    {
+namespace SharpHoundCommonLib.Enums {
+    public static class LdapSupportedSaslMechanisms {
         public const string GSSAPI = "GSSAPI";
         public const string GSS_SPNEGO = "GSS-SPNEGO";
         public const string EXTERNAL = "EXTERNAL";
         public const string DIGEST_MD5 = "DIGEST_MD5";
     }
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/Extensions.cs b/src/CommonLib/Extensions.cs
index be102fd9..570a2b58 100644
--- a/src/CommonLib/Extensions.cs
+++ b/src/CommonLib/Extensions.cs
@@ -186,7 +186,7 @@ public static string LdapValue(this Guid s)
         /// <param name="methods"></param>
         /// <returns></returns>
         public static bool IsComputerCollectionSet(this CollectionMethod methods) {
-            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn;
+            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn | CollectionMethod.SmbInfo | CollectionMethod.SmbInfo;
             return (methods & test) != 0;
         }
 
diff --git a/src/CommonLib/Impersonate.cs b/src/CommonLib/Impersonate.cs
index f6e03aae..cefbd05a 100644
--- a/src/CommonLib/Impersonate.cs
+++ b/src/CommonLib/Impersonate.cs
@@ -90,7 +90,7 @@ public class Impersonator : IDisposable {
         ///<param name = "domainName" > Name of the domain.</param>
         ///<param name = "password" > The password. <see cref = "System.String" /></ param >
         ///< param name="logonType">Type of the logon.</param>
-        ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></ param >
+        ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></param >
         public Impersonator(string userName, string domainName, string password, LogonType logonType,
             LogonProvider logonProvider) {
             Impersonate(userName, domainName, password, logonType, logonProvider);
@@ -125,10 +125,11 @@ public void Dispose() {
         /// </summary>
         ///<param name = "userName" > Name of the user.</param>
         ///<param name = "domainName" > Name of the domain.</param>
-        ///<param name = "password" > The password. <see cref = "System.String" /></ param >
-        ///< param name="logonType">Type of the logon.</param>
+        ///<param name = "password" > The password. <see cref = "System.String" /></param >
+        ///<param name="logonType">Type of the logon.</param>
         ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></ param >
-        public void Impersonate(string userName, string domainName, string password, LogonType logonType = LogonType.LOGON32_LOGON_INTERACTIVE,
+        public void Impersonate(string userName, string domainName, string password,
+            LogonType logonType = LogonType.LOGON32_LOGON_INTERACTIVE,
             LogonProvider logonProvider = LogonProvider.LOGON32_PROVIDER_DEFAULT) {
             UndoImpersonation();
 
@@ -149,14 +150,11 @@ public void Impersonate(string userName, string domainName, string password, Log
                             ref logonTokenDuplicate) != 0) {
                         var wi = new WindowsIdentity(logonTokenDuplicate);
                         wi.Impersonate(); // discard the returned identity context (which is the context of the application pool)
-                    }
-                    else
+                    } else
                         throw new Win32Exception(Marshal.GetLastWin32Error());
-                }
-                else
+                } else
                     throw new Win32Exception(Marshal.GetLastWin32Error());
-            }
-            finally {
+            } finally {
                 if (logonToken != IntPtr.Zero)
                     Win32NativeMethods.CloseHandle(logonToken);
 
diff --git a/src/CommonLib/LdapConnectionPool.cs b/src/CommonLib/LdapConnectionPool.cs
index 3f6ee8ab..f3e8735d 100644
--- a/src/CommonLib/LdapConnectionPool.cs
+++ b/src/CommonLib/LdapConnectionPool.cs
@@ -16,7 +16,7 @@
 using SharpHoundRPC.NetAPINative;
 
 namespace SharpHoundCommonLib {
-    internal class LdapConnectionPool : IDisposable{
+    internal class LdapConnectionPool : IDisposable {
         private readonly ConcurrentBag<LdapConnectionWrapper> _connections;
         private readonly ConcurrentBag<LdapConnectionWrapper> _globalCatalogConnection;
         private readonly SemaphoreSlim _semaphore = null;
@@ -32,7 +32,8 @@ internal class LdapConnectionPool : IDisposable{
         private const int MaxRetries = 3;
         private static readonly ConcurrentDictionary<string, NetAPIStructs.DomainControllerInfo?> DCInfoCache = new();
 
-        public LdapConnectionPool(string identifier, string poolIdentifier, LdapConfig config, PortScanner scanner = null, NativeMethods nativeMethods = null, ILogger log = null) {
+        public LdapConnectionPool(string identifier, string poolIdentifier, LdapConfig config,
+            PortScanner scanner = null, NativeMethods nativeMethods = null, ILogger log = null) {
             _connections = new ConcurrentBag<LdapConnectionWrapper>();
             _globalCatalogConnection = new ConcurrentBag<LdapConnectionWrapper>();
             //TODO: Re-enable this once we track down the semaphore deadlock
@@ -42,7 +43,7 @@ public LdapConnectionPool(string identifier, string poolIdentifier, LdapConfig c
             //     //If MaxConcurrentQueries is 0, we'll just disable the semaphore entirely
             //     _semaphore = null;
             // }
-            
+
             _identifier = identifier;
             _poolIdentifier = poolIdentifier;
             _ldapConfig = config;
@@ -50,14 +51,16 @@ public LdapConnectionPool(string identifier, string poolIdentifier, LdapConfig c
             _portScanner = scanner ?? new PortScanner();
             _nativeMethods = nativeMethods ?? new NativeMethods();
         }
-        
-        private async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)> GetLdapConnection(bool globalCatalog) {
+
+        private async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)> GetLdapConnection(
+            bool globalCatalog) {
             if (globalCatalog) {
                 return await GetGlobalCatalogConnectionAsync();
             }
+
             return await GetConnectionAsync();
         }
-        
+
         public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParameters queryParameters,
             [EnumeratorCancellation] CancellationToken cancellationToken = new()) {
             var setupResult = await SetupLdapQuery(queryParameters);
@@ -83,11 +86,14 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
             SearchResponse response = null;
             while (!cancellationToken.IsCancellationRequested) {
                 //Grab our semaphore here to take one of our query slots
-                if (_semaphore != null){
-                    _log.LogTrace("Query entering semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                if (_semaphore != null) {
+                    _log.LogTrace("Query entering semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     await _semaphore.WaitAsync(cancellationToken);
-                    _log.LogTrace("Query entered semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                    _log.LogTrace("Query entered semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                 }
+
                 try {
                     _log.LogTrace("Sending ldap request - {Info}", queryParameters.GetQueryInfo());
                     response = (SearchResponse)connectionWrapper.Connection.SendRequest(searchRequest);
@@ -114,7 +120,8 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                      * since non-paged queries do not require same server connections
                      */
                     queryRetryCount++;
-                    _log.LogDebug("Query - Attempting to recover from ServerDown for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), queryRetryCount);
+                    _log.LogDebug("Query - Attempting to recover from ServerDown for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), queryRetryCount);
                     ReleaseConnection(connectionWrapper, true);
 
                     for (var retryCount = 0; retryCount < MaxRetries; retryCount++) {
@@ -145,7 +152,8 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                      * The expectation is that given enough time, the server should stop being busy and service our query appropriately
                      */
                     busyRetryCount++;
-                    _log.LogDebug("Query - Executing busy backoff for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), busyRetryCount);
+                    _log.LogDebug("Query - Executing busy backoff for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), busyRetryCount);
                     var backoffDelay = GetNextBackoff(busyRetryCount);
                     await Task.Delay(backoffDelay, cancellationToken);
                 } catch (LdapException le) {
@@ -165,9 +173,11 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                 } finally {
                     // Always release our semaphore to prevent deadlocks
                     if (_semaphore != null) {
-                        _log.LogTrace("Query releasing semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());    
+                        _log.LogTrace("Query releasing semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                         _semaphore.Release();
-                        _log.LogTrace("Query released semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                        _log.LogTrace("Query released semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     }
                 }
 
@@ -194,7 +204,7 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                 yield return LdapResult<IDirectoryObject>.Ok(new SearchResultEntryWrapper(entry));
             }
         }
-        
+
         public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParameters queryParameters,
             [EnumeratorCancellation] CancellationToken cancellationToken = new()) {
             var setupResult = await SetupLdapQuery(queryParameters);
@@ -222,11 +232,14 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
             LdapResult<IDirectoryObject> tempResult = null;
 
             while (!cancellationToken.IsCancellationRequested) {
-                if (_semaphore != null){
-                    _log.LogTrace("PagedQuery entering semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                if (_semaphore != null) {
+                    _log.LogTrace("PagedQuery entering semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     await _semaphore.WaitAsync(cancellationToken);
-                    _log.LogTrace("PagedQuery entered semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                    _log.LogTrace("PagedQuery entered semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                 }
+
                 SearchResponse response = null;
                 try {
                     _log.LogTrace("Sending paged ldap request - {Info}", queryParameters.GetQueryInfo());
@@ -244,15 +257,15 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                     }
                 } catch (LdapException le) when (le.ErrorCode == (int)LdapErrorCodes.ServerDown) {
                     /*
-                    * A ServerDown exception indicates that our connection is no longer valid for one of many reasons.
-                    * We'll want to release our connection back to the pool, but dispose it. We need a new connection,
-                    * and because this is not a paged query, we can get this connection from anywhere.
-                    *
-                    * We use queryRetryCount here to prevent an infinite retry loop from occurring
-                    *
-                    * Release our connection in a faulted state since the connection is defunct.
-                    * Paged queries require a connection to be made to the same server which we started the paged query on 
-                    */
+                     * A ServerDown exception indicates that our connection is no longer valid for one of many reasons.
+                     * We'll want to release our connection back to the pool, but dispose it. We need a new connection,
+                     * and because this is not a paged query, we can get this connection from anywhere.
+                     *
+                     * We use queryRetryCount here to prevent an infinite retry loop from occurring
+                     *
+                     * Release our connection in a faulted state since the connection is defunct.
+                     * Paged queries require a connection to be made to the same server which we started the paged query on
+                     */
                     if (serverName == null) {
                         _log.LogError(
                             "PagedQuery - Received server down exception without a known servername. Unable to generate new connection\n{Info}",
@@ -260,9 +273,11 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                         ReleaseConnection(connectionWrapper, true);
                         yield break;
                     }
-                    
-                    _log.LogDebug("PagedQuery - Attempting to recover from ServerDown for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), queryRetryCount);
-                    
+
+                    _log.LogDebug(
+                        "PagedQuery - Attempting to recover from ServerDown for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), queryRetryCount);
+
                     ReleaseConnection(connectionWrapper, true);
                     for (var retryCount = 0; retryCount < MaxRetries; retryCount++) {
                         var backoffDelay = GetNextBackoff(retryCount);
@@ -290,7 +305,8 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                      * The expectation is that given enough time, the server should stop being busy and service our query appropriately
                      */
                     busyRetryCount++;
-                    _log.LogDebug("PagedQuery - Executing busy backoff for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), busyRetryCount);
+                    _log.LogDebug("PagedQuery - Executing busy backoff for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), busyRetryCount);
                     var backoffDelay = GetNextBackoff(busyRetryCount);
                     await Task.Delay(backoffDelay, cancellationToken);
                 } catch (LdapException le) {
@@ -303,9 +319,11 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                             queryParameters);
                 } finally {
                     if (_semaphore != null) {
-                        _log.LogTrace("PagedQuery releasing semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());    
+                        _log.LogTrace("PagedQuery releasing semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                         _semaphore.Release();
-                        _log.LogTrace("PagedQuery released semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                        _log.LogTrace("PagedQuery released semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     }
                 }
 
@@ -348,7 +366,7 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                 pageControl.Cookie = pageResponse.Cookie;
             }
         }
-        
+
         private async Task<LdapQuerySetupResult> SetupLdapQuery(LdapQueryParameters queryParameters) {
             var result = new LdapQuerySetupResult();
             var (success, connectionWrapper, message) =
@@ -389,10 +407,10 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
                 yield return Result<string>.Fail(connectionResult.Message);
                 yield break;
             }
-            
+
             var index = 0;
             var step = 0;
-            
+
             //Start by using * as our upper index, which will automatically give us the range size
             var currentRange = $"{attributeName};range={index}-*";
             var complete = false;
@@ -411,7 +429,7 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
                 yield return Result<string>.Fail("Failed to create search request");
                 yield break;
             }
-            
+
             var queryRetryCount = 0;
             var busyRetryCount = 0;
 
@@ -419,22 +437,28 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
 
             while (!cancellationToken.IsCancellationRequested) {
                 SearchResponse response = null;
-                if (_semaphore != null){
-                    _log.LogTrace("RangedRetrieval entering semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                if (_semaphore != null) {
+                    _log.LogTrace("RangedRetrieval entering semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     await _semaphore.WaitAsync(cancellationToken);
-                    _log.LogTrace("RangedRetrieval entered semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                    _log.LogTrace("RangedRetrieval entered semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                 }
+
                 try {
                     response = (SearchResponse)connectionWrapper.Connection.SendRequest(searchRequest);
                 } catch (LdapException le) when (le.ErrorCode == (int)ResultCode.Busy && busyRetryCount < MaxRetries) {
                     busyRetryCount++;
-                    _log.LogDebug("RangedRetrieval - Executing busy backoff for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), busyRetryCount);
+                    _log.LogDebug("RangedRetrieval - Executing busy backoff for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), busyRetryCount);
                     var backoffDelay = GetNextBackoff(busyRetryCount);
                     await Task.Delay(backoffDelay, cancellationToken);
                 } catch (LdapException le) when (le.ErrorCode == (int)LdapErrorCodes.ServerDown &&
                                                  queryRetryCount < MaxRetries) {
                     queryRetryCount++;
-                    _log.LogDebug("RangedRetrieval - Attempting to recover from ServerDown for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), queryRetryCount);
+                    _log.LogDebug(
+                        "RangedRetrieval - Attempting to recover from ServerDown for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), queryRetryCount);
                     ReleaseConnection(connectionWrapper, true);
                     for (var retryCount = 0; retryCount < MaxRetries; retryCount++) {
                         var backoffDelay = GetNextBackoff(retryCount);
@@ -469,9 +493,11 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
                         LdapResult<string>.Fail($"Caught unrecoverable exception: {e.Message}", queryParameters);
                 } finally {
                     if (_semaphore != null) {
-                        _log.LogTrace("RangedRetrieval releasing semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());    
+                        _log.LogTrace("RangedRetrieval releasing semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                         _semaphore.Release();
-                        _log.LogTrace("RangedRetrieval released semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                        _log.LogTrace("RangedRetrieval released semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     }
                 }
 
@@ -523,13 +549,13 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
 
             ReleaseConnection(connectionWrapper);
         }
-        
+
         private static TimeSpan GetNextBackoff(int retryCount) {
             return TimeSpan.FromSeconds(Math.Min(
                 MinBackoffDelay.TotalSeconds * Math.Pow(BackoffDelayMultiplier, retryCount),
                 MaxBackoffDelay.TotalSeconds));
         }
-        
+
         private bool CreateSearchRequest(LdapQueryParameters queryParameters,
             LdapConnectionWrapper connectionWrapper, out SearchRequest searchRequest) {
             string basePath;
@@ -540,7 +566,7 @@ private bool CreateSearchRequest(LdapQueryParameters queryParameters,
                 if (CallDsGetDcName(queryParameters.DomainName, out var info) && info != null) {
                     tempPath = Helpers.DomainNameToDistinguishedName(info.Value.DomainName);
                     connectionWrapper.SaveContext(queryParameters.NamingContext, basePath);
-                } else if (LdapUtils.GetDomain(queryParameters.DomainName,_ldapConfig,  out var domainObject)) {
+                } else if (LdapUtils.GetDomain(queryParameters.DomainName, _ldapConfig, out var domainObject)) {
                     tempPath = Helpers.DomainNameToDistinguishedName(domainObject.Name);
                 } else {
                     searchRequest = null;
@@ -556,8 +582,9 @@ private bool CreateSearchRequest(LdapQueryParameters queryParameters,
 
                 connectionWrapper.SaveContext(queryParameters.NamingContext, basePath);
             }
-            
-            if (string.IsNullOrWhiteSpace(queryParameters.SearchBase) && !string.IsNullOrWhiteSpace(queryParameters.RelativeSearchBase)) {
+
+            if (string.IsNullOrWhiteSpace(queryParameters.SearchBase) &&
+                !string.IsNullOrWhiteSpace(queryParameters.RelativeSearchBase)) {
                 basePath = $"{queryParameters.RelativeSearchBase},{basePath}";
             }
 
@@ -576,7 +603,7 @@ private bool CreateSearchRequest(LdapQueryParameters queryParameters,
 
             return true;
         }
-        
+
         private bool CallDsGetDcName(string domainName, out NetAPIStructs.DomainControllerInfo? info) {
             if (DCInfoCache.TryGetValue(domainName.ToUpper().Trim(), out info)) return info != null;
 
@@ -594,13 +621,14 @@ private bool CallDsGetDcName(string domainName, out NetAPIStructs.DomainControll
             return true;
         }
 
-        public async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)> GetConnectionAsync() {
+        public async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)>
+            GetConnectionAsync() {
             if (!_connections.TryTake(out var connectionWrapper)) {
                 var (success, connection, message) = await CreateNewConnection();
                 if (!success) {
                     return (false, null, message);
                 }
-            
+
                 connectionWrapper = connection;
             }
 
@@ -612,7 +640,8 @@ private bool CallDsGetDcName(string domainName, out NetAPIStructs.DomainControll
             return CreateNewConnectionForServer(server, globalCatalog);
         }
 
-        public async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)> GetGlobalCatalogConnectionAsync() {
+        public async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)>
+            GetGlobalCatalogConnectionAsync() {
             if (!_globalCatalogConnection.TryTake(out var connectionWrapper)) {
                 var (success, connection, message) = await CreateNewConnection(true);
                 if (!success) {
@@ -630,39 +659,40 @@ public void ReleaseConnection(LdapConnectionWrapper connectionWrapper, bool conn
             if (!connectionFaulted) {
                 if (connectionWrapper.GlobalCatalog) {
                     _globalCatalogConnection.Add(connectionWrapper);
+                } else {
+                    _connections.Add(connectionWrapper);
                 }
-                else {
-                    _connections.Add(connectionWrapper);    
-                }
-            }
-            else {
+            } else {
                 connectionWrapper.Connection.Dispose();
             }
         }
-    
+
         public void Dispose() {
             while (_connections.TryTake(out var wrapper)) {
                 wrapper.Connection.Dispose();
             }
         }
 
-        private async Task<(bool Success, LdapConnectionWrapper Connection, string Message)> CreateNewConnection(bool globalCatalog = false) {
+        private async Task<(bool Success, LdapConnectionWrapper Connection, string Message)> CreateNewConnection(
+            bool globalCatalog = false) {
             try {
                 if (!string.IsNullOrWhiteSpace(_ldapConfig.Server)) {
                     return CreateNewConnectionForServer(_ldapConfig.Server, globalCatalog);
                 }
 
                 if (CreateLdapConnection(_identifier.ToUpper().Trim(), globalCatalog, out var connectionWrapper)) {
-                    _log.LogDebug("Successfully created ldap connection for domain: {Domain} using strategy 1. SSL: {SSl}", _identifier, connectionWrapper.Connection.SessionOptions.SecureSocketLayer);
+                    _log.LogDebug(
+                        "Successfully created ldap connection for domain: {Domain} using strategy 1. SSL: {SSl}",
+                        _identifier, connectionWrapper.Connection.SessionOptions.SecureSocketLayer);
                     return (true, connectionWrapper, "");
                 }
-            
+
                 string tempDomainName;
-            
+
                 var dsGetDcNameResult = _nativeMethods.CallDsGetDcName(null, _identifier,
                     (uint)(NetAPIEnums.DSGETDCNAME_FLAGS.DS_FORCE_REDISCOVERY |
-                        NetAPIEnums.DSGETDCNAME_FLAGS.DS_RETURN_DNS_NAME |
-                        NetAPIEnums.DSGETDCNAME_FLAGS.DS_DIRECTORY_SERVICE_REQUIRED));
+                           NetAPIEnums.DSGETDCNAME_FLAGS.DS_RETURN_DNS_NAME |
+                           NetAPIEnums.DSGETDCNAME_FLAGS.DS_DIRECTORY_SERVICE_REQUIRED));
                 if (dsGetDcNameResult.IsSuccess) {
                     tempDomainName = dsGetDcNameResult.Value.DomainName;
 
@@ -673,7 +703,7 @@ public void Dispose() {
                             _identifier, tempDomainName);
                         return (true, connectionWrapper, "");
                     }
-                
+
                     var server = dsGetDcNameResult.Value.DomainControllerName.TrimStart('\\');
 
                     var result =
@@ -685,7 +715,7 @@ public void Dispose() {
                         return (true, result.connection, "");
                     }
                 }
-            
+
                 if (!LdapUtils.GetDomain(_identifier, _ldapConfig, out var domainObject) || domainObject.Name == null) {
                     //If we don't get a result here, we effectively have no other ways to resolve this domain, so we'll just have to exit out
                     _log.LogDebug(
@@ -693,8 +723,9 @@ public void Dispose() {
                         _identifier);
                     return (false, null, "Unable to get domain object for further strategies");
                 }
+
                 tempDomainName = domainObject.Name.ToUpper().Trim();
-            
+
                 if (!tempDomainName.Equals(_identifier, StringComparison.OrdinalIgnoreCase) &&
                     CreateLdapConnection(tempDomainName, globalCatalog, out connectionWrapper)) {
                     _log.LogDebug(
@@ -702,7 +733,7 @@ public void Dispose() {
                         _identifier, tempDomainName);
                     return (true, connectionWrapper, "");
                 }
-            
+
                 var primaryDomainController = domainObject.PdcRoleOwner.Name;
                 var portConnectionResult =
                     await CreateLDAPConnectionWithPortCheck(primaryDomainController, globalCatalog);
@@ -712,7 +743,7 @@ public void Dispose() {
                         _identifier, primaryDomainController);
                     return (true, portConnectionResult.connection, "");
                 }
-            
+
                 foreach (DomainController dc in domainObject.DomainControllers) {
                     portConnectionResult =
                         await CreateLDAPConnectionWithPortCheck(dc.Name, globalCatalog);
@@ -724,32 +755,34 @@ public void Dispose() {
                     }
                 }
             } catch (Exception e) {
-                _log.LogInformation(e, "We will not be able to connect to domain {Domain} by any strategy, leaving it.", _identifier);
+                _log.LogInformation(e, "We will not be able to connect to domain {Domain} by any strategy, leaving it.",
+                    _identifier);
             }
 
             return (false, null, "All attempted connections failed");
         }
-    
-        private (bool Success, LdapConnectionWrapper Connection, string Message ) CreateNewConnectionForServer(string identifier, bool globalCatalog = false) {
+
+        private (bool Success, LdapConnectionWrapper Connection, string Message ) CreateNewConnectionForServer(
+            string identifier, bool globalCatalog = false) {
             if (CreateLdapConnection(identifier, globalCatalog, out var serverConnection)) {
                 return (true, serverConnection, "");
             }
 
             return (false, null, $"Failed to create ldap connection for {identifier}");
         }
-    
+
         private bool CreateLdapConnection(string target, bool globalCatalog,
             out LdapConnectionWrapper connection) {
             var baseConnection = CreateBaseConnection(target, true, globalCatalog);
             if (TestLdapConnection(baseConnection, out var result)) {
-                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog, _poolIdentifier);
+                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog,
+                    _poolIdentifier);
                 return true;
             }
 
             try {
                 baseConnection.Dispose();
-            }
-            catch {
+            } catch {
                 //this is just in case
             }
 
@@ -760,43 +793,42 @@ private bool CreateLdapConnection(string target, bool globalCatalog,
 
             baseConnection = CreateBaseConnection(target, false, globalCatalog);
             if (TestLdapConnection(baseConnection, out result)) {
-                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog, _poolIdentifier);
+                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog,
+                    _poolIdentifier);
                 return true;
             }
 
             try {
                 baseConnection.Dispose();
-            }
-            catch {
+            } catch {
                 //this is just in case
             }
 
             connection = null;
             return false;
         }
-    
+
         private LdapConnection CreateBaseConnection(string directoryIdentifier, bool ssl,
             bool globalCatalog) {
             _log.LogDebug("Creating connection for identifier {Identifier}", directoryIdentifier);
             var port = globalCatalog ? _ldapConfig.GetGCPort(ssl) : _ldapConfig.GetPort(ssl);
             var identifier = new LdapDirectoryIdentifier(directoryIdentifier, port, false, false);
             var connection = new LdapConnection(identifier) { Timeout = new TimeSpan(0, 0, 5, 0) };
-            
+
             //These options are important!
             connection.SessionOptions.ProtocolVersion = 3;
             //Referral chasing does not work with paged searches 
             connection.SessionOptions.ReferralChasing = ReferralChasingOptions.None;
             if (ssl) connection.SessionOptions.SecureSocketLayer = true;
-            
+
             if (_ldapConfig.DisableSigning || ssl) {
                 connection.SessionOptions.Signing = false;
                 connection.SessionOptions.Sealing = false;
-            }
-            else {
+            } else {
                 connection.SessionOptions.Signing = true;
                 connection.SessionOptions.Sealing = true;
             }
-            
+
             if (_ldapConfig.DisableCertVerification)
                 connection.SessionOptions.VerifyServerCertificate = (_, _) => true;
 
@@ -826,10 +858,10 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
             try {
                 //Attempt an initial bind. If this fails, likely auth is invalid, or its not a valid target
                 connection.Bind();
-            }
-            catch (LdapException e) {
+            } catch (LdapException e) {
                 //TODO: Maybe look at this and find a better way?
-                if (e.ErrorCode is (int)LdapErrorCodes.InvalidCredentials or (int)ResultCode.InappropriateAuthentication) {
+                if (e.ErrorCode is (int)LdapErrorCodes.InvalidCredentials
+                    or (int)ResultCode.InappropriateAuthentication) {
                     connection.Dispose();
                     throw new LdapAuthenticationException(e);
                 }
@@ -837,8 +869,7 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
                 testResult.Message = e.Message;
                 testResult.ErrorCode = e.ErrorCode;
                 return false;
-            }
-            catch (Exception e) {
+            } catch (Exception e) {
                 testResult.Message = e.Message;
                 return false;
             }
@@ -851,8 +882,7 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
                     SearchScope.Base, null);
 
                 response = (SearchResponse)connection.SendRequest(searchRequest);
-            }
-            catch (LdapException e) {
+            } catch (LdapException e) {
                 /*
                  * If we can't send the initial search request, its unlikely any other search requests will work so we will immediately return false
                  */
@@ -867,7 +897,7 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
                  * across external trusts with kerberos authentication without Forest Search Order properly configured.
                  * Either way, this connection isn't useful for us because we're not going to get data, so return false
                  */
-            
+
                 connection.Dispose();
                 throw new NoLdapDataException();
             }
@@ -882,15 +912,14 @@ private class LdapConnectionTestResult {
             public IDirectoryObject SearchResultEntry { get; set; }
             public int ErrorCode { get; set; }
         }
-    
+
         private async Task<(bool success, LdapConnectionWrapper connection)> CreateLDAPConnectionWithPortCheck(
             string target, bool globalCatalog) {
             if (globalCatalog) {
                 if (await _portScanner.CheckPort(target, _ldapConfig.GetGCPort(true)) || (!_ldapConfig.ForceSSL &&
                         await _portScanner.CheckPort(target, _ldapConfig.GetGCPort(false))))
                     return (CreateLdapConnection(target, true, out var connection), connection);
-            }
-            else {
+            } else {
                 if (await _portScanner.CheckPort(target, _ldapConfig.GetPort(true)) || (!_ldapConfig.ForceSSL &&
                         await _portScanner.CheckPort(target, _ldapConfig.GetPort(false))))
                     return (CreateLdapConnection(target, true, out var connection), connection);
@@ -898,7 +927,7 @@ await _portScanner.CheckPort(target, _ldapConfig.GetPort(false))))
 
             return (false, null);
         }
-    
+
         private SearchRequest CreateSearchRequest(string distinguishedName, string ldapFilter,
             SearchScope searchScope,
             string[] attributes) {
diff --git a/src/CommonLib/LdapProducerQueryGenerator.cs b/src/CommonLib/LdapProducerQueryGenerator.cs
index fb0be38b..14ac7db0 100644
--- a/src/CommonLib/LdapProducerQueryGenerator.cs
+++ b/src/CommonLib/LdapProducerQueryGenerator.cs
@@ -9,11 +9,12 @@ public class LdapProducerQueryGenerator {
     public static GeneratedLdapParameters GenerateDefaultPartitionParameters(CollectionMethod methods) {
         var filter = new LdapFilter();
         var properties = new List<string>();
-        
+
         properties.AddRange(CommonProperties.BaseQueryProps);
         properties.AddRange(CommonProperties.TypeResolutionProps);
 
-        if (methods.HasFlag(CollectionMethod.ObjectProps) || methods.HasFlag(CollectionMethod.ACL) || methods.HasFlag(CollectionMethod.Container)) {
+        if (methods.HasFlag(CollectionMethod.ObjectProps) || methods.HasFlag(CollectionMethod.ACL) ||
+            methods.HasFlag(CollectionMethod.Container)) {
             filter = filter.AddComputers().AddDomains().AddUsers().AddContainers().AddGPOs().AddOUs().AddGroups();
 
             if (methods.HasFlag(CollectionMethod.Container)) {
@@ -39,7 +40,7 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
             if (methods.HasFlag(CollectionMethod.Trusts)) {
                 properties.AddRange(CommonProperties.DomainTrustProps);
             }
-            
+
             if (methods.HasFlag(CollectionMethod.GPOLocalGroup))
                 properties.AddRange(CommonProperties.GPOLocalGroupProps);
 
@@ -83,12 +84,12 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
             filter = filter.AddComputers(CommonFilters.DomainControllers);
             properties.AddRange(CommonProperties.ComputerMethodProps);
         }
-        
+
         if (methods.HasFlag(CollectionMethod.Group)) {
             filter = filter.AddGroups();
             properties.AddRange(CommonProperties.GroupResolutionProps);
         }
-        
+
         return new GeneratedLdapParameters {
             Filter = filter,
             Attributes = properties.Distinct().ToArray()
@@ -98,7 +99,7 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
     public static GeneratedLdapParameters GenerateConfigurationPartitionParameters(CollectionMethod methods) {
         var filter = new LdapFilter();
         var properties = new List<string>();
-        
+
         properties.AddRange(CommonProperties.BaseQueryProps);
         properties.AddRange(CommonProperties.TypeResolutionProps);
 
@@ -106,9 +107,8 @@ public static GeneratedLdapParameters GenerateConfigurationPartitionParameters(C
             methods.HasFlag(CollectionMethod.Container) || methods.HasFlag(CollectionMethod.CertServices)) {
             filter = filter.AddContainers().AddConfiguration().AddCertificateTemplates().AddCertificateAuthorities()
                 .AddEnterpriseCertificationAuthorities().AddIssuancePolicies();
-            
-            if (methods.HasFlag(CollectionMethod.ObjectProps))
-            {
+
+            if (methods.HasFlag(CollectionMethod.ObjectProps)) {
                 properties.AddRange(CommonProperties.ObjectPropsProps);
             }
 
diff --git a/src/CommonLib/Ntlm/HttpClientFactory.cs b/src/CommonLib/Ntlm/HttpClientFactory.cs
index 227c168b..74b8e6f5 100644
--- a/src/CommonLib/Ntlm/HttpClientFactory.cs
+++ b/src/CommonLib/Ntlm/HttpClientFactory.cs
@@ -4,18 +4,14 @@
 
 namespace SharpHoundCommonLib.Ntlm;
 
-public interface IHttpClientFactory
-{
+public interface IHttpClientFactory {
     HttpClient CreateUnauthenticatedClient();
     HttpClient CreateAuthenticatedHttpClient(Uri Url, string authPackage = "Kerberos");
 }
 
-public class HttpClientFactory : IHttpClientFactory
-{
-    public HttpClient CreateUnauthenticatedClient()
-    {
-        var handler = new HttpClientHandler
-        {
+public class HttpClientFactory : IHttpClientFactory {
+    public HttpClient CreateUnauthenticatedClient() {
+        var handler = new HttpClientHandler {
             ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, cetChain, policyErrors) => true,
             UseDefaultCredentials = false
         };
@@ -23,23 +19,17 @@ public HttpClient CreateUnauthenticatedClient()
         return new HttpClient(handler);
     }
 
-    public HttpClient CreateAuthenticatedHttpClient(Uri Url, string authPackage = "Kerberos")
-    {
-        var handler = new HttpClientHandler
-        {
-            Credentials = new CredentialCache()
-            {
+    public HttpClient CreateAuthenticatedHttpClient(Uri Url, string authPackage = "Kerberos") {
+        var handler = new HttpClientHandler {
+            Credentials = new CredentialCache() {
                 { Url, authPackage, CredentialCache.DefaultNetworkCredentials }
             },
 
             PreAuthenticate = true,
             ServerCertificateCustomValidationCallback =
-                (httpRequestMessage, cert, cetChain, policyErrors) =>
-                {
-                    return true;
-                },
+                (httpRequestMessage, cert, cetChain, policyErrors) => { return true; },
         };
 
         return new HttpClient(handler);
     }
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
index 0f9924bc..d535c011 100644
--- a/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
+++ b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
@@ -8,20 +8,16 @@
 
 namespace SharpHoundCommonLib.Ntlm;
 
-public class HttpNtlmAuthenticationService
-{
+public class HttpNtlmAuthenticationService {
     private readonly ILogger _logger;
     private readonly IHttpClientFactory _httpClientFactory;
-    public Uri Url { get; set; }
 
-    public HttpNtlmAuthenticationService(ILogger logger, IHttpClientFactory httpClientFactory)
-    {
-        _logger = logger;
+    public HttpNtlmAuthenticationService(IHttpClientFactory httpClientFactory, ILogger logger = null) {
+        _logger = logger ?? Logging.LogProvider.CreateLogger(nameof(HttpNtlmAuthenticationService));
         _httpClientFactory = httpClientFactory;
     }
 
-    public async Task EnsureRequiresAuth(bool enableSigning, bool? useBadChannelBindings)
-    {
+    public async Task EnsureRequiresAuth(Uri Url, bool? useBadChannelBindings) {
         if (Url == null)
             throw new ArgumentException("Url property is null");
 
@@ -30,25 +26,17 @@ public async Task EnsureRequiresAuth(bool enableSigning, bool? useBadChannelBind
 
         var supportedAuthSchemes = await GetSupportedNtlmAuthSchemesAsync(Url);
 
-        _logger.LogDebug($"Supported NTLM auth schemes for {Url}: " + String.Join(",", supportedAuthSchemes));
+        _logger.LogDebug($"Supported NTLM auth schemes for {Url}: " + string.Join(",", supportedAuthSchemes));
 
-        foreach (var authScheme in supportedAuthSchemes)
-        {
-            if (useBadChannelBindings == null)
-            {
+        foreach (var authScheme in supportedAuthSchemes) {
+            if (useBadChannelBindings == null) {
                 await AuthWithBadChannelBindings(Url, authScheme);
-            }
-            else
-            {
-                if((bool)useBadChannelBindings)
-                {
+            } else {
+                if ((bool)useBadChannelBindings) {
                     await AuthWithBadChannelBindings(Url, authScheme);
-                }
-                else
-                {
+                } else {
                     await AuthWithChannelBindingAsync(Url, authScheme);
                 }
-                    
             }
 
             // If we've got here, everything has worked and it's accessible, so return
@@ -56,8 +44,7 @@ public async Task EnsureRequiresAuth(bool enableSigning, bool? useBadChannelBind
         }
     }
 
-    private async Task<string[]> GetSupportedNtlmAuthSchemesAsync(Uri url)
-    {
+    private async Task<string[]> GetSupportedNtlmAuthSchemesAsync(Uri url) {
         var httpClient = _httpClientFactory.CreateUnauthenticatedClient();
 
         using var getRequest = new HttpRequestMessage(HttpMethod.Get, url);
@@ -65,33 +52,25 @@ private async Task<string[]> GetSupportedNtlmAuthSchemesAsync(Uri url)
         return ExtractAuthSchemes(getResponse);
     }
 
-    private string[] ExtractAuthSchemes(HttpResponseMessage response)
-    {
-        if (response.StatusCode == HttpStatusCode.OK)
-        {
-            throw new AuthNotRequiredException("Authorization was not solicited when enumerating Authentication schemes");
+    private string[] ExtractAuthSchemes(HttpResponseMessage response) {
+        if (response.StatusCode == HttpStatusCode.OK) {
+            throw new AuthNotRequiredException(
+                "Authorization was not solicited when enumerating Authentication schemes");
         }
 
         // We expect to get an Unauthorized. If not, something is off
-        if (response.StatusCode != HttpStatusCode.Unauthorized)
-        {
-            if (response.StatusCode == HttpStatusCode.Forbidden)
-            {
+        if (response.StatusCode != HttpStatusCode.Unauthorized) {
+            if (response.StatusCode == HttpStatusCode.Forbidden) {
                 throw new HttpForbiddenException("Forbidden when enumerating Auth schemes");
-            }
-            else if (response.StatusCode == HttpStatusCode.InternalServerError)
-            {
+            } else if (response.StatusCode == HttpStatusCode.InternalServerError) {
                 throw new HttpServerErrorException("Server Error when enumerating Auth schemes");
-            }
-            else
-            {
+            } else {
                 // Use .NET's exceptions to make things easy
                 response.EnsureSuccessStatusCode();
             }
         }
 
-        if (response.Headers.WwwAuthenticate == null)
-        {
+        if (response.Headers.WwwAuthenticate == null) {
             throw new InvalidOperationException("WWW-Authenticate header is missing");
         }
 
@@ -104,34 +83,27 @@ private string[] ExtractAuthSchemes(HttpResponseMessage response)
         return schemes;
     }
 
-    private async Task AuthWithBadChannelBindings(Uri url, string authScheme)
-    {
+    private async Task AuthWithBadChannelBindings(Uri url, string authScheme) {
         var httpClient = _httpClientFactory.CreateUnauthenticatedClient();
-        var transport = new HttpTransport(_logger, httpClient, url, authScheme);
-        var ntlmAuthHandler = new NtlmAuthenticationHandler(_logger, url.Host, $"HTTP/{url.Host}");
+        var transport = new HttpTransport(httpClient, url, authScheme, _logger);
+        var ntlmAuthHandler = new NtlmAuthenticationHandler($"HTTP/{url.Host}");
 
         var response = (HttpResponseMessage)await ntlmAuthHandler.PerformNtlmAuthenticationAsync(transport);
 
-        if (response.StatusCode == HttpStatusCode.OK)
-        {
+        if (response.StatusCode == HttpStatusCode.OK) {
             return;
-        }
-        else if(response.StatusCode == HttpStatusCode.Unauthorized)
-        {
-            throw new HttpUnauthorizedException($"401 Unauthorized when accessing {url} with {authScheme} and no signing");
-        }
-        else if(response.StatusCode == HttpStatusCode.Forbidden)
-        {
+        } else if (response.StatusCode == HttpStatusCode.Unauthorized) {
+            throw new HttpUnauthorizedException(
+                $"401 Unauthorized when accessing {url} with {authScheme} and no signing");
+        } else if (response.StatusCode == HttpStatusCode.Forbidden) {
             throw new HttpForbiddenException($"403 Forbidden when accessing {url} with {authScheme} and no signing");
         }
 
         response.EnsureSuccessStatusCode();
     }
 
-    private async Task<bool> AuthWithChannelBindingAsync(Uri url, string authScheme)
-    {
-        var handler = new HttpClientHandler
-        {
+    private async Task<bool> AuthWithChannelBindingAsync(Uri url, string authScheme) {
+        var handler = new HttpClientHandler {
             ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, cetChain, policyErrors) => true,
         };
 
@@ -143,13 +115,10 @@ private async Task<bool> AuthWithChannelBindingAsync(Uri url, string authScheme)
 
         using var client = new HttpClient(handler);
 
-        try
-        {
+        try {
             HttpResponseMessage response = await client.GetAsync(url);
             return response.StatusCode == HttpStatusCode.OK;
-        }
-        catch (AuthenticationException ex)
-        {
+        } catch (AuthenticationException ex) {
             _logger.LogWarning(ex, $"Authentication failed for {url} with {authScheme}");
             return false;
         }
@@ -157,49 +126,37 @@ private async Task<bool> AuthWithChannelBindingAsync(Uri url, string authScheme)
 }
 
 [Serializable]
-internal class HttpUnauthorizedException : Exception
-{
-    public HttpUnauthorizedException()
-    {
+internal class HttpUnauthorizedException : Exception {
+    public HttpUnauthorizedException() {
     }
 
-    public HttpUnauthorizedException(string message) : base(message)
-    {
+    public HttpUnauthorizedException(string message) : base(message) {
     }
 }
 
 [Serializable]
-internal class HttpForbiddenException : Exception
-{
-    public HttpForbiddenException()
-    {
+internal class HttpForbiddenException : Exception {
+    public HttpForbiddenException() {
     }
 
-    public HttpForbiddenException(string message) : base(message)
-    {
+    public HttpForbiddenException(string message) : base(message) {
     }
 }
 
 [Serializable]
-internal class HttpServerErrorException : Exception
-{
-    public HttpServerErrorException()
-    {
+internal class HttpServerErrorException : Exception {
+    public HttpServerErrorException() {
     }
 
-    public HttpServerErrorException(string message) : base(message)
-    {
+    public HttpServerErrorException(string message) : base(message) {
     }
 }
 
 [Serializable]
-internal class AuthNotRequiredException : Exception
-{
-    public AuthNotRequiredException()
-    {
+internal class AuthNotRequiredException : Exception {
+    public AuthNotRequiredException() {
     }
 
-    public AuthNotRequiredException(string message) : base(message)
-    {
+    public AuthNotRequiredException(string message) : base(message) {
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/HttpTransport.cs b/src/CommonLib/Ntlm/HttpTransport.cs
index 4c84739e..508b9c2d 100644
--- a/src/CommonLib/Ntlm/HttpTransport.cs
+++ b/src/CommonLib/Ntlm/HttpTransport.cs
@@ -13,9 +13,9 @@ public class HttpTransport : INtlmTransport
     private readonly Uri _url;
     private readonly string _authScheme;
 
-    public HttpTransport(ILogger logger, HttpClient httpClient, Uri url, string authScheme)
+    public HttpTransport(HttpClient httpClient, Uri url, string authScheme, ILogger logger = null)
     {
-        _logger = logger;
+        _logger = logger ?? Logging.LogProvider.CreateLogger(nameof(HttpTransport));
         _httpClient = httpClient;
         _url = url;
         _authScheme = authScheme;
@@ -34,7 +34,7 @@ public async Task<byte[]> NegotiateAsync(byte[] negotiateMessage)
             throw new InvalidOperationException("No WWW-Authenticate header found in response");
         }
 
-        var authHeaders = response.Headers.WwwAuthenticate.Where(a => a.Scheme == _authScheme);
+        var authHeaders = response.Headers.WwwAuthenticate.Where(a => a.Scheme == _authScheme).ToArray();
         if (!authHeaders.Any())
         {
             throw new InvalidOperationException($"No WWW-Authenticate header found in response. Auth Scheme: {_authScheme}");
diff --git a/src/CommonLib/Ntlm/INtlmTransport.cs b/src/CommonLib/Ntlm/INtlmTransport.cs
index 6b88ba99..b29a4f3f 100644
--- a/src/CommonLib/Ntlm/INtlmTransport.cs
+++ b/src/CommonLib/Ntlm/INtlmTransport.cs
@@ -3,8 +3,7 @@
 
 namespace SharpHoundCommonLib.Ntlm;
 
-public interface INtlmTransport
-{
+public interface INtlmTransport {
     Task<byte[]> NegotiateAsync(byte[] negotiateMessage);
-    Task<Object> AuthenticateAsync(byte[] authenticateMessage);
+    Task<object> AuthenticateAsync(byte[] authenticateMessage);
 }
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/LdapException.cs b/src/CommonLib/Ntlm/LdapException.cs
deleted file mode 100644
index e75a76e3..00000000
--- a/src/CommonLib/Ntlm/LdapException.cs
+++ /dev/null
@@ -1,16 +0,0 @@
-using System;
-
-namespace SharpHoundCommonLib.Ntlm;
-
-public class LdapException : Exception
-{
-    public int ErrorCode { get; }
-    public string ServerErrorMessage { get; }
-
-    public LdapException(string message, int errorCode, string serverErrorMessage = null)
-        : base($"{message}. LDAP error code: {errorCode}{(string.IsNullOrEmpty(serverErrorMessage) ? "" : $". Server error: {serverErrorMessage}")}")
-    {
-        ErrorCode = errorCode;
-        ServerErrorMessage = serverErrorMessage;
-    }
-}
diff --git a/src/CommonLib/Ntlm/LdapNative.cs b/src/CommonLib/Ntlm/LdapNative.cs
index 8b34574f..e8cca6ce 100644
--- a/src/CommonLib/Ntlm/LdapNative.cs
+++ b/src/CommonLib/Ntlm/LdapNative.cs
@@ -7,73 +7,57 @@
 
 namespace SharpHoundCommonLib.Ntlm;
 
-public class SafeLdapHandle : SafeHandleZeroOrMinusOneIsInvalid
-{
-    internal SafeLdapHandle(IntPtr handle) : base(true)
-    {
+public class SafeLdapHandle : SafeHandleZeroOrMinusOneIsInvalid {
+    internal SafeLdapHandle(IntPtr handle) : base(true) {
         this.handle = handle;
     }
 
-    protected override bool ReleaseHandle()
-    {
-        if (!IsInvalid)
-        {
-            int result = NativeMethods.ldap_unbind_s(handle);
+    protected override bool ReleaseHandle() {
+        if (!IsInvalid) {
+            var result = NativeMethods.ldap_unbind_s(handle);
             return result == 0;
         }
+
         return true;
     }
 }
 
-public class LdapConnection : IDisposable
-{
+public class LdapConnection : IDisposable {
     private SafeLdapHandle? _handle;
     private bool _disposed;
 
-    public SafeLdapHandle Handle
-    {
-        get
-        {
+    public SafeLdapHandle Handle {
+        get {
             ThrowIfDisposed();
             return _handle ?? throw new InvalidOperationException("LDAP connection not initialized");
         }
     }
 
-    private void ThrowIfDisposed()
-    {
-        if (_disposed)
-        {
+    private void ThrowIfDisposed() {
+        if (_disposed) {
             throw new ObjectDisposedException(nameof(LdapConnection));
         }
     }
 
-    private string? GetServerError()
-    {
+    private string? GetServerError() {
         ThrowIfDisposed();
 
-        try
-        {
-            IntPtr errorMessagePtr;
-            int result = NativeMethods.ldap_get_option(
+        try {
+            var result = NativeMethods.ldap_get_option(
                 Handle,
                 LdapOption.ServerError,
-                out errorMessagePtr
+                out IntPtr errorMessagePtr
             );
 
             if (result != 0 || errorMessagePtr == IntPtr.Zero)
                 return null;
 
-            try
-            {
+            try {
                 return Marshal.PtrToStringAnsi(errorMessagePtr);
-            }
-            finally
-            {
+            } finally {
                 NativeMethods.ldap_memfree(errorMessagePtr);
             }
-        }
-        catch
-        {
+        } catch {
             // If anything goes wrong getting the server error,
             // return null rather than throw since we're already
             // in error handling code
@@ -81,71 +65,58 @@ out errorMessagePtr
         }
     }
 
-    public void CheckError(int result, string operation)
-    {
-        if (result != 0)
-        {
-            int lastError = NativeMethods.LdapGetLastError();
-            string? serverError = GetServerError();
-            throw new LdapException(
-                $"LDAP operation failed. Operation: {operation}. API error code: {result}",
-                lastError,
-                serverError
-            );
-        }
+    public void CheckError(int result, string operation) {
+        if (result == (int)LdapErrorCodes.Success) return;
+
+        var lastError = NativeMethods.LdapGetLastError();
+        var serverError = GetServerError();
+        throw new LdapNativeException(
+            $"LDAP operation failed. Operation: {operation}. API error code: {result}",
+            lastError,
+            serverError
+        );
     }
 
-    public void Initialize(string hostName, int port)
-    {
+    public void Initialize(string hostName, int port) {
         ThrowIfDisposed();
 
         var handle = NativeMethods.ldap_init(hostName, port);
-        if (handle == IntPtr.Zero)
-        {
-            int lastError = NativeMethods.LdapGetLastError();
-            throw new LdapException($"Failed to initialize LDAP connection", lastError);
+        if (handle == IntPtr.Zero) {
+            var lastError = NativeMethods.LdapGetLastError();
+            throw new LdapNativeException($"Failed to initialize LDAP connection", lastError);
         }
 
         _handle = new SafeLdapHandle(handle);
     }
 
-    public void Connect(int timeout = -1)
-    {
+    public void Connect(int timeout = -1) {
         ThrowIfDisposed();
 
         var timeoutPtr = IntPtr.Zero;
-        try
-        {
-            if (timeout >= 0)
-            {
-                var ldapTimeout = new LDAP_TIMEVAL
-                {
+        try {
+            if (timeout >= 0) {
+                var ldapTimeout = new LDAP_TIMEVAL {
                     tv_sec = (int)(new TimeSpan(0, 0, timeout).Ticks / TimeSpan.TicksPerSecond),
                 };
                 timeoutPtr = Marshal.AllocHGlobal(Marshal.SizeOf(ldapTimeout));
                 Marshal.StructureToPtr(ldapTimeout, timeoutPtr, false);
             }
 
-            int result = NativeMethods.ldap_connect(Handle, timeoutPtr);
+            var result = NativeMethods.ldap_connect(Handle, timeoutPtr);
             CheckError(result, "Connecting to LDAP server");
-        }
-        finally
-        {
-            if (timeoutPtr != IntPtr.Zero)
-            {
+        } finally {
+            if (timeoutPtr != IntPtr.Zero) {
                 Marshal.FreeHGlobal(timeoutPtr);
             }
         }
     }
 
-    private T GetOption<T>(LdapOption option) where T : struct
-    {
+    private T GetOption<T>(LdapOption option) where T : struct {
         ThrowIfDisposed();
 
-        if (typeof(T) == typeof(int))
-        {
+        if (typeof(T) == typeof(int)) {
             int value;
-            int result = NativeMethods.ldap_get_option(Handle, option, out value);
+            var result = NativeMethods.ldap_get_option(Handle, option, out value);
             CheckError(result, $"Getting LDAP option {option}");
             return (T)(object)value;
         }
@@ -153,46 +124,42 @@ private T GetOption<T>(LdapOption option) where T : struct
         throw new ArgumentException($"Unsupported option type: {typeof(T).Name}");
     }
 
-    public void SetOption(LdapOption option, LdapOptionValue value)
-    {
+    public void SetOption(LdapOption option, LdapOptionValue value) {
         ThrowIfDisposed();
 
         // Get current value
-        int currentValue = GetOption<int>(option);
-        int newValue = (int)value;
+        var currentValue = GetOption<int>(option);
+        var newValue = (int)value;
 
         // Only set if different
-        if (currentValue != newValue)
-        {
+        if (currentValue != newValue) {
 #pragma warning disable CS8604 // Possible null reference argument.
-            int result = NativeMethods.ldap_set_option(_handle, option, ref newValue);
+            var result = NativeMethods.ldap_set_option(_handle, option, ref newValue);
 #pragma warning restore CS8604 // Possible null reference argument.
             CheckError(result, $"Setting LDAP option {option}");
 
             // Verify the change
-            int verifyValue = GetOption<int>(option);
-            if (verifyValue != newValue)
-            {
-                throw new LdapException($"Failed to verify option change for {option}. Expected {newValue} but got {verifyValue}",
+            var verifyValue = GetOption<int>(option);
+            if (verifyValue != newValue) {
+                throw new LdapNativeException(
+                    $"Failed to verify option change for {option}. Expected {newValue} but got {verifyValue}",
                     NativeMethods.LdapGetLastError());
             }
         }
     }
 
-    public void SetOption(LdapOption option, IntPtr value)
-    {
+    public void SetOption(LdapOption option, IntPtr value) {
 #pragma warning disable CS8604 // Possible null reference argument.
-        int result = NativeMethods.ldap_set_option(_handle, option, value);
+        var result = NativeMethods.ldap_set_option(_handle, option, value);
 #pragma warning restore CS8604 // Possible null reference argument.
         CheckError(result, $"Setting LDAP option {option}");
     }
 
-    private int GetResultCode()
-    {
+    private int GetResultCode() {
         ThrowIfDisposed();
 
         int resultCode;
-        int result = NativeMethods.ldap_get_option(
+        var result = NativeMethods.ldap_get_option(
             Handle,
             LdapOption.ResultCode,
             out resultCode
@@ -202,16 +169,13 @@ out resultCode
         return resultCode;
     }
 
-    public byte[] SaslBind(string distinguishedName, string mechanism, byte[] credential)
-    {
+    public byte[] SaslBind(string distinguishedName, string mechanism, byte[] credential) {
         ThrowIfDisposed();
 
-        IntPtr credPtr = IntPtr.Zero;
-        try
-        {
+        var credPtr = IntPtr.Zero;
+        try {
             // Create berval structure for credentials
-            var berval = new BERVAL
-            {
+            var berval = new BERVAL {
                 bv_len = credential.Length,
                 bv_val = Marshal.AllocHGlobal(credential.Length)
             };
@@ -222,47 +186,42 @@ public byte[] SaslBind(string distinguishedName, string mechanism, byte[] creden
             Marshal.StructureToPtr(berval, credPtr, false);
 
             // Perform SASL bind
-            int result = NativeMethods.ldap_sasl_bind_s(
+            var result = NativeMethods.ldap_sasl_bind_s(
                 Handle,
                 distinguishedName,
                 mechanism,
                 credPtr,
-                IntPtr.Zero,  // No server controls
-                IntPtr.Zero,  // No client controls
-                out IntPtr response
+                IntPtr.Zero, // No server controls
+                IntPtr.Zero, // No client controls
+                out var response
             );
 
             if (result != (int)LdapErrorCodes.Success &&
-                result != (int)LdapErrorCodes.SaslBindInProgress)
-            {
-                throw new LdapException("SASL bind failed", result, GetServerError());
+                result != (int)LdapErrorCodes.SaslBindInProgress) {
+                throw new LdapNativeException("SASL bind failed", result, GetServerError());
             }
 
-            int bindResultCode = GetResultCode();
+            var bindResultCode = GetResultCode();
 
             if (bindResultCode != (int)LdapErrorCodes.Success &&
-                bindResultCode != (int)LdapErrorCodes.SaslBindInProgress)
-            {
-                throw new LdapException("SASL bind result failed", bindResultCode, GetServerError());
+                bindResultCode != (int)LdapErrorCodes.SaslBindInProgress) {
+                throw new LdapNativeException("SASL bind result failed", bindResultCode, GetServerError());
             }
 
             if (response == IntPtr.Zero)
                 throw new InvalidOperationException("Server did return a challenge");
 
             var responseBerval = Marshal.PtrToStructure<BERVAL>(response);
-            byte[] responseData = new byte[responseBerval.bv_len];
+            var responseData = new byte[responseBerval.bv_len];
             Marshal.Copy(responseBerval.bv_val, responseData, 0, responseBerval.bv_len);
             return responseData;
-        }
-        finally
-        {
-            if (credPtr != IntPtr.Zero)
-            {
+        } finally {
+            if (credPtr != IntPtr.Zero) {
                 var berval = Marshal.PtrToStructure<BERVAL>(credPtr);
-                if (berval.bv_val != IntPtr.Zero)
-                {
+                if (berval.bv_val != IntPtr.Zero) {
                     Marshal.FreeHGlobal(berval.bv_val);
                 }
+
                 Marshal.FreeHGlobal(credPtr);
             }
 
@@ -278,10 +237,9 @@ out IntPtr response
             //}
         }
     }
-    public void Dispose()
-    {
-        if (!_disposed)
-        {
+
+    public void Dispose() {
+        if (!_disposed) {
             _handle?.Dispose();
             _handle = null;
             _disposed = true;
@@ -289,23 +247,19 @@ public void Dispose()
     }
 }
 
-
 [StructLayout(LayoutKind.Sequential)]
-public struct LDAP_TIMEVAL
-{
+public struct LDAP_TIMEVAL {
     public int tv_sec;
     public int tv_usec;
 }
 
 [StructLayout(LayoutKind.Sequential)]
-public struct BERVAL
-{
+public struct BERVAL {
     public int bv_len;
     public IntPtr bv_val;
 }
-public class NativeMethods
-{
 
+public class NativeMethods {
     [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
     public static extern IntPtr ldap_init(string Host, int Port);
 
@@ -320,6 +274,7 @@ public class NativeMethods
 
     [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
     public static extern int ldap_get_option(SafeLdapHandle ld, LdapOption option, out int value);
+
     [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
     public static extern int ldap_get_option(SafeLdapHandle ld, LdapOption option, out IntPtr value);
 
diff --git a/src/CommonLib/Ntlm/LdapNativeException.cs b/src/CommonLib/Ntlm/LdapNativeException.cs
new file mode 100644
index 00000000..f39ddcba
--- /dev/null
+++ b/src/CommonLib/Ntlm/LdapNativeException.cs
@@ -0,0 +1,15 @@
+using System;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class LdapNativeException : Exception {
+    public int ErrorCode { get; }
+    public string ServerErrorMessage { get; }
+
+    public LdapNativeException(string message, int errorCode, string serverErrorMessage = null)
+        : base(
+            $"{message}. LDAP error code: {errorCode}{(string.IsNullOrEmpty(serverErrorMessage) ? "" : $". Server error: {serverErrorMessage}")}") {
+        ErrorCode = errorCode;
+        ServerErrorMessage = serverErrorMessage;
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/LdapTransport.cs b/src/CommonLib/Ntlm/LdapTransport.cs
index e8827a62..be94eec1 100644
--- a/src/CommonLib/Ntlm/LdapTransport.cs
+++ b/src/CommonLib/Ntlm/LdapTransport.cs
@@ -8,50 +8,40 @@
 
 namespace SharpHoundCommonLib.Ntlm;
 
-public class LdapTransport(ILogger logger, Uri ldapEndpoint) : INtlmTransport, IDisposable
-{
+public class LdapTransport(ILogger logger, Uri ldapEndpoint) : INtlmTransport, IDisposable {
     private LdapConnection? _ldap;
     private bool _disposed;
 
     [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
     public delegate bool VerifyServerCert(
-       IntPtr Connection,
-       IntPtr pServerCert
+        IntPtr Connection,
+        IntPtr pServerCert
     );
 
-    public bool IsLdaps
-    {
+    public bool IsSecureLdap {
         get { return ldapEndpoint.Scheme == "ldaps"; }
     }
 
-    private void ThrowIfDisposed()
-    {
-        if (_disposed)
-        {
+    private void ThrowIfDisposed() {
+        if (_disposed) {
             throw new ObjectDisposedException(nameof(LdapConnection));
         }
     }
 
-    private void ThrowIfHandleNull()
-    {
-        if (_ldap == null)
-        {
+    private void ThrowIfHandleNull() {
+        if (_ldap == null) {
             throw new NullReferenceException("LDAP handle is null");
         }
     }
 
-    public void InitializeConnectionAsync(int timeout = -1)
-    {
-        if (_ldap == null)
-        {
+    public void InitializeConnectionAsync(int timeout = -1) {
+        if (_ldap == null) {
             _ldap = new LdapConnection();
-            try
-            {
+            try {
                 _ldap.Initialize(ldapEndpoint.Host, ldapEndpoint.Port);
                 _ldap.SetOption(LdapOption.ProtocolVersion, LdapOptionValue.Version3);
 
-                if (IsLdaps)
-                {
+                if (IsSecureLdap) {
                     _ldap.SetOption(
                         LdapOption.ServerCertificate,
                         Marshal.GetFunctionPointerForDelegate<VerifyServerCert>((connection, serverCert) => true)
@@ -67,9 +57,7 @@ public void InitializeConnectionAsync(int timeout = -1)
 
                 _ldap.Connect(timeout);
                 logger.LogDebug($"LDAP connection established to {ldapEndpoint.Host}:{ldapEndpoint.Port}");
-            }
-            catch (Exception)
-            {
+            } catch (Exception) {
                 _ldap.Dispose();
                 _ldap = null;
                 throw;
@@ -77,40 +65,31 @@ public void InitializeConnectionAsync(int timeout = -1)
         }
     }
 
-    public Task<byte[]> NegotiateAsync(byte[] negotiateMessage)
-    {
+    public Task<byte[]> NegotiateAsync(byte[] negotiateMessage) {
         ThrowIfDisposed();
         ThrowIfHandleNull();
 
-        return Task.Run(() =>
-        {
-            return _ldap!.SaslBind("", LdapSupportedSaslMechansims.GSS_SPNEGO, negotiateMessage);
-        });
-
+        return Task.Run(() => _ldap!.SaslBind("", LdapSupportedSaslMechanisms.GSS_SPNEGO, negotiateMessage));
     }
 
-    public async Task<Object> AuthenticateAsync(byte[] authenticateMessage)
-    {
+    public async Task<Object> AuthenticateAsync(byte[] authenticateMessage) {
         ThrowIfDisposed();
         ThrowIfHandleNull();
 
-        return await Task.Run(() =>
-        {
+        return await Task.Run(() => {
             InitializeConnectionAsync();
-            var bytes = _ldap!.SaslBind("", LdapSupportedSaslMechansims.GSS_SPNEGO, authenticateMessage);
+            var bytes = _ldap!.SaslBind("", LdapSupportedSaslMechanisms.GSS_SPNEGO, authenticateMessage);
             return bytes;
         });
     }
 
-    public void Dispose()
-    {
-        if (!_disposed)
-        {
-            if (_ldap != null)
-            {
+    public void Dispose() {
+        if (!_disposed) {
+            if (_ldap != null) {
                 _ldap.Dispose();
                 _ldap = null;
             }
+
             _disposed = true;
         }
     }
diff --git a/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
index 78b9397c..f4a10914 100644
--- a/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
+++ b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
@@ -14,15 +14,12 @@ interface INtlmAuthenticationHandler
 public class NtlmAuthenticationHandler : INtlmAuthenticationHandler
 {
     private readonly ILogger _logger;
-    private readonly string _host;
     private readonly string _targetService;
-    private const string NtlmAuthPackageName = "NTLM";
     public LdapAuthOptions Options { get; set; }
 
-    public NtlmAuthenticationHandler(ILogger logger, string host, string targetService)
+    public NtlmAuthenticationHandler(string targetService, ILogger logger = null)
     {
-        _logger = logger;
-        _host = host;
+        _logger = logger ?? Logging.LogProvider.CreateLogger("NtlmAuthenticationHandler");
         _targetService = targetService;
 
         Options = new LdapAuthOptions()
@@ -32,7 +29,7 @@ public NtlmAuthenticationHandler(ILogger logger, string host, string targetServi
         };
     }
 
-    public async Task<Object> PerformNtlmAuthenticationAsync(INtlmTransport transport)
+    public async Task<object> PerformNtlmAuthenticationAsync(INtlmTransport transport)
     {
         using var context = new SspiContext(
                 null,
@@ -46,15 +43,12 @@ public async Task<Object> PerformNtlmAuthenticationAsync(INtlmTransport transpor
 
         // NEGOTIATE
         var negotiateMsgBytes = context.Step();
-        //_logger.LogDebug($"NTLM-NEGOTIATE message: {Convert.ToBase64String(negotiateMsgBytes)}");
 
         // CHALLENGE
         var challengeMessageBytes = await transport.NegotiateAsync(negotiateMsgBytes);
-        //_logger.LogDebug($"NTLM-CHALLENGE message: {Convert.ToBase64String(challengeMessageBytes)}");
 
         // AUTHENTICATE
         var authenticateMsgBytes = context.Step(challengeMessageBytes);
-        //_logger.LogDebug($"NTLM-AUTHENTICATE message: {Convert.ToBase64String(authenticateMsgBytes)}");
 
         // Perform final authentication
         var response = await transport.AuthenticateAsync(authenticateMsgBytes);
diff --git a/src/CommonLib/OutputTypes/APIResult.cs b/src/CommonLib/OutputTypes/APIResult.cs
index e859f56f..a6e9a05f 100644
--- a/src/CommonLib/OutputTypes/APIResult.cs
+++ b/src/CommonLib/OutputTypes/APIResult.cs
@@ -1,48 +1,34 @@
-namespace SharpHoundCommonLib.OutputTypes
-{
-    public class BaseAPIResult<T>
-    {
-        public bool Collected { get; set; }
-        public string FailureReason { get; set; }
-    }
-
+namespace SharpHoundCommonLib.OutputTypes {
 #nullable enable
-    public class APIResult
-    {
+    public class APIResult {
         public bool Collected { get; set; }
         public string? FailureReason { get; set; }
     }
-    public class ApiResult<T> : APIResult
-    {
+
+    public class ApiResult<T> : APIResult {
         public T? Results { get; set; }
 
-        public ApiResult()
-        {
+        public ApiResult() {
             Results = default(T);
             Collected = false;
             FailureReason = null;
         }
 
-        public ApiResult(T? data)
-        {
+        public ApiResult(T? data) {
             Results = data;
             Collected = data != null;
             FailureReason = null;
         }
 
-        public static ApiResult<T> CreateSuccess(T result)
-        {
-            return new ApiResult<T>(result)
-            {
+        public static ApiResult<T> CreateSuccess(T result) {
+            return new ApiResult<T>(result) {
                 Collected = true,
                 FailureReason = null
             };
         }
 
-        public static ApiResult<T> CreateError(string message)
-        {
-            return new ApiResult<T>(default)
-            {
+        public static ApiResult<T> CreateError(string message) {
+            return new ApiResult<T>(default) {
                 Collected = false,
                 FailureReason = message
             };
diff --git a/src/CommonLib/OutputTypes/CAHttpEndpoint.cs b/src/CommonLib/OutputTypes/CAHttpEndpoint.cs
index 58520a0f..29ec91fd 100644
--- a/src/CommonLib/OutputTypes/CAHttpEndpoint.cs
+++ b/src/CommonLib/OutputTypes/CAHttpEndpoint.cs
@@ -4,10 +4,8 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace SharpHoundCommonLib.OutputTypes
-{
-    public enum CAEnrollmentEndpointType
-    {
+namespace SharpHoundCommonLib.OutputTypes {
+    public enum CAEnrollmentEndpointType {
         // The Certificate Authority Web Enrollment server role, an ASP web application
         WebEnrollmentApplication,
 
@@ -15,16 +13,16 @@ public enum CAEnrollmentEndpointType
         EnrollmentWebService,
 
         // The Network Device Enrollment Service (NDES), which uses the SCEP protocol to obtain certificates.
-        NDES,                     // NDES
+        NDES, // NDES
 
         // ICertPassage Remote Protocol (MS-ICPR), an RPC protcol
-        RPC,                      // 
+        RPC, // 
 
         // The Windows Client Certificate Enrollment Protocol (MS-WCCE), a set of DCOM interfaces for certificate enrollment
         DCOM,
     }
-    public enum CAEnrollmentEndpointScanResult
-    {
+
+    public enum CAEnrollmentEndpointScanResult {
         // Endpoint is vulnerable due to using HTTP (not HTTPS) with NTLM auth (ESC8)
         Vulnerable_NtlmHttpEndpoint,
 
@@ -39,7 +37,7 @@ public enum CAEnrollmentEndpointScanResult
 
         // Endpoint is not vulnerable due to not existing
         NotVulnerable_PortInaccessible = 0x100,
-        
+
         // The server did not return an NTLM challenge (e.g., when Negotiate:Kerberos is enabled)
         NotVulnerable_NoNtlmChallenge,
 
@@ -57,11 +55,10 @@ public enum CAEnrollmentEndpointScanResult
 
         Error = 0xFFFF
     }
-    public class CAEnrollmentEndpoint(Uri url, CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult status)
-    {
+
+    public class CAEnrollmentEndpoint(Uri url, CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult status) {
         public Uri Url { get; set; } = url;
         public CAEnrollmentEndpointType Type { get; set; } = type;
         public CAEnrollmentEndpointScanResult Status { get; set; } = status;
-
     }
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/OutputTypes/Computer.cs b/src/CommonLib/OutputTypes/Computer.cs
index 35d84f85..dedad361 100644
--- a/src/CommonLib/OutputTypes/Computer.cs
+++ b/src/CommonLib/OutputTypes/Computer.cs
@@ -1,12 +1,10 @@
 using System.Collections.Generic;
 
-namespace SharpHoundCommonLib.OutputTypes
-{
+namespace SharpHoundCommonLib.OutputTypes {
     /// <summary>
     ///     Represents a computer object in Active Directory. Contains all the properties BloodHound cares about
     /// </summary>
-    public class Computer : OutputBase
-    {
+    public class Computer : OutputBase {
         public string PrimaryGroupSID { get; set; }
         public TypedPrincipal[] AllowedToDelegate { get; set; } = [];
         public TypedPrincipal[] AllowedToAct { get; set; } = [];
@@ -25,15 +23,17 @@ public class Computer : OutputBase
 
 #pragma warning disable CS8632 // The annotation for nullable reference types should only be used in code within a '#nullable' annotations context.
         public ApiResult<bool> IsWebClientRunning { get; set; }
-        public LdapService? LdapServices { get; set; } 
+        public LdapService? LdapServices { get; set; }
         public ApiResult<SmbInfo>? SmbInfo { get; set; }
-        public ApiResult<NtlmSessionResult>? NtlmSessions { get; set; } 
+        public ApiResult<NtlmSessionResult>? NtlmSessions { get; set; }
 #pragma warning restore CS8632 // The annotation for nullable reference types should only be used in code within a '#nullable' annotations context.
-
     }
 
-    public class LdapService(bool hasLdap, bool hasLdaps, ApiResult<bool> isSigningRequired, ApiResult<bool> isChannelBindingRequired)
-    {
+    public class LdapService(
+        bool hasLdap,
+        bool hasLdaps,
+        ApiResult<bool> isSigningRequired,
+        ApiResult<bool> isChannelBindingRequired) {
         // Is the LDAP port accesible?
         public bool HasLdap { get; set; } = hasLdap;
 
@@ -46,32 +46,30 @@ public class LdapService(bool hasLdap, bool hasLdaps, ApiResult<bool> isSigningR
         // For LDAPS, is EPA(ChannelBinding) required?
         public ApiResult<bool> IsChannelBindingDisabled { get; set; } = isChannelBindingRequired;
 
-        public override string ToString()
-        {
-            return $@"HasLdap: {HasLdap}
-HasLdaps: {HasLdaps}
-IsSigningRequired: {IsSigningRequired}
-IsChannelBindingDisabled: {IsChannelBindingDisabled}";
+        public override string ToString() {
+            return $"""
+                    HasLdap: {HasLdap}
+                    HasLdaps: {HasLdaps}
+                    IsSigningRequired: {IsSigningRequired}
+                    IsChannelBindingDisabled: {IsChannelBindingDisabled}
+                    """;
         }
     }
 
 
-    public class SmbInfo
-    {
+    public class SmbInfo {
         public bool? SigningEnabled;
         public string OsVersion;
         public string OsBuild;
         public string DnsComputerName { get; internal set; }
     }
 
-    public class DCRegistryData
-    {
+    public class DCRegistryData {
         public IntRegistryAPIResult CertificateMappingMethods { get; set; }
         public IntRegistryAPIResult StrongCertificateBindingEnforcement { get; set; }
     }
 
-    public class ComputerStatus
-    {
+    public class ComputerStatus {
         public bool Connectable { get; set; }
         public string Error { get; set; }
 
@@ -80,14 +78,12 @@ public class ComputerStatus
         public static string PortNotOpen => "PortNotOpen";
         public static string Success => "Success";
 
-        public CSVComputerStatus GetCSVStatus(string computerName)
-        {
-            return new CSVComputerStatus
-            {
+        public CSVComputerStatus GetCSVStatus(string computerName) {
+            return new CSVComputerStatus {
                 Status = Error,
                 Task = "CheckAvailability",
                 ComputerName = computerName
             };
         }
     }
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/OutputTypes/NtlmSession.cs b/src/CommonLib/OutputTypes/NtlmSession.cs
index ab6c77a6..9a58a056 100644
--- a/src/CommonLib/OutputTypes/NtlmSession.cs
+++ b/src/CommonLib/OutputTypes/NtlmSession.cs
@@ -3,16 +3,15 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics.Eventing.Reader;
+using SharpHoundCommonLib.Enums;
 
-namespace SharpHoundCommonLib.OutputTypes
-{
-    public class NtlmSessionResult
-    {
+namespace SharpHoundCommonLib.OutputTypes {
+    public class NtlmSessionResult {
         public List<NtlmSession>? Sessions { get; set; }
         public long CollectionDurationMs { get; set; }
     }
+
     public class NtlmSession(
-        string host,
         DateTime? timeCreatedUtc,
         SecurityLogId id,
         string? accountSid,
@@ -22,30 +21,26 @@ public class NtlmSession(
         string? sourceIp,
         string? sourcePort,
         string packageName
-        )
-    {
-        public string Host { get; set; } = host;   // Hostname the sessions occurred on
+    ) {
         public DateTime? TimeCreatedUtc { get; set; } = timeCreatedUtc;
         public SecurityLogId Id { get; set; } = id;
         public string? AccountSid { get; set; } = accountSid;
         public string AccountName { get; set; } = accountName;
         public string? AccountDomain { get; set; } = accountDomain;
-        public string SourceHost { get; set; } = sourceHost;   // The host the auth originated from
+        public string SourceHost { get; set; } = sourceHost; // The host the auth originated from
         public string? SourceIp { get; set; } = sourceIp;
         public string? SourcePort { get; set; } = sourcePort;
         public string? PackageName { get; set; } = packageName;
 
-        public override string ToString()
-        {
+        public override string ToString() {
             var targetUser = AccountDomain + "\\" + AccountName;
             var source = (SourceIp != null || SourcePort != null) ? $"{SourceIp}:{SourcePort}" : "";
 
             return ($"  {TimeCreatedUtc?.ToLocalTime()},{Id},{targetUser},{AccountSid},{SourceHost},,{PackageName}");
         }
 
-        public static NtlmSession FromLogonEvent(string host, EventRecord evnt)
-        {
-            if (evnt.Id != 4624)
+        public static NtlmSession FromLogonEvent(EventRecord evnt) {
+            if (evnt.Id != EventIds.LogonEvent)
                 throw new ArgumentException("Not a logon event");
 
             //var subjectUserSid = eventDetail.Properties[0].Value.ToString();
@@ -72,7 +67,6 @@ public static NtlmSession FromLogonEvent(string host, EventRecord evnt)
 
 
             return new NtlmSession(
-                host,
                 evnt.TimeCreated?.ToUniversalTime(),
                 SecurityLogId.Logon,
                 targetUserSid,
@@ -85,9 +79,8 @@ public static NtlmSession FromLogonEvent(string host, EventRecord evnt)
             );
         }
 
-        public static NtlmSession FromValidateCredentialEvent(string host, EventRecord evnt)
-        {
-            if (evnt.Id != 4776)
+        public static NtlmSession FromValidateCredentialEvent(EventRecord evnt) {
+            if (evnt.Id != EventIds.ValidateCredentialsEvent)
                 throw new ArgumentException("Not a validate credential event");
 
             var packageName = evnt.Properties[0].Value.ToString();
@@ -96,7 +89,6 @@ public static NtlmSession FromValidateCredentialEvent(string host, EventRecord e
             //var status = evt.Properties[3].Value.ToString();
 
             return new NtlmSession(
-                host,
                 evnt.TimeCreated?.ToUniversalTime(),
                 SecurityLogId.Logon,
                 null,
diff --git a/src/CommonLib/Processors/CAEnrollmentProcessor.cs b/src/CommonLib/Processors/CAEnrollmentProcessor.cs
index 3ce9c6ab..0e106781 100644
--- a/src/CommonLib/Processors/CAEnrollmentProcessor.cs
+++ b/src/CommonLib/Processors/CAEnrollmentProcessor.cs
@@ -8,17 +8,14 @@
 using System.Net.Sockets;
 using System.Threading.Tasks;
 
-namespace SharpHoundCommonLib.Processors
-{
-    public class CAEnrollmentProcessor
-    {
+namespace SharpHoundCommonLib.Processors {
+    public class CAEnrollmentProcessor {
         private readonly string _caDnsHostname;
         private readonly string _caName;
         private readonly ILogger _logger;
         private readonly IHttpClientFactory _httpClientFactory;
 
-        public CAEnrollmentProcessor(string caDnsHostname, string caName, ILogger log = null)
-        {
+        public CAEnrollmentProcessor(string caDnsHostname, string caName, ILogger log = null) {
             ServicePointManager.SecurityProtocol |=
                 SecurityProtocolType.Ssl3
                 | SecurityProtocolType.Tls12
@@ -33,44 +30,37 @@ public CAEnrollmentProcessor(string caDnsHostname, string caName, ILogger log =
         }
 
 
-        public async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanAsync()
-        {
+        public async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanAsync() {
             var endpoints = new List<ApiResult<CAEnrollmentEndpoint>>();
 
-            try
-            {
+            try {
                 var webEnrollmentTask = ScanHttpEndpoint(CAEnrollmentEndpointType.WebEnrollmentApplication);
                 var webServiceTask = ScanHttpEndpoint(CAEnrollmentEndpointType.EnrollmentWebService);
-                // var rpcServiceTask = CheckEnrollmentRpcAsync();
-                // var dcomServiceTask = CheckEnrollmentDcomAsync();
 
                 await Task.WhenAll(
                     webEnrollmentTask,
                     webServiceTask
-                    //rpcServiceTask,
-                    //dcomServiceTask,
                 );
 
                 endpoints.AddRange(await webEnrollmentTask);
                 endpoints.AddRange(await webServiceTask);
-            }
-            catch (Exception ex)
-            {
+            } catch (Exception ex) {
                 _logger.LogError(ex, "An error occurred while scanning enrollment endpoints");
             }
 
             return endpoints;
         }
 
-        private async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanHttpEndpoint(CAEnrollmentEndpointType type)
-        {
+        private async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>>
+            ScanHttpEndpoint(CAEnrollmentEndpointType type) {
             var endpoints = new List<ApiResult<CAEnrollmentEndpoint>>();
             var (httpUrl, httpsUrl) = BuildEnrollmentUrls(type);
 
 
             // Check 1 - ESC8 via HTTP
             // Is the HTTP URL accessible via NTLM? If so, it's vulnerable to NTLM relay
-            var endpoint = await GetNtlmEndpoint(httpUrl, null, type, CAEnrollmentEndpointScanResult.Vulnerable_NtlmHttpEndpoint);
+            var endpoint = await GetNtlmEndpoint(httpUrl, null, type,
+                CAEnrollmentEndpointScanResult.Vulnerable_NtlmHttpEndpoint);
             endpoints.Add(endpoint);
 
             // Check 2 - ESC8 via HTTPS w/o channel binding (EPA)
@@ -88,17 +78,15 @@ private async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanHttpEndpoin
             return endpoints;
         }
 
-        private (Uri httpUrl, Uri httpsUrl) BuildEnrollmentUrls(CAEnrollmentEndpointType type)
-        {
-            switch (type)
-            {
+        private (Uri httpUrl, Uri httpsUrl) BuildEnrollmentUrls(CAEnrollmentEndpointType type) {
+            switch (type) {
                 case CAEnrollmentEndpointType.WebEnrollmentApplication:
                     return (new Uri($"http://{_caDnsHostname}/certsrv/"),
-                            new Uri($"https://{_caDnsHostname}/certsrv/"));
+                        new Uri($"https://{_caDnsHostname}/certsrv/"));
 
                 case CAEnrollmentEndpointType.EnrollmentWebService:
                     return (new Uri($"http://{_caDnsHostname}/{_caName}_CES_Kerberos/service.svc"),
-                            new Uri($"https://{_caDnsHostname}/{_caName}_CES_Kerberos/service.svc"));
+                        new Uri($"https://{_caDnsHostname}/{_caName}_CES_Kerberos/service.svc"));
 
                 default:
                     throw new ArgumentException("Unhandled enrollment endpoint type");
@@ -106,45 +94,35 @@ private async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanHttpEndpoin
         }
 
 
-        private async Task<ApiResult<CAEnrollmentEndpoint>> GetNtlmEndpoint(Uri url, bool? useBadChannelBinding, CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult scanResult)
-        {
+        private async Task<ApiResult<CAEnrollmentEndpoint>> GetNtlmEndpoint(Uri url, bool? useBadChannelBinding,
+            CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult scanResult) {
             var authService = new HttpNtlmAuthenticationService(
-                    _logger,
-                    new HttpClientFactory()
-                )
-            {
-                Url = url
-            };
+                new HttpClientFactory()
+            );
 
             var output = new CAEnrollmentEndpoint(url, type, scanResult);
 
-            try
-            {
-                await authService.EnsureRequiresAuth(false, useBadChannelBinding);
+            try {
+                await authService.EnsureRequiresAuth(url, useBadChannelBinding);
                 return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
-            }
-            catch (HttpRequestException ex)
-            {
-                if (ex.InnerException is WebException)
-                {
+            } catch (HttpRequestException ex) {
+                if (ex.InnerException is WebException) {
                     var webEx = (WebException)ex.InnerException;
 
 
-                    if (webEx.InnerException is SocketException)
-                    {
+                    if (webEx.InnerException is SocketException) {
                         output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PortInaccessible;
                         return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
                     }
-                    else if (webEx.Status == WebExceptionStatus.NameResolutionFailure)
-                    {
+
+                    if (webEx.Status == WebExceptionStatus.NameResolutionFailure) {
                         return ApiResult<CAEnrollmentEndpoint>.CreateError("Could not resolve hostname");
                     }
-                    else if (webEx.Response is HttpWebResponse httpResponse)
-                    {
+
+                    if (webEx.Response is HttpWebResponse httpResponse) {
                         HttpStatusCode statusCode = httpResponse.StatusCode;
 
-                        switch (statusCode)
-                        {
+                        switch (statusCode) {
                             case HttpStatusCode.NotFound:
                                 output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathNotFound;
                                 break;
@@ -154,82 +132,48 @@ private async Task<ApiResult<CAEnrollmentEndpoint>> GetNtlmEndpoint(Uri url, boo
                                 break;
                             default:
                                 return ApiResult<CAEnrollmentEndpoint>
-                                    .CreateError($"Unexpected status code '{statusCode}' for the URL {url}. UseBadChannelBindings: {useBadChannelBinding}");
+                                    .CreateError(
+                                        $"Unexpected status code '{statusCode}' for the URL {url}. UseBadChannelBindings: {useBadChannelBinding}");
                         }
 
                         return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
                     }
-                    else
-                    {
-                        Console.WriteLine($"WebException occurred: {ex}");
-                    }
+                    Console.WriteLine($"WebException occurred: {ex}");
 
                     return ApiResult<CAEnrollmentEndpoint>
-                        .CreateError($"Unhandled WebException. Url: {url}. Exception: {webEx}. Inner: {webEx.InnerException}  Data: {webEx.Data}");
-                }
-                else
-                {
-                    return ApiResult<CAEnrollmentEndpoint>
-                            .CreateError($"HttpRequestException occured checking NTLM accessibility for URL: {url}. Exception: {ex}");
+                        .CreateError(
+                            $"Unhandled WebException. Url: {url}. Exception: {webEx}. Inner: {webEx.InnerException}  Data: {webEx.Data}");
                 }
-            }
-            catch (HttpUnauthorizedException ex)
-            {
-                if (useBadChannelBinding == true)
-                {
+
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateError(
+                        $"HttpRequestException occured checking NTLM accessibility for URL: {url}. Exception: {ex}");
+            } catch (HttpUnauthorizedException ex) {
+                if (useBadChannelBinding == true) {
                     output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_NtlmChannelBindingRequired;
                     return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
                 }
-                else
-                {
-                    return ApiResult<CAEnrollmentEndpoint>
-                    .CreateError($"401 Unauthorized exception checking NTLM accessibility for URL: {url}. Exception: {ex}");
-                }
-            }
-            catch(HttpForbiddenException)
-            {
+
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateError(
+                        $"401 Unauthorized exception checking NTLM accessibility for URL: {url}. Exception: {ex}");
+            } catch (HttpForbiddenException) {
                 output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathForbidden;
                 return ApiResult<CAEnrollmentEndpoint>
                     .CreateSuccess(output);
-            }
-            catch(HttpServerErrorException)
-            {
+            } catch (HttpServerErrorException) {
                 output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathNotFound;
                 return ApiResult<CAEnrollmentEndpoint>
                     .CreateSuccess(output);
-            }
-            catch (MissingChallengeException)
-            {
+            } catch (MissingChallengeException) {
                 output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_NoNtlmChallenge;
                 return ApiResult<CAEnrollmentEndpoint>
                     .CreateSuccess(output);
-            }
-            catch (Exception ex)
-            {
+            } catch (Exception ex) {
                 return ApiResult<CAEnrollmentEndpoint>
-                    .CreateError($"Unhandled exception checking NTLM accessibility for URL: {url}. BadChannelBindings: {useBadChannelBinding}.  Exception: {ex}");
-            }
-        }
-
-        private async Task<bool> CanAccessUrlWithKerberosAsync(string url, bool useBadChannelBinding)
-        {
-            using (var client = _httpClientFactory.CreateAuthenticatedHttpClient(new Uri(url)))
-            {
-                try
-                {
-                    HttpResponseMessage response = await client.GetAsync(url);
-
-                    return true;
-                }
-                catch (HttpRequestException e)
-                {
-                    Console.WriteLine($"Error: {e.Message}");
-
-                    return false;
-                }
+                    .CreateError(
+                        $"Unhandled exception checking NTLM accessibility for URL: {url}. BadChannelBindings: {useBadChannelBinding}.  Exception: {ex}");
             }
         }
-
     }
-
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/Processors/CertAbuseProcessor.cs b/src/CommonLib/Processors/CertAbuseProcessor.cs
index 8c1cc787..4147b5b2 100644
--- a/src/CommonLib/Processors/CertAbuseProcessor.cs
+++ b/src/CommonLib/Processors/CertAbuseProcessor.cs
@@ -29,7 +29,7 @@ public CertAbuseProcessor(ILdapUtils utils, ILogger log = null)
         }
 
         /// <summary>
-        /// This function should be called with the security data fetched from <see cref="GetCARegistryValues"/>.
+        /// This function should be called with the security data fetched from <see cref="GetCASecurity"/>.
         /// The resulting ACEs will contain the owner of the CA as well as Management rights.
         /// </summary>
         /// <param name="security"></param>
diff --git a/src/CommonLib/Processors/ComputerSessionProcessor.cs b/src/CommonLib/Processors/ComputerSessionProcessor.cs
index d76933d9..35f5f122 100644
--- a/src/CommonLib/Processors/ComputerSessionProcessor.cs
+++ b/src/CommonLib/Processors/ComputerSessionProcessor.cs
@@ -50,12 +50,12 @@ public ComputerSessionProcessor(ILdapUtils utils,
         /// <returns></returns>
         public async Task<SessionAPIResult> ReadUserSessions(string computerName, string computerSid,
             string computerDomain, TimeSpan timeout = default) {
-
             if (timeout == default) {
                 timeout = TimeSpan.FromMinutes(2);
             }
+
             var ret = new SessionAPIResult();
-            
+
             _log.LogDebug("Running NetSessionEnum for {ObjectName}", computerName);
 
             var result = await Task.Run(() => {
@@ -138,7 +138,7 @@ await SendComputerStatus(new CSVComputerStatus {
                     continue;
                 }
 
-                (bool matchSuccess, string[] sids) = await _utils.GetGlobalCatalogMatches(username, computerDomain);
+                var (matchSuccess, sids) = await _utils.GetGlobalCatalogMatches(username, computerDomain);
                 if (matchSuccess) {
                     results.AddRange(
                         sids.Select(s => new Session { ComputerSID = resolvedComputerSID, UserSID = s }));
@@ -172,7 +172,7 @@ public async Task<SessionAPIResult> ReadUserSessionsPrivileged(string computerNa
             if (timeout == default) {
                 timeout = TimeSpan.FromMinutes(2);
             }
-            
+
             _log.LogDebug("Running NetWkstaUserEnum for {ObjectName}", computerName);
 
             var result = await Task.Run(() => {
@@ -198,7 +198,7 @@ public async Task<SessionAPIResult> ReadUserSessionsPrivileged(string computerNa
 
                 return result;
             }).TimeoutAfter(timeout);
-            
+
             if (result.IsFailed) {
                 await SendComputerStatus(new CSVComputerStatus {
                     Status = result.GetErrorStatus(),
@@ -224,7 +224,7 @@ await SendComputerStatus(new CSVComputerStatus {
             foreach (var wkstaUserInfo in result.Value) {
                 var domain = wkstaUserInfo.LogonDomain;
                 var username = wkstaUserInfo.Username;
-                
+
                 //If we dont have a domain or the domain has a space, ignore this object as it's unusable for us
                 if (string.IsNullOrWhiteSpace(domain) || domain.Contains(" ")) {
                     continue;
@@ -256,7 +256,7 @@ await SendComputerStatus(new CSVComputerStatus {
         public async Task<SessionAPIResult> ReadUserSessionsRegistry(string computerName, string computerDomain,
             string computerSid) {
             var ret = new SessionAPIResult();
-            
+
             _log.LogDebug("Running RegSessionEnum for {ObjectName}", computerName);
 
             RegistryKey key = null;
diff --git a/src/CommonLib/Processors/DCLdapProcessor.cs b/src/CommonLib/Processors/DCLdapProcessor.cs
index 25e898ed..b3b48994 100644
--- a/src/CommonLib/Processors/DCLdapProcessor.cs
+++ b/src/CommonLib/Processors/DCLdapProcessor.cs
@@ -10,14 +10,12 @@
 
 namespace SharpHoundCommonLib.Processors;
 
-public class LdapAuthOptions
-{
+public class LdapAuthOptions {
     public bool Signing { get; set; }
     public ChannelBindings? Bindings { get; set; }
 }
 
-public class DCLdapProcessor
-{
+public class DCLdapProcessor {
     private readonly ILogger _log;
     private readonly PortScanner _scanner;
     private readonly int _portScanTimeout;
@@ -29,8 +27,7 @@ public class DCLdapProcessor
     private readonly string SEC_E_BAD_BINDINGS = "80090346";
 
 
-    public DCLdapProcessor(int portScanTimeout, string dcHostname, ILogger log)
-    {
+    public DCLdapProcessor(int portScanTimeout, string dcHostname, ILogger log) {
         _log = log;
         _scanner = new PortScanner();
         _portScanTimeout = portScanTimeout;
@@ -39,20 +36,17 @@ public DCLdapProcessor(int portScanTimeout, string dcHostname, ILogger log)
         _ldapSslEndpoint = new Uri($"ldaps://{dcHostname}:636");
     }
 
-    public async Task<LdapService> Scan()
-    {
+    public async Task<LdapService> Scan() {
         var hasLdap = await TestLdapPort();
         var hasLdaps = await TestLdapsPort();
         ApiResult<bool> isSigningRequired = new(),
             isChannelBindingDisabled = new();
 
-        if (hasLdap)
-        {
+        if (hasLdap) {
             isSigningRequired = await CheckIsNtlmSigningRequired();
         }
 
-        if (hasLdaps)
-        {
+        if (hasLdaps) {
             isChannelBindingDisabled = await CheckIsChannelBindingDisabled();
         }
 
@@ -71,36 +65,29 @@ public async Task<LdapService> Scan()
     /// <param name="target">TCP port being tested</param>
     /// <returns>bool</returns>
     [ExcludeFromCodeCoverage]
-    public async Task<bool> TestLdapPort()
-    {
+    public async Task<bool> TestLdapPort() {
         return await _scanner.CheckPort(_ldapEndpoint.Host, _ldapEndpoint.Port, _portScanTimeout);
     }
 
     [ExcludeFromCodeCoverage]
-    public async Task<bool> TestLdapsPort()
-    {
+    public async Task<bool> TestLdapsPort() {
         return await _scanner.CheckPort(_ldapSslEndpoint.Host, _ldapSslEndpoint.Port, _portScanTimeout);
     }
 
-    public async Task<ApiResult<bool>> CheckIsNtlmSigningRequired()
-    {
-        try
-        {
-            var options = new LdapAuthOptions()
-            {
+    public async Task<ApiResult<bool>> CheckIsNtlmSigningRequired() {
+        try {
+            var options = new LdapAuthOptions() {
                 Signing = false
             };
             var accessibleWithoutSigning = await Authenticate(_ldapEndpoint, options);
 
             return ApiResult<bool>.CreateSuccess(accessibleWithoutSigning == false);
-        }
-        catch (Exception ex)
-        {
+        } catch (Exception ex) {
             return ApiResult<bool>.CreateError($"CheckIsNtlmSigningRequired failed: {ex}");
         }
     }
 
-    // Checks if EPA is enabled. Does so by trying to auth with wrong channel bingings.
+    // Checks if EPA is enabled. Does so by trying to auth with wrong channel bindings.
     // If auth is successful despite the wrong bindings, then EPA is not required.
     // Note: Ideally we'd check if it works under 3 conditions:
     // 1) No channel bindings to check if configured to "Never"
@@ -108,93 +95,54 @@ public async Task<ApiResult<bool>> CheckIsNtlmSigningRequired()
     // 3) Correct bindings to ensure NTLM auth is enabled
     // However, as of right now we only do #2. We can't do #1 right now since the
     // Window's SSPI APIs (InitSecurityContext) always add channel bindings.
-    public async Task<ApiResult<bool>> CheckIsChannelBindingDisabled()
-    {
-        try
-        {
+    public async Task<ApiResult<bool>> CheckIsChannelBindingDisabled() {
+        try {
             // 1) Can we connect with *invalid* bindings
 
-            var bindings = new ChannelBindings
-            {
+            var bindings = new ChannelBindings {
                 ApplicationData = [0, 0, 0, 0]
             };
-            var accessibleWithNoBindings = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions()
-            {
+            var accessibleWithNoBindings = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions() {
                 Signing = false,
                 Bindings = bindings
             });
 
-            return ApiResult<bool>.CreateSuccess(accessibleWithNoBindings == true);
-
-            //// Second, check if we can connect, but with *INVALID* bindings
-            //// This is to check if it's configured for "When Supported"
-            //var bindings = new ChannelBindings();
-            //bindings.ApplicationData = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
-            //var accessibleWithBadBindings = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions()
-            //{
-            //    Signing = true,
-            //    Bindings = bindings
-            //});
-
-            //if (accessibleWithBadBindings)
-            //    return ApiResult<bool>.CreateSuccess(false);
-
-            // Third, check if we can connect with *CORRECT* bindings to see if NTLM is enabled
-            //var cert = await SslUtils.GetServerCertificate(_ldapSslEndpoint.Host);
-            //var bindings = SslUtils.GetTlsChannelBindings(cert);
-            //var accessible = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions()
-            //{
-            //    Signing = true,
-            //    Bindings = bindings
-            //});
-
-            //if (accessible)
-            //    return ApiResult<bool>.CreateSuccess(true);
-
-            //throw new InvalidOperationException("Could not access any LDAP endpoints");
-        }
-        catch (Exception ex)
-        {
+            return ApiResult<bool>.CreateSuccess(accessibleWithNoBindings);
+        } catch (Exception ex) {
             return ApiResult<bool>.CreateError($"CheckIsNtlmSigningRequired failed: {ex}");
         }
     }
 
-    private async Task<bool> Authenticate(Uri endpoint, LdapAuthOptions options)
-    {
+    private async Task<bool> Authenticate(Uri endpoint, LdapAuthOptions options) {
         var host = endpoint.Host;
-        var auth = new NtlmAuthenticationHandler(_log, host, $"LDAP/{host.ToUpper()}")
-        {
+        var auth = new NtlmAuthenticationHandler($"LDAP/{host.ToUpper()}") {
             Options = options
         };
         var transport = new LdapTransport(_log, endpoint);
 
-        try
-        {
+        try {
             transport.InitializeConnectionAsync(_ldapTimeout);
-            var bytes = (byte[])await auth.PerformNtlmAuthenticationAsync(transport);
+            await auth.PerformNtlmAuthenticationAsync(transport);
             return true;
-        }
-        catch (LdapException ex)
-        {
-            switch (ex.ErrorCode)
-            {
+        } catch (LdapNativeException ex) {
+            switch (ex.ErrorCode) {
                 case (int)LdapErrorCodes.InvalidCredentials:
                     // If NTLM is blocked via GPO, the server returns the following error message:
                     //   "80090302: LdapErr: DSID-0C090816, comment: AcceptSecurityContext error, data 1, v6673"
                     //   0x80090302 == SEC_E_UNSUPPORTED_FUNCTION
-                    if (ex.ServerErrorMessage.StartsWith(SEC_E_UNSUPPORTED_FUNCTION))
-                    {
+                    if (ex.ServerErrorMessage.StartsWith(SEC_E_UNSUPPORTED_FUNCTION)) {
                         _log.LogDebug("LDAP endpoint '{endpoint}' does not support NTLM", endpoint);
                         return false;
                     }
-                    if (ex.ServerErrorMessage.StartsWith(SEC_E_BAD_BINDINGS))
-                    {
-                        _log.LogDebug("Bad bindings with the LDAPS endpoint '{endpoint}'. Server error: {serverError}", endpoint, ex.ServerErrorMessage);
+
+                    if (ex.ServerErrorMessage.StartsWith(SEC_E_BAD_BINDINGS)) {
+                        _log.LogDebug("Bad bindings with the LDAPS endpoint '{endpoint}'. Server error: {serverError}",
+                            endpoint, ex.ServerErrorMessage);
                         return false;
-                    }
-                    else
-                    {
-                        _log.LogError("Unhandled LDAP InvalidCred error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
+                    } else {
+                        _log.LogError(
+                            "Unhandled LDAP InvalidCred error code during LDAP test: {ex}, Server error: {err}", ex,
+                            ex.ServerErrorMessage);
                         break;
                     }
                 case (int)LdapErrorCodes.StrongAuthRequired:
@@ -204,88 +152,16 @@ private async Task<bool> Authenticate(Uri endpoint, LdapAuthOptions options)
                     _log.LogDebug("LDAP endpoint '{endpoint}' not accessible", endpoint);
                     return false;
                 default:
-                    _log.LogError("Unhandled LdapException error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
+                    _log.LogError("Unhandled LdapException error code during LDAP test: {ex}, Server error: {err}", ex,
+                        ex.ServerErrorMessage);
                     break;
             }
-        }
-        catch (Exception ex)
-        {
+        } catch (Exception ex) {
             _log.LogError("An unhandled error occurred during the LDAP test: {ex}", ex);
         }
 
         return false;
     }
-
-    //private Task<bool> CanAccessWithChannelBindings()
-    //{
-    //    return Task.Run(() =>
-    //    {
-    //        var timeout = TimeSpan.FromSeconds(5);
-
-    //        try
-    //        {
-    //            using var conn = new System.DirectoryServices.Protocols.LdapConnection(
-    //                new LdapDirectoryIdentifier(_ldapEndpoint.Host, _ldapEndpoint.Port, false, false),
-    //                null,
-    //                AuthType.Ntlm
-    //                )
-    //            {
-    //                AuthType = AuthType.Ntlm,
-    //                AutoBind = false,
-    //                Timeout = timeout,
-    //                SessionOptions =
-    //                {
-    //                    SspiFlag = (int)InitiatorContextRequestFlags.ISC_REQ_CONNECTION,
-    //                    RootDseCache = false,
-    //                    Signing = false,
-    //                    Sealing = false,
-    //                    SendTimeout = timeout,
-    //                    VerifyServerCertificate =
-    //                        (connection, certificate) =>
-    //                        {
-    //                            return true;
-    //                        }
-    //                }
-    //            };
-
-    //            conn.Bind();
-
-    //            return true;
-    //        }
-    //        catch (System.DirectoryServices.Protocols.LdapException ex)
-    //        {
-    //            switch (ex.ErrorCode)
-    //            {
-    //                case (int)LdapErrorCodes.InvalidCredentials:
-    //                    // If NTLM is blocked via GPO, the server returns the following error message:
-    //                    //   "80090302: LdapErr: DSID-0C090816, comment: AcceptSecurityContext error, data 1, v6673"
-    //                    //   0x80090302 == SEC_E_UNSUPPORTED_FUNCTION
-    //                    if (ex.ServerErrorMessage.StartsWith(SEC_E_UNSUPPORTED_FUNCTION))
-    //                    {
-    //                        _log.LogDebug("LDAP endpoint '{endpoint}' does not support NTLM", _ldapEndpoint);
-    //                        return false;
-    //                    }
-    //                    else
-    //                    {
-    //                        _log.LogError("Unhandled LDAP InvalidCred error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
-    //                        break;
-    //                    }
-    //                case (int)LdapErrorCodes.ServerDown:
-    //                    _log.LogDebug("LDAP endpoint '{endpoint}' not accessible", _ldapEndpoint);
-    //                    return false;
-    //                default:
-    //                    _log.LogError("Unhandled LdapException error code during LDAP test: {ex}, Server error: {err}", ex, ex.ServerErrorMessage);
-    //                    break;
-    //            }
-    //        }
-    //        catch (Exception ex)
-    //        {
-    //            _log.LogError("An unhandled error occurred during the LDAP test: {ex}", ex);
-    //        }
-
-    //        return false;
-    //    });
-    //}
 }
 
 #nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/EventLogProcessor.cs b/src/CommonLib/Processors/EventLogProcessor.cs
index 30858ec6..97dbe865 100644
--- a/src/CommonLib/Processors/EventLogProcessor.cs
+++ b/src/CommonLib/Processors/EventLogProcessor.cs
@@ -8,38 +8,28 @@
 using SharpHoundCommonLib.OutputTypes;
 using System.Net;
 
-namespace SharpHoundCommonLib.Processors
-{
+namespace SharpHoundCommonLib.Processors {
     [Flags]
-    public enum EventLogCollection
-    {
+    public enum EventLogCollection {
         InboundNtlmSessions,
         DomainControllerNtlmAuth,
     }
 
     public class EventLogProcessor(
-         ILdapUtils utils,
-         ILogger log,
-         string host,
-         string domain,
-         EventLogCollection collectionType,
-         int numDays = 7,
-         int readEventDelayMs = 5,
-         int readEventTimeoutMs = 10000,
-         NetworkCredential? localAdminCredential = null
-         )
-    {
-        private readonly ILdapUtils _utils = utils;
-        private readonly string _host = host;
-        private readonly string _domain = domain;
-        private readonly EventLogCollection _collectType = collectionType;
-        private readonly int _numDays = numDays;
+        ILdapUtils utils,
+        ILogger log,
+        string host,
+        string domain,
+        EventLogCollection collectionType,
+        int numDays = 7,
+        int readEventDelayMs = 5,
+        int readEventTimeoutMs = 10000,
+        NetworkCredential? localAdminCredential = null
+    ) {
         private readonly TimeSpan _readEventTimeoutMs = TimeSpan.FromMilliseconds(readEventTimeoutMs);
-        private readonly int _readDelay = readEventDelayMs;
-        private readonly ILogger _log = log;
-        private NetworkCredential? _localAdminCred = localAdminCredential;
 
         #region Event Log XPath Queries
+
         /* Logic for non-DC machines:
          * - Collect from the Security event log
          * - Get 4624 events (Logon Events) in the last X days
@@ -47,37 +37,37 @@ public class EventLogProcessor(
          * - Filter on either of these:
          *   - NTLMv2 and KeyLength=0 (indicates signing is disabled)
          *   - NTLMV1 (doesn't support signing)
-         *   
+         *
          * Example event XML data:
          * <EventData>
-         *   <Data Name="SubjectUserSid">S-1-0-0</Data> 
-         *   <Data Name="SubjectUserName">-</Data> 
-         *   <Data Name="SubjectDomainName">-</Data> 
-         *   <Data Name="SubjectLogonId">0x0</Data> 
-         *   <Data Name="TargetUserSid">S-1-5-21-3821320868-1508310791-3575676346-1103</Data> 
-         *   <Data Name="TargetUserName">itadmin</Data> 
-         *   <Data Name="TargetDomainName">CORP</Data> 
-         *   <Data Name="TargetLogonId">0x21eacfe9</Data> 
-         *   <Data Name="LogonType">3</Data> 
-         *   <Data Name="LogonProcessName">NtLmSsp</Data> 
-         *   <Data Name="AuthenticationPackageName">NTLM</Data> 
-         *   <Data Name="WorkstationName">WIN11</Data> 
-         *   <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data> 
-         *   <Data Name="TransmittedServices">-</Data> 
-         *   <Data Name="LmPackageName">NTLM V2</Data> 
-         *   <Data Name="KeyLength">0</Data> 
-         *   <Data Name="ProcessId">0x0</Data> 
-         *   <Data Name="ProcessName">-</Data> 
-         *   <Data Name="IpAddress">192.168.230.101</Data> 
-         *   <Data Name="IpPort">54303</Data> 
-         *   <Data Name="ImpersonationLevel">%%1833</Data> 
-         *   <Data Name="RestrictedAdminMode">-</Data> 
-         *   <Data Name="RemoteCredentialGuard">-</Data> 
-         *   <Data Name="TargetOutboundUserName">-</Data> 
-         *   <Data Name="TargetOutboundDomainName">-</Data> 
-         *   <Data Name="VirtualAccount">%%1843</Data> 
-         *   <Data Name="TargetLinkedLogonId">0x0</Data> 
-         *   <Data Name="ElevatedToken">%%1842</Data> 
+         *   <Data Name="SubjectUserSid">S-1-0-0</Data>
+         *   <Data Name="SubjectUserName">-</Data>
+         *   <Data Name="SubjectDomainName">-</Data>
+         *   <Data Name="SubjectLogonId">0x0</Data>
+         *   <Data Name="TargetUserSid">S-1-5-21-3821320868-1508310791-3575676346-1103</Data>
+         *   <Data Name="TargetUserName">itadmin</Data>
+         *   <Data Name="TargetDomainName">CORP</Data>
+         *   <Data Name="TargetLogonId">0x21eacfe9</Data>
+         *   <Data Name="LogonType">3</Data>
+         *   <Data Name="LogonProcessName">NtLmSsp</Data>
+         *   <Data Name="AuthenticationPackageName">NTLM</Data>
+         *   <Data Name="WorkstationName">WIN11</Data>
+         *   <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
+         *   <Data Name="TransmittedServices">-</Data>
+         *   <Data Name="LmPackageName">NTLM V2</Data>
+         *   <Data Name="KeyLength">0</Data>
+         *   <Data Name="ProcessId">0x0</Data>
+         *   <Data Name="ProcessName">-</Data>
+         *   <Data Name="IpAddress">192.168.230.101</Data>
+         *   <Data Name="IpPort">54303</Data>
+         *   <Data Name="ImpersonationLevel">%%1833</Data>
+         *   <Data Name="RestrictedAdminMode">-</Data>
+         *   <Data Name="RemoteCredentialGuard">-</Data>
+         *   <Data Name="TargetOutboundUserName">-</Data>
+         *   <Data Name="TargetOutboundDomainName">-</Data>
+         *   <Data Name="VirtualAccount">%%1843</Data>
+         *   <Data Name="TargetLinkedLogonId">0x0</Data>
+         *   <Data Name="ElevatedToken">%%1842</Data>
          * </EventData>
          */
         private readonly string _noSigningXpathEvents = @"
@@ -111,14 +101,14 @@ public class EventLogProcessor(
          * - Get 4776 events (Logon Events) in the last X days. This event is only generated for NTLM auth.
          * - Filter on:
          *      Status=0 (Successful auth)
-         *   
+         *
          * - Example event XML data:
           <Event>
             <EventData>
-              <Data Name="PackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data> 
-              <Data Name="TargetUserName">lowpriv</Data> 
-              <Data Name="Workstation">DESKTOP-P8UDQ3B</Data> 
-              <Data Name="Status">0x0</Data> 
+              <Data Name="PackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data>
+              <Data Name="TargetUserName">lowpriv</Data>
+              <Data Name="Workstation">DESKTOP-P8UDQ3B</Data>
+              <Data Name="Status">0x0</Data>
             </EventData>
           </Event>
         */
@@ -141,100 +131,84 @@ public class EventLogProcessor(
   </Query>
 </QueryList>
 ";
+
         #endregion // Event Log XPath Queries
-        public ApiResult<NtlmSessionResult> ReadEvents()
-        {
+
+        public ApiResult<NtlmSessionResult> ReadEvents() {
             var result = new NtlmSessionResult();
             string query;
-            var timeFilterMs = TimeSpan.FromDays(_numDays).TotalMilliseconds;
+            var timeFilterMs = TimeSpan.FromDays(numDays).TotalMilliseconds;
 
-            switch (_collectType)
-            {
+            switch (collectionType) {
                 case EventLogCollection.DomainControllerNtlmAuth:
-                    query = String.Format(_dcNtlmAuthXpathEvents, timeFilterMs);
+                    query = string.Format(_dcNtlmAuthXpathEvents, timeFilterMs);
                     break;
                 case EventLogCollection.InboundNtlmSessions:
-                    query = String.Format(_noSigningXpathEvents, timeFilterMs);
+                    query = string.Format(_noSigningXpathEvents, timeFilterMs);
                     break;
                 default:
                     throw new InvalidOperationException("Invalid option");
             }
 
 
-            try
-            {
+            try {
                 var sw = Stopwatch.StartNew();
                 result.Sessions = CollectEvents(query);
                 sw.Stop();
 
                 result.CollectionDurationMs = sw.ElapsedMilliseconds;
 
-                _log.LogDebug($"Processed {result.Sessions.Count} event logs in {sw.Elapsed}. Event Log Collection Type: {_collectType}");
+                log.LogDebug(
+                    $"Processed {result.Sessions.Count} event logs in {sw.Elapsed}. Event Log Collection Type: {collectionType}");
 
                 return ApiResult<NtlmSessionResult>.CreateSuccess(result);
-            }
-            catch (UnauthorizedAccessException)
-            {
+            } catch (UnauthorizedAccessException) {
                 return ApiResult<NtlmSessionResult>.CreateError("Access Denied");
-            }
-            catch (Exception ex)
-            {
+            } catch (Exception ex) {
                 return ApiResult<NtlmSessionResult>.CreateError($"Unexpected exception: {ex}");
             }
         }
 
-        private List<NtlmSession> CollectEvents(string query)
-        {
+        private List<NtlmSession> CollectEvents(string query) {
             var ntlmSessions = new List<NtlmSession>();
             var dupCheck = new HashSet<string>();
 
-            using EventLogReader logReader = GetEventLogReader(_host, "Security", query);
-
-            int count = 0;
+            using var logReader = GetEventLogReader(host, "Security", query);
 
             for (var evnt = logReader.ReadEvent(_readEventTimeoutMs);
-                evnt != null;
-                evnt = logReader.ReadEvent())
-            {
-                count++;
+                 evnt != null;
+                 evnt = logReader.ReadEvent()) {
                 var eventId = (SecurityLogId)evnt.Id;
                 var parsed = ProcessSecurityEvent(evnt, eventId).Result;
                 // Don't return another if we've already got the info
-                if (dupCheck.Add(GetHashString(parsed)))
-                {
+                if (dupCheck.Add(GetHashString(parsed))) {
                     ntlmSessions.Add(parsed);
                 }
 
-                if (_readDelay > 0)
-                {
-                    System.Threading.Thread.Sleep(_readDelay);
+                if (readEventDelayMs > 0) {
+                    System.Threading.Thread.Sleep(readEventDelayMs);
                 }
             }
 
             return ntlmSessions;
         }
 
-        private string GetHashString(NtlmSession s)
-        {
+        private string GetHashString(NtlmSession s) {
             return $"{s.AccountDomain}{s.AccountName}{s.AccountSid}{s.PackageName}{s.SourceIp}{s.SourceHost}";
         }
 
-        private async Task<string?> ResolveNameToSid(string username, string domain)
-        {
-            var (matchSuccess, sids) = await _utils.GetGlobalCatalogMatches(username, domain);
-            if (matchSuccess)
-            {
-                if (sids.Length > 1)
-                {
-                    _log.LogError("More than one SID was returned for the user '{user}'. SIDs: {sids}", username, string.Join(",", sids));
+        private async Task<string?> ResolveNameToSid(string username, string domain) {
+            var (matchSuccess, sids) = await utils.GetGlobalCatalogMatches(username, domain);
+            if (matchSuccess) {
+                if (sids.Length > 1) {
+                    log.LogError("More than one SID was returned for the user '{user}'. SIDs: {sids}", username,
+                        string.Join(",", sids));
                     return null;
                 }
 
                 return sids[0];
-            }
-            else
-            {
-                var (success, principal) = await _utils.ResolveAccountName(username, domain);
+            } else {
+                var (success, principal) = await utils.ResolveAccountName(username, domain);
 
                 if (!success) return null;
 
@@ -242,26 +216,24 @@ private string GetHashString(NtlmSession s)
             }
         }
 
-        private async Task<NtlmSession> ProcessSecurityEvent(EventRecord evnt, SecurityLogId eventId)
-        {
+        private async Task<NtlmSession> ProcessSecurityEvent(EventRecord evnt, SecurityLogId eventId) {
             NtlmSession session;
 
-            switch (eventId)
-            {
+            switch (eventId) {
                 case SecurityLogId.Logon:
-                    session = NtlmSession.FromLogonEvent(_host, evnt);
+                    session = NtlmSession.FromLogonEvent(evnt);
                     return session;
 
                 case SecurityLogId.ValidateCredential:
 
-                    session = NtlmSession.FromValidateCredentialEvent(_host, evnt);
+                    session = NtlmSession.FromValidateCredentialEvent(evnt);
 
                     // The Validate Credential event does not return the domain or account sid
                     // so try and find those
-                    var sid = await ResolveNameToSid(session.AccountName, _domain);
+                    var sid = await ResolveNameToSid(session.AccountName, domain);
 
                     session.AccountSid = sid?.ToString();
-                    session.AccountDomain = _domain;
+                    session.AccountDomain = domain;
 
                     return session;
 
@@ -271,15 +243,11 @@ private async Task<NtlmSession> ProcessSecurityEvent(EventRecord evnt, SecurityL
         }
 
 
-        private EventLogReader GetEventLogReader(string host, string path, string query)
-        {
+        private EventLogReader GetEventLogReader(string host, string path, string query) {
             var eventsQuery = new EventLogQuery(path, PathType.LogName, query) { ReverseDirection = true };
-            EventLogSession session;
-            if (!string.IsNullOrEmpty(host))
-            {
-
-                if (_localAdminCred == null)
-                {
+            if (!string.IsNullOrEmpty(host)) {
+                EventLogSession session;
+                if (localAdminCredential == null) {
                     session = new EventLogSession(
                         host,
                         null,
@@ -287,14 +255,12 @@ private EventLogReader GetEventLogReader(string host, string path, string query)
                         null,
                         SessionAuthentication.Negotiate
                     );
-                }
-                else
-                {
+                } else {
                     session = new EventLogSession(
                         host,
-                        _localAdminCred.Domain,
-                        _localAdminCred.UserName,
-                        _localAdminCred.SecurePassword,
+                        localAdminCredential.Domain,
+                        localAdminCredential.UserName,
+                        localAdminCredential.SecurePassword,
                         SessionAuthentication.Negotiate
                     );
                 }
@@ -307,26 +273,24 @@ private EventLogReader GetEventLogReader(string host, string path, string query)
         }
     }
 
-    public enum SecurityLogId
-    {
+    public enum SecurityLogId {
         Logon = 4624,
         ValidateCredential = 4776
     }
 
-    public enum SecurityLogLogonType : uint
-    {
-        Interactive = 2,        // logging on interactively.
-        Network,                // logging using a network.
-        Batch,                  // logon for a batch process.
-        Service,                // logon for a service account.
-        Proxy,                  // Not supported.
-        Unlock,                 // Tattempt to unlock a workstation.
-        NetworkCleartext,       // network logon with cleartext credentials
-        NewCredentials,         // caller can clone its current token and specify new credentials for outbound connections
-        RemoteInteractive,      // terminal server session that is both remote and interactive
-        CachedInteractive,      // attempt to use the cached credentials without going out across the network
-        CachedRemoteInteractive,// same as RemoteInteractive, except used internally for auditing purposes
-        CachedUnlock            // attempt to unlock a workstation
+    public enum SecurityLogLogonType : uint {
+        Interactive = 2, // logging on interactively.
+        Network, // logging using a network.
+        Batch, // logon for a batch process.
+        Service, // logon for a service account.
+        Proxy, // Not supported.
+        Unlock, // Tattempt to unlock a workstation.
+        NetworkCleartext, // network logon with cleartext credentials
+        NewCredentials, // caller can clone its current token and specify new credentials for outbound connections
+        RemoteInteractive, // terminal server session that is both remote and interactive
+        CachedInteractive, // attempt to use the cached credentials without going out across the network
+        CachedRemoteInteractive, // same as RemoteInteractive, except used internally for auditing purposes
+        CachedUnlock // attempt to unlock a workstation
     }
 }
 #nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/SmbProcessor.cs b/src/CommonLib/Processors/SmbProcessor.cs
index 0bec2b42..41692493 100644
--- a/src/CommonLib/Processors/SmbProcessor.cs
+++ b/src/CommonLib/Processors/SmbProcessor.cs
@@ -8,22 +8,16 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace SharpHoundCommonLib.Processors
-{
-    public class SmbProcessor(int timeoutMs, ILogger? log = null)
-    {
+namespace SharpHoundCommonLib.Processors {
+    public class SmbProcessor(int timeoutMs, ILogger? log = null) {
         private readonly ILogger _log = log ?? Logging.LogProvider.CreateLogger("SmbProcessor");
-        int _timeoutMs = timeoutMs;
 
-        public async Task<ApiResult<SmbInfo>> Scan(string host)
-        {
+        public async Task<ApiResult<SmbInfo>> Scan(string host) {
             var scanner = new SmbScanner();
-            var result = await scanner.Scan(host, 445, _timeoutMs);
+            var result = await scanner.Scan(host, 445, timeoutMs);
 
-            if (result.Success && result.Info != null)
-            {
-                var info = new SmbInfo()
-                {
+            if (result.Success && result.Info != null) {
+                var info = new SmbInfo() {
                     SigningEnabled = result.Info.SmbSigning,
                     OsVersion = result.Info.OsVersion,
                     OsBuild = result.Info.OsBuildNumber.ToString(),
@@ -31,27 +25,21 @@ public async Task<ApiResult<SmbInfo>> Scan(string host)
                 };
 
                 return ApiResult<SmbInfo>.CreateSuccess(info);
-            }
-            else
-            {
+            } else {
                 return ApiResult<SmbInfo>.CreateError(result.ErrorMessage ?? "Unknown error");
             }
         }
-
     }
 
 
-    public enum SmbVersion
-    {
+    public enum SmbVersion {
         Unknown,
         SMBv1,
         SMBv2
     }
 
-    public class SmbScanResult
-    {
-        public SmbScanResult(string host)
-        {
+    public class SmbScanResult {
+        public SmbScanResult(string host) {
             Host = host;
         }
 
@@ -62,18 +50,13 @@ public SmbScanResult(string host)
         public SmbVersion SmbVersion { get; set; }
     }
 
-    public class SMBPacket
-    {
-        public SMBPacket(bool signingEnabled)
-        {
-            if (signingEnabled)
-            {
+    public class SMBPacket {
+        public SMBPacket(bool signingEnabled) {
+            if (signingEnabled) {
                 SMB_Signing = signingEnabled;
                 SMB_Session_Key_Length = [0x00, 0x00];
                 SMB_Negotiate_Flags = [0x15, 0x82, 0x08, 0xa0];
-            }
-            else
-            {
+            } else {
                 SMB_Signing = signingEnabled;
                 SMB_Session_Key_Length = [0x00, 0x00];
                 SMB_Negotiate_Flags = [0x05, 0x80, 0x08, 0xa0];
@@ -95,8 +78,7 @@ public SMBPacket(bool signingEnabled)
         public byte[]? Session_Key { get; set; }
     }
 
-    public class NTLMInfo
-    {
+    public class NTLMInfo {
         public string? NativeOs { get; set; }
         public string? NativeLanManager { get; set; }
         public string? NbtDomainName { get; set; }
@@ -110,115 +92,107 @@ public class NTLMInfo
         public DateTime TimeStamp { get; set; }
         public bool SmbSigning { get; set; }
 
-        public static NTLMInfo FromBytes(byte[] buf)
-        {
-            NTLMInfo ntlminfo = new NTLMInfo();
-            string NTLMSSP_Negotiate = BitConverter.ToString(buf).Replace("-", "");
+        public static NTLMInfo FromBytes(byte[] buf) {
+            var ntlminfo = new NTLMInfo();
+            var ntlmsspNegotiate = BitConverter.ToString(buf).Replace("-", "");
             int off;
-            off = NTLMSSP_Negotiate.IndexOf("4E544C4D53535000") / 2;
-            int NTLMSSP_Negotiate_Len = (NTLMSSP_Negotiate.Length - NTLMSSP_Negotiate.IndexOf("4E544C4D53535000")) / 2;
-            byte[] ntlm = new byte[NTLMSSP_Negotiate_Len];
-            Array.Copy(buf, off, ntlm, 0, NTLMSSP_Negotiate_Len);
+            off = ntlmsspNegotiate.IndexOf("4E544C4D53535000", StringComparison.Ordinal) / 2;
+            var ntlmsspNegotiateLen = (ntlmsspNegotiate.Length - ntlmsspNegotiate.IndexOf("4E544C4D53535000", StringComparison.Ordinal)) / 2;
+            var ntlm = new byte[ntlmsspNegotiateLen];
+            Array.Copy(buf, off, ntlm, 0, ntlmsspNegotiateLen);
 
-            NTLMSSP_Negotiate_Len = BitConverter.ToInt16(ntlm, 0xc);
+            ntlmsspNegotiateLen = BitConverter.ToInt16(ntlm, 0xc);
             off = BitConverter.ToInt16(ntlm, 0x10);
             ntlminfo.OsBuildNumber = BitConverter.ToInt16(ntlm, off - 6);
             ntlminfo.OsVersion = $@"{ntlm[off - 8]}.{ntlm[off - 7]}";
 
-            off += NTLMSSP_Negotiate_Len;
+            off += ntlmsspNegotiateLen;
             int type = BitConverter.ToInt16(ntlm, off);
 
-            while (type != 0)
-            {
+            while (type != 0) {
                 off += 2;
-                NTLMSSP_Negotiate_Len = BitConverter.ToInt16(ntlm, off);
+                ntlmsspNegotiateLen = BitConverter.ToInt16(ntlm, off);
                 off += 2;
-                switch (type)
-                {
+                switch (type) {
                     case 1:
-                        ntlminfo.NbtComputer = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        ntlminfo.NbtComputer = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
                         break;
                     case 2:
-                        ntlminfo.NbtDomainName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        ntlminfo.NbtDomainName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
                         break;
                     case 3:
-                        ntlminfo.DnsComputerName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        ntlminfo.DnsComputerName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
                         break;
                     case 4:
-                        ntlminfo.DnsDomainName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        ntlminfo.DnsDomainName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
                         break;
                     case 5:
-                        ntlminfo.DnsTreeName = Encoding.Unicode.GetString(ntlm, off, NTLMSSP_Negotiate_Len);
+                        ntlminfo.DnsTreeName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
                         break;
                     case 7:
                         ntlminfo.TimeStamp = DateTime.FromFileTime(BitConverter.ToInt64(ntlm, off));
                         break;
                 }
-                off += NTLMSSP_Negotiate_Len;
+
+                off += ntlmsspNegotiateLen;
                 type = BitConverter.ToInt16(ntlm, off);
             }
 
             return ntlminfo;
         }
     }
-    
-    public class SmbScanner
-    { 
-        public async Task<SmbScanResult> Scan(string host, int port, int timeoutMs = 10000)
-        {
-            var result = new SmbScanResult(host)
-            {
+
+    public class SmbScanner {
+        public async Task<SmbScanResult> Scan(string host, int port, int timeoutMs = 10000) {
+            var result = new SmbScanResult(host) {
                 Success = false,
                 SmbVersion = SmbVersion.Unknown
             };
 
-            var SMBClientReceive = new byte[2048];
-            TcpClient? SMB_Client = null;
-            NetworkStream? SMB_Client_Stream = null;
+            TcpClient? smbClient = null;
 
-            try
-            {
-                SMB_Client = await ConnectAsync(host, port, timeoutMs);
+            try {
+                smbClient = await ConnectAsync(host, port, timeoutMs);
 
-                if (!SMB_Client.Connected)
-                {
+                if (!smbClient.Connected) {
                     result.ErrorMessage = "SMBInfo can't connect!";
                     return result;
                 }
 
-                SMB_Client_Stream = SMB_Client.GetStream();
+                var smbClientStream = smbClient.GetStream();
 
                 using var operationCts = new System.Threading.CancellationTokenSource(timeoutMs);
 
-                if (port == 139)
-                {
-                    await SendStreamAsync(SMB_Client_Stream, GetNtbiosTCPData(), operationCts.Token);
+                if (port == 139) {
+                    await SendStreamAsync(smbClientStream, GetNtbiosTCPData(), operationCts.Token);
                 }
 
-                try
-                {
+                byte[] smbClientReceive;
+                try {
                     // Try SMBv1 first
-                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNegotiateSMBv1Data(), operationCts.Token);
+                    smbClientReceive =
+                        await SendStreamAsync(smbClientStream, GetNegotiateSMBv1Data(), operationCts.Token);
 
-                    bool singingEnabled = BitConverter.ToString(SMBClientReceive).Replace("-", "").Substring(78, 2) == "0F";
+                    var singingEnabled = BitConverter.ToString(smbClientReceive).Replace("-", "").Substring(78, 2) ==
+                                         "0F";
 
-                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNTLMSSPNegotiatev1Data(), operationCts.Token);
+                    smbClientReceive = await SendStreamAsync(smbClientStream, GetNTLMSSPNegotiatev1Data(),
+                        operationCts.Token);
 
-                    int len = BitConverter.ToInt16(SMBClientReceive, 43);
+                    int len = BitConverter.ToInt16(smbClientReceive, 43);
                     string[]? ss = null;
 
-                    if (Encoding.Unicode.GetString(SMBClientReceive, len + 47, SMBClientReceive.Length - len - 47).Split('\0')[0].ToLower().Contains("windows"))
-                    {
-                        ss = Encoding.Unicode.GetString(SMBClientReceive, len + 47, SMBClientReceive.Length - len - 47).Split('\0');
-                    }
-                    else
-                    {
-                        ss = Encoding.Unicode.GetString(SMBClientReceive, len + 48, SMBClientReceive.Length - len - 48).Split('\0');
+                    if (Encoding.Unicode.GetString(smbClientReceive, len + 47, smbClientReceive.Length - len - 47)
+                        .Split('\0')[0].ToLower().Contains("windows")) {
+                        ss = Encoding.Unicode.GetString(smbClientReceive, len + 47, smbClientReceive.Length - len - 47)
+                            .Split('\0');
+                    } else {
+                        ss = Encoding.Unicode.GetString(smbClientReceive, len + 48, smbClientReceive.Length - len - 48)
+                            .Split('\0');
                     }
 
-                    if (ss.Length >= 2)
-                    {
-                        result.Info = NTLMInfo.FromBytes(SMBClientReceive);
+                    if (ss.Length >= 2) {
+                        result.Info = NTLMInfo.FromBytes(smbClientReceive);
                         result.Info.NativeOs = ss[0];
                         result.Info.NativeLanManager = ss[1];
                         result.Info.SmbSigning = singingEnabled;
@@ -226,107 +200,93 @@ public async Task<SmbScanResult> Scan(string host, int port, int timeoutMs = 100
 
                     result.SmbVersion = SmbVersion.SMBv1;
                     result.Success = true;
-                }
-                catch
-                {
+                } catch {
                     // If SMBv1 fails, try SMBv2 with a new connection
-                    if (SMB_Client != null)
-                    {
-                        SMB_Client.Close();
+                    if (smbClient != null) {
+                        smbClient.Close();
                     }
 
-                    SMB_Client = await ConnectAsync(host, port, 10000);
-                    SMB_Client_Stream = SMB_Client.GetStream();
+                    smbClient = await ConnectAsync(host, port, 10000);
+                    smbClientStream = smbClient.GetStream();
 
-                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNegotiateSMBv2Data1(), operationCts.Token);
-                    if (BitConverter.ToString([SMBClientReceive[4], SMBClientReceive[5], SMBClientReceive[6], SMBClientReceive[7]]).ToLower() == "ff-53-4d-42")
-                    {
+                    smbClientReceive =
+                        await SendStreamAsync(smbClientStream, GetNegotiateSMBv2Data1(), operationCts.Token);
+                    if (BitConverter.ToString([
+                            smbClientReceive[4], smbClientReceive[5], smbClientReceive[6], smbClientReceive[7]
+                        ]).ToLower() == "ff-53-4d-42") {
                         result.ErrorMessage = "Could not connect with SMBv2";
                         return result;
                     }
 
-                    bool signingEnabled = BitConverter.ToString(new byte[] { SMBClientReceive[70] }) == "03";
-                    var SMBPackets = new SMBPacket(signingEnabled);
-                    
-                    
+                    var signingEnabled = BitConverter.ToString(new byte[] { smbClientReceive[70] }) == "03";
+                    var smbPackets = new SMBPacket(signingEnabled);
+
 
-                    await SendStreamAsync(SMB_Client_Stream, GetNegotiateSMBv2Data2(), operationCts.Token);
-                    SMBClientReceive = await SendStreamAsync(SMB_Client_Stream, GetNTLMSSPNegotiatev2Data(SMBPackets), operationCts.Token);
+                    await SendStreamAsync(smbClientStream, GetNegotiateSMBv2Data2(), operationCts.Token);
+                    smbClientReceive = await SendStreamAsync(smbClientStream, GetNTLMSSPNegotiatev2Data(smbPackets),
+                        operationCts.Token);
 
-                    result.Info = NTLMInfo.FromBytes(SMBClientReceive);
-                    result.Info.SmbSigning = SMBPackets.SMB_Signing;
+                    result.Info = NTLMInfo.FromBytes(smbClientReceive);
+                    result.Info.SmbSigning = smbPackets.SMB_Signing;
 
                     result.SmbVersion = SmbVersion.SMBv2;
                     result.Success = true;
                 }
-            }
-            catch (Exception ex)
-            {
+            } catch (Exception ex) {
                 result.ErrorMessage = ex.Message;
-            }
-            finally
-            {
-                SMB_Client?.Close();
+            } finally {
+                smbClient?.Close();
             }
 
             return result;
         }
 
-        private static async Task<TcpClient> ConnectAsync(string host, int port, int timeoutMs)
-        {
+        private static async Task<TcpClient> ConnectAsync(string host, int port, int timeoutMs) {
             using var connectCts = new System.Threading.CancellationTokenSource(timeoutMs + 100);
             var client = new TcpClient();
 
             client.Client.SendTimeout = timeoutMs;
             client.Client.ReceiveTimeout = timeoutMs;
 
-            try
-            {
+            try {
                 var connectTask = client.ConnectAsync(host, port);
-                if (await Task.WhenAny(connectTask, Task.Delay(timeoutMs, connectCts.Token)) != connectTask)
-                {
+                if (await Task.WhenAny(connectTask, Task.Delay(timeoutMs, connectCts.Token)) != connectTask) {
                     client.Close();
                     throw new TimeoutException($"Connection to {host}:{port} timed out after {timeoutMs}ms");
                 }
 
                 await connectTask;
                 return client;
-            }
-            catch (Exception ex) when (ex is SocketException || ex is TimeoutException)
-            {
+            } catch (Exception ex) when (ex is SocketException || ex is TimeoutException) {
                 client.Close();
                 throw new TimeoutException($"Connection to {host}:{port} timed out after {timeoutMs}ms", ex);
-            }
-            catch
-            {
+            } catch {
                 client.Close();
                 throw;
             }
         }
 
-        private static async Task<byte[]> SendStreamAsync(NetworkStream stream, byte[] BytesToSend, System.Threading.CancellationToken cancellationToken)
-        {
-            byte[] BytesReceived = new byte[2048];
+        private static async Task<byte[]> SendStreamAsync(NetworkStream stream, byte[] BytesToSend,
+            System.Threading.CancellationToken cancellationToken) {
+            var bytesReceived = new byte[2048];
             await stream.WriteAsync(BytesToSend, 0, BytesToSend.Length, cancellationToken);
             await stream.FlushAsync(cancellationToken);
-            await stream.ReadAsync(BytesReceived, 0, BytesReceived.Length, cancellationToken);
-            return BytesReceived;
+            await stream.ReadAsync(bytesReceived, 0, bytesReceived.Length, cancellationToken);
+            return bytesReceived;
         }
 
-        private static byte[] GetNtbiosTCPData()
-        {
-            byte[] NtbiosTCPData = {
-                0x81,0x00,0x00,0x44,0x20,0x43,0x4b,0x46,0x44,0x45,0x4e,0x45,0x43,0x46,0x44,0x45
-                ,0x46,0x46,0x43,0x46,0x47,0x45,0x46,0x46,0x43,0x43,0x41,0x43,0x41,0x43,0x41,0x43
-                ,0x41,0x43,0x41,0x43,0x41,0x00,0x20,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43
-                ,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43
-                ,0x41,0x43,0x41,0x43,0x41,0x41,0x41,0x00
+        private static byte[] GetNtbiosTCPData() {
+            byte[] NetbiosTCPData = {
+                0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46, 0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45, 0x46,
+                0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46, 0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
+                0x41, 0x43, 0x41, 0x00, 0x20, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41,
+                0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
+                0x41, 0x41, 0x41, 0x00
             };
-            return NtbiosTCPData;
+            return NetbiosTCPData;
         }
 
-        private static byte[] GetNegotiateSMBv1Data()
-        {
+        private static byte[] GetNegotiateSMBv1Data() {
             byte[] NegotiateSMBv1Data = {
                 0x00, 0x00, 0x00, 0x85, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xC8,
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
@@ -341,8 +301,7 @@ private static byte[] GetNegotiateSMBv1Data()
             return NegotiateSMBv1Data;
         }
 
-        private static byte[] GetNTLMSSPNegotiatev1Data()
-        {
+        private static byte[] GetNTLMSSPNegotiatev1Data() {
             byte[] NTLMSSPNegotiatev1Data = {
                 0x00, 0x00, 0x01, 0x0A, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8,
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
@@ -354,7 +313,7 @@ private static byte[] GetNTLMSSPNegotiatev1Data()
                 0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0x00, 0x05, 0x02, 0xCE, 0x0E, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00,
                 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
-                0x76, 0x00,0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,
+                0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,
                 0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00,
                 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00,
                 0x50, 0x00, 0x61, 0x00, 0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00,
@@ -366,8 +325,7 @@ private static byte[] GetNTLMSSPNegotiatev1Data()
             return NTLMSSPNegotiatev1Data;
         }
 
-        private static byte[] GetNegotiateSMBv2Data1()
-        {
+        private static byte[] GetNegotiateSMBv2Data1() {
             byte[] NegotiateSMBData = {
                 0x00, 0x00, 0x00, 0x45, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00,
                 0x00, 0x00, 0x00, 0x18, 0x01, 0x48, 0x00, 0x00, 0x00, 0x00,
@@ -381,8 +339,7 @@ private static byte[] GetNegotiateSMBv2Data1()
             return NegotiateSMBData;
         }
 
-        private static byte[] GetNegotiateSMBv2Data2()
-        {
+        private static byte[] GetNegotiateSMBv2Data2() {
             byte[] NegotiateSMB2Data = {
                 0x00, 0x00, 0x00, 0x68, 0xFE, 0x53, 0x4D, 0x42, 0x40, 0x00,
                 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -399,8 +356,7 @@ private static byte[] GetNegotiateSMBv2Data2()
             return NegotiateSMB2Data;
         }
 
-        private static byte[] GetNTLMSSPNegotiatev2Data(SMBPacket SMBPackets)
-        {
+        private static byte[] GetNTLMSSPNegotiatev2Data(SMBPacket SMBPackets) {
             byte[] NTLMSSPNegotiateData = {
                 0x00, 0x00, 0x00, 0x9A, 0xFE, 0x53, 0x4D, 0x42, 0x40, 0x00,
                 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
diff --git a/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs b/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
index c7cb74b0..7a849618 100644
--- a/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
+++ b/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
@@ -9,25 +9,21 @@
 using SharpHoundRPC.Shared;
 using SharpHoundRPC.Wrappers;
 
-namespace SharpHoundCommonLib.Processors
-{
-    public class UserRightsAssignmentProcessor
-    {
+namespace SharpHoundCommonLib.Processors {
+    public class UserRightsAssignmentProcessor {
         public delegate Task ComputerStatusDelegate(CSVComputerStatus status);
 
         private readonly ILogger _log;
         private readonly ILdapUtils _utils;
 
-        public UserRightsAssignmentProcessor(ILdapUtils utils, ILogger log = null)
-        {
+        public UserRightsAssignmentProcessor(ILdapUtils utils, ILogger log = null) {
             _utils = utils;
             _log = log ?? Logging.LogProvider.CreateLogger("UserRightsAssignmentProcessor");
         }
 
         public event ComputerStatusDelegate ComputerStatusEvent;
 
-        public virtual SharpHoundRPC.Result<ILSAPolicy> OpenLSAPolicy(string computerName)
-        {
+        public virtual SharpHoundRPC.Result<ILSAPolicy> OpenLSAPolicy(string computerName) {
             var result = LSAPolicy.OpenPolicy(computerName);
             if (result.IsFailed) return SharpHoundRPC.Result<ILSAPolicy>.Fail(result.SError);
 
@@ -35,8 +31,7 @@ public virtual SharpHoundRPC.Result<ILSAPolicy> OpenLSAPolicy(string computerNam
         }
 
         public IAsyncEnumerable<UserRightsAssignmentAPIResult> GetUserRightsAssignments(ResolvedSearchResult result,
-            string[] desiredPrivileges = null)
-        {
+            string[] desiredPrivileges = null) {
             return GetUserRightsAssignments(result.DisplayName, result.ObjectId, result.Domain,
                 result.IsDomainController, desiredPrivileges);
         }
@@ -52,18 +47,17 @@ public IAsyncEnumerable<UserRightsAssignmentAPIResult> GetUserRightsAssignments(
         /// <param name="timeout"></param>
         /// <returns></returns>
         public async IAsyncEnumerable<UserRightsAssignmentAPIResult> GetUserRightsAssignments(string computerName,
-            string computerObjectId, string computerDomain, bool isDomainController, string[] desiredPrivileges = null, TimeSpan timeout = default)
-        {
+            string computerObjectId, string computerDomain, bool isDomainController, string[] desiredPrivileges = null,
+            TimeSpan timeout = default) {
             if (timeout == default) {
                 timeout = TimeSpan.FromMinutes(2);
             }
+
             var policyOpenResult = await Task.Run(() => OpenLSAPolicy(computerName)).TimeoutAfter(timeout);
-            if (!policyOpenResult.IsSuccess)
-            {
+            if (!policyOpenResult.IsSuccess) {
                 _log.LogDebug("LSAOpenPolicy failed on {ComputerName} with status {Status}", computerName,
                     policyOpenResult.Error);
-                await SendComputerStatus(new CSVComputerStatus
-                {
+                await SendComputerStatus(new CSVComputerStatus {
                     Task = "LSAOpenPolicy",
                     ComputerName = computerName,
                     Status = policyOpenResult.Error
@@ -75,15 +69,13 @@ await SendComputerStatus(new CSVComputerStatus
             desiredPrivileges ??= LSAPrivileges.DesiredPrivileges;
 
             SecurityIdentifier machineSid;
-            if (!Cache.GetMachineSid(computerObjectId, out var temp))
-            {
-                var getMachineSidResult = await Task.Run(() => server.GetLocalDomainInformation()).TimeoutAfter(timeout);
-                if (getMachineSidResult.IsFailed)
-                {
+            if (!Cache.GetMachineSid(computerObjectId, out var temp)) {
+                var getMachineSidResult =
+                    await Task.Run(() => server.GetLocalDomainInformation()).TimeoutAfter(timeout);
+                if (getMachineSidResult.IsFailed) {
                     _log.LogWarning("Failed to get machine sid for {Server}: {Status}. Abandoning URA collection",
                         computerName, getMachineSidResult.SError);
-                    await SendComputerStatus(new CSVComputerStatus
-                    {
+                    await SendComputerStatus(new CSVComputerStatus {
                         ComputerName = computerName,
                         Status = getMachineSidResult.SError,
                         Task = "LSAGetMachineSID"
@@ -93,30 +85,26 @@ await SendComputerStatus(new CSVComputerStatus
 
                 machineSid = new SecurityIdentifier(getMachineSidResult.Value.Sid);
                 Cache.AddMachineSid(computerObjectId, getMachineSidResult.Value.Sid);
-            }
-            else
-            {
+            } else {
                 machineSid = new SecurityIdentifier(temp);
             }
 
-            foreach (var privilege in desiredPrivileges)
-            {
-                _log.LogTrace("Getting principals for privilege {Priv} on computer {ComputerName}", privilege, computerName);
-                var ret = new UserRightsAssignmentAPIResult
-                {
+            foreach (var privilege in desiredPrivileges) {
+                _log.LogTrace("Getting principals for privilege {Priv} on computer {ComputerName}", privilege,
+                    computerName);
+                var ret = new UserRightsAssignmentAPIResult {
                     Collected = false,
                     Privilege = privilege
                 };
 
                 //Ask for all principals with the specified privilege. 
-                var enumerateAccountsResult = await Task.Run(() => server.GetResolvedPrincipalsWithPrivilege(privilege)).TimeoutAfter(timeout);
-                if (enumerateAccountsResult.IsFailed)
-                {
+                var enumerateAccountsResult = await Task.Run(() => server.GetResolvedPrincipalsWithPrivilege(privilege))
+                    .TimeoutAfter(timeout);
+                if (enumerateAccountsResult.IsFailed) {
                     _log.LogDebug(
                         "LSAEnumerateAccountsWithUserRight failed on {ComputerName} with status {Status} for privilege {Privilege}",
                         computerName, policyOpenResult.Error, privilege);
-                    await SendComputerStatus(new CSVComputerStatus
-                    {
+                    await SendComputerStatus(new CSVComputerStatus {
                         ComputerName = computerName,
                         Status = enumerateAccountsResult.SError,
                         Task = "LSAEnumerateAccountsWithUserRight"
@@ -127,11 +115,11 @@ await SendComputerStatus(new CSVComputerStatus
                     if (enumerateAccountsResult.IsTimeout) {
                         yield break;
                     }
+
                     continue;
                 }
 
-                await SendComputerStatus(new CSVComputerStatus
-                {
+                await SendComputerStatus(new CSVComputerStatus {
                     ComputerName = computerName,
                     Status = CSVComputerStatus.StatusSuccess,
                     Task = "LSAEnumerateAccountsWithUserRight"
@@ -140,16 +128,16 @@ await SendComputerStatus(new CSVComputerStatus
                 var resolved = new List<TypedPrincipal>();
                 var names = new List<NamedPrincipal>();
 
-                foreach (var value in enumerateAccountsResult.Value)
-                {
+                foreach (var value in enumerateAccountsResult.Value) {
                     var (sid, name, use, _) = value;
-                    _log.LogTrace("Got principal {Name} with sid {SID} and use {Use} for privilege {Priv} on computer {ComputerName}", name, sid.Value, use, privilege, computerName);
+                    _log.LogTrace(
+                        "Got principal {Name} with sid {SID} and use {Use} for privilege {Priv} on computer {ComputerName}",
+                        name, sid.Value, use, privilege, computerName);
                     //Check if our sid is filtered
                     if (Helpers.IsSidFiltered(sid.Value))
                         continue;
 
-                    if (isDomainController)
-                    {
+                    if (isDomainController) {
                         var result = await ResolveDomainControllerPrincipal(sid.Value, computerDomain);
                         if (result != null)
                             resolved.Add(result);
@@ -157,19 +145,20 @@ await SendComputerStatus(new CSVComputerStatus
                     }
 
                     //If we get a local well known principal, we need to convert it using the computer's domain sid
-                    if (await _utils.ConvertLocalWellKnownPrincipal(sid, computerObjectId, computerDomain) is (true, var principal))
-                    {
-                        _log.LogTrace("Got Well Known Principal {SID} on computer {Computer} for privilege {Privilege} and type {Type}", principal.ObjectIdentifier, computerName, privilege, principal.ObjectType);
+                    if (await _utils.ConvertLocalWellKnownPrincipal(sid, computerObjectId, computerDomain) is
+                        (true, var principal)) {
+                        _log.LogTrace(
+                            "Got Well Known Principal {SID} on computer {Computer} for privilege {Privilege} and type {Type}",
+                            principal.ObjectIdentifier, computerName, privilege, principal.ObjectType);
                         resolved.Add(principal);
                         continue;
                     }
 
                     //If the security identifier starts with the machine sid, we need to resolve it as a local account
-                    if (sid.IsEqualDomainSid(machineSid))
-                    {
-                        _log.LogTrace("Got local account {sid} on computer {Computer} for privilege {Privilege}", sid.Value, computerName, privilege);
-                        var objectType = use switch
-                        {
+                    if (sid.IsEqualDomainSid(machineSid)) {
+                        _log.LogTrace("Got local account {sid} on computer {Computer} for privilege {Privilege}",
+                            sid.Value, computerName, privilege);
+                        var objectType = use switch {
                             SharedEnums.SidNameUse.User => Label.LocalUser,
                             SharedEnums.SidNameUse.Group => Label.LocalGroup,
                             SharedEnums.SidNameUse.Alias => Label.LocalGroup,
@@ -184,14 +173,12 @@ await SendComputerStatus(new CSVComputerStatus
                         var groupRid = sid.Rid();
                         var newSid = $"{computerObjectId}-{groupRid}";
                         if (name != null)
-                            names.Add(new NamedPrincipal
-                            {
+                            names.Add(new NamedPrincipal {
                                 ObjectId = newSid,
                                 PrincipalName = name
                             });
 
-                        resolved.Add(new TypedPrincipal
-                        {
+                        resolved.Add(new TypedPrincipal {
                             ObjectIdentifier = newSid,
                             ObjectType = objectType
                         });
@@ -210,19 +197,17 @@ await SendComputerStatus(new CSVComputerStatus
             }
         }
 
-        private async Task<TypedPrincipal> ResolveDomainControllerPrincipal(string sid, string computerDomain)
-        {
+        private async Task<TypedPrincipal> ResolveDomainControllerPrincipal(string sid, string computerDomain) {
             //If the server is a domain controller and we have a well known group, use the domain value
             if (await _utils.GetWellKnownPrincipal(sid, computerDomain) is (true, var wellKnown))
                 return wellKnown;
             //Otherwise, do a domain lookup
-            var domainPrinciple =  await _utils.ResolveIDAndType(sid, computerDomain);
+            var domainPrinciple = await _utils.ResolveIDAndType(sid, computerDomain);
             return domainPrinciple.Principal;
         }
 
 
-        private async Task SendComputerStatus(CSVComputerStatus status)
-        {
+        private async Task SendComputerStatus(CSVComputerStatus status) {
             if (ComputerStatusEvent is not null) await ComputerStatusEvent.Invoke(status);
         }
     }
diff --git a/src/CommonLib/Processors/WebClientServiceProcessor.cs b/src/CommonLib/Processors/WebClientServiceProcessor.cs
index 4deebbbc..6cab7308 100644
--- a/src/CommonLib/Processors/WebClientServiceProcessor.cs
+++ b/src/CommonLib/Processors/WebClientServiceProcessor.cs
@@ -9,10 +9,8 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace SharpHoundCommonLib.Processors
-{
-    public class WebClientServiceProcessor(ILogger log = null)
-    {
+namespace SharpHoundCommonLib.Processors {
+    public class WebClientServiceProcessor(ILogger log = null) {
         private readonly ILogger _log = log ?? Logging.LogProvider.CreateLogger("WebClientServiceProcessor");
 
         // Define constants
@@ -40,12 +38,11 @@ public static extern SafeFileHandle CreateFile(
             uint dwFlagsAndAttributes,
             IntPtr hTemplateFile);
 
-        public bool TestPathExists(string path)
-        {
-            using SafeFileHandle handle = CreateFile(
+        public static bool TestPathExists(string path) {
+            using var handle = CreateFile(
                 path,
-                MAXIMUM_ALLOWED,  // Request maximum allowed access
-                FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,  // Allow all share modes
+                MAXIMUM_ALLOWED, // Request maximum allowed access
+                FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, // Allow all share modes
                 IntPtr.Zero,
                 OPEN_EXISTING,
                 0,
@@ -54,10 +51,8 @@ public bool TestPathExists(string path)
 
             var result = Marshal.GetHRForLastWin32Error();
 
-            if (handle.IsInvalid)
-            {
-                switch ((uint)result)
-                {
+            if (handle.IsInvalid) {
+                switch ((uint)result) {
                     case ERROR_ACCESS_DENIED:
                         return true;
                     case ERROR_BAD_NETPATH:
@@ -74,26 +69,19 @@ public bool TestPathExists(string path)
             return true;
         }
 
-        public async Task<ApiResult<bool>> IsWebClientRunning(string computerName)
-        {
+        public async Task<ApiResult<bool>> IsWebClientRunning(string computerName) {
             // When the service is running, this named pipe is present
             var pipePath = @$"\\{computerName}\pipe\DAV RPC SERVICE";
 
-            return await Task.Run(() =>
-            {
-                try
-                {
-                    bool exists = TestPathExists(pipePath);
+            return await Task.Run(() => {
+                try {
+                    var exists = TestPathExists(pipePath);
 
                     return ApiResult<bool>.CreateSuccess(exists);
-
-                }
-                catch (Exception ex)
-                {
+                } catch (Exception ex) {
                     return ApiResult<bool>.CreateError(ex.ToString());
-
                 }
             });
         }
     }
-}
+}
\ No newline at end of file
diff --git a/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs b/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
index 68594ff3..396ad993 100644
--- a/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
+++ b/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
@@ -5,8 +5,7 @@
 
 namespace SharpHoundCommonLib.ThirdParty.PSOpenAD;
 
-public enum AuthenticationMethod
-{
+public enum AuthenticationMethod {
     /// <summary>Selects the best auth mechanism available.</summary>
     Default,
 
@@ -32,8 +31,7 @@ public enum AuthenticationMethod
 }
 
 /// <summary>Details on an authentication mechanism for the local client.</summary>
-public sealed class AuthenticationProvider
-{
+public sealed class AuthenticationProvider {
     /// <summary>The authentication mechanism this represents.</summary>
     public AuthenticationMethod Method { get; }
 
@@ -50,8 +48,7 @@ public sealed class AuthenticationProvider
     public string Details { get; }
 
     public AuthenticationProvider(AuthenticationMethod method, string saslId, bool available, bool canSign,
-        string details)
-    {
+        string details) {
         Method = method;
         SaslId = saslId;
         Available = available;
@@ -60,8 +57,7 @@ public AuthenticationProvider(AuthenticationMethod method, string saslId, bool a
     }
 }
 
-internal enum GssapiProvider
-{
+internal enum GssapiProvider {
     None,
     MIT,
     Heimdal,
@@ -70,16 +66,14 @@ internal enum GssapiProvider
 }
 
 [Flags]
-internal enum SASLSecurityFlags : byte
-{
+internal enum SASLSecurityFlags : byte {
     None = 0,
     NoSecurity = 1,
     Integrity = 2,
     Confidentiality = 4,
 }
 
-public class ChannelBindings
-{
+public class ChannelBindings {
     public int InitiatorAddrType { get; set; }
     public byte[]? InitiatorAddr { get; set; }
     public int AcceptorAddrType { get; set; }
@@ -87,8 +81,7 @@ public class ChannelBindings
     public byte[]? ApplicationData { get; set; }
 }
 
-internal abstract class SecurityContext : IDisposable
-{
+internal abstract class SecurityContext : IDisposable {
     public bool Complete { get; internal set; }
     public bool IntegrityAvailable { get; internal set; }
     public bool ConfidentialityAvailable { get; internal set; }
@@ -97,18 +90,16 @@ internal abstract class SecurityContext : IDisposable
     public abstract byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt);
     public abstract byte[] Unwrap(ReadOnlySpan<byte> data);
 
-    public abstract UInt32 MaxWrapSize(UInt32 outputSize, bool confReq);
+    public abstract uint MaxWrapSize(uint outputSize, bool confReq);
 
     public abstract void Dispose();
     ~SecurityContext() => Dispose();
 }
 
-internal class ExternalContext : SecurityContext
-{
+internal class ExternalContext : SecurityContext {
     private bool _called;
 
-    public override byte[] Step(byte[]? inputToken = null)
-    {
+    public override byte[] Step(byte[]? inputToken = null) {
         // No actual tokens are exchanged but we need to return at least 1 empty array and set it to be completed
         // on the next call
         Complete = _called;
@@ -120,163 +111,44 @@ public override byte[] Step(byte[]? inputToken = null)
     public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt) => Array.Empty<byte>();
     public override byte[] Unwrap(ReadOnlySpan<byte> data) => Array.Empty<byte>();
     public override uint MaxWrapSize(uint outputSize, bool confReq) => 0;
-    public override void Dispose()
-    { }
+
+    public override void Dispose() {
+    }
 }
 
-//internal class GssapiContext : SecurityContext
-//{
-//    private readonly SafeGssapiCred? _credential;
-//    private readonly SafeGssapiName _targetSpn;
-//    private readonly ChannelBindings? _bindingData;
-//    private readonly byte[]? _mech;
-//    private readonly GssapiContextFlags _flags = GssapiContextFlags.GSS_C_MUTUAL_FLAG |
-//        GssapiContextFlags.GSS_C_SEQUENCE_FLAG;
-//    private SafeGssapiSecContext? _context;
-
-//    public GssapiContext(string? username, string? password, AuthenticationMethod method, string target,
-//        ChannelBindings? channelBindings, bool integrity, bool confidentiality)
-//    {
-//        _bindingData = channelBindings;
-//        _mech = method == AuthenticationMethod.Negotiate ? GSSAPI.SPNEGO : GSSAPI.KERBEROS;
-//        _targetSpn = GSSAPI.ImportName(target, GSSAPI.GSS_C_NT_HOSTBASED_SERVICE);
-
-//        bool isHeimdal = GlobalState.GssapiProvider != GssapiProvider.MIT;
-//        List<byte[]> mechList = new() { _mech };
-//        if (isHeimdal && method == AuthenticationMethod.Negotiate)
-//        {
-//            mechList.AddRange(new[] { GSSAPI.KERBEROS, GSSAPI.NTLM });
-//        }
-
-//        if (!string.IsNullOrEmpty(username) && !string.IsNullOrEmpty(password))
-//        {
-//            using SafeGssapiName name = GSSAPI.ImportName(username, GSSAPI.GSS_C_NT_USER_NAME);
-//            _credential = GSSAPI.AcquireCredWithPassword(name, password, 0, mechList,
-//                GssapiCredUsage.GSS_C_INITIATE).Creds;
-
-//            if (GlobalState.GssapiProvider != GssapiProvider.MIT)
-//            {
-//                _mech = null;
-//            }
-//        }
-//        else
-//        {
-//            SafeGssapiName? name = null;
-//            if (!string.IsNullOrEmpty(username))
-//                name = GSSAPI.ImportName(username, GSSAPI.GSS_C_NT_USER_NAME);
-
-//            using (name)
-//                _credential = GSSAPI.AcquireCred(name, 0, mechList, GssapiCredUsage.GSS_C_INITIATE).Creds;
-//        }
-
-//        if (integrity)
-//            _flags |= GssapiContextFlags.GSS_C_INTEG_FLAG;
-
-//        if (confidentiality)
-//            _flags |= GssapiContextFlags.GSS_C_INTEG_FLAG | GssapiContextFlags.GSS_C_CONF_FLAG;
-
-//        if (method == AuthenticationMethod.Kerberos)
-//        {
-//            // Kerberos uses a special SASL wrapping mechanism and always requires integrity
-//            _flags |= GssapiContextFlags.GSS_C_INTEG_FLAG;
-//        }
-//        else if (!integrity && !confidentiality)
-//        {
-//            // GSSAPI always sets INTEG | CONF unless this flag is set. When using GSS-SPNEGO over TLS Windows
-//            // will reject the auth as you cannot nested wrapping within TLS. By setting this flag GSSAPI will no
-//            // longer add the integrity of conf flags to the auth mechanism allowing it to work with Windows.
-//            // Note: This does not apply to Kerberos (SASL GSSAPI) as there are futher token exchanges after the
-//            // auth to negotiate the integrity/conf options.
-//            GSSAPI.SetCredOption(_credential, GSSAPI.GSS_KRB5_CRED_NO_CI_FLAGS_X);
-//        }
-//    }
-
-//    public override byte[] Step(byte[]? inputToken = null)
-//    {
-//        var res = GSSAPI.InitSecContext(_credential, _context, _targetSpn, _mech, _flags, 0, _bindingData,
-//            inputToken);
-//        _context = res.Context;
-
-//        if (!res.MoreNeeded)
-//        {
-//            Complete = true;
-//            IntegrityAvailable = (res.Flags & GssapiContextFlags.GSS_C_INTEG_FLAG) != 0;
-//            ConfidentialityAvailable = (res.Flags & GssapiContextFlags.GSS_C_CONF_FLAG) != 0;
-//        }
-
-//        return res.OutputToken ?? Array.Empty<byte>();
-//    }
-
-//    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt)
-//    {
-//        if (_context == null || !Complete)
-//            throw new InvalidOperationException("Cannot wrap without a completed context");
-
-//        (byte[] wrappedData, bool _) = GSSAPI.Wrap(_context, encrypt, 0, data);
-//        return wrappedData;
-//    }
-
-//    public override byte[] Unwrap(ReadOnlySpan<byte> data)
-//    {
-//        if (_context == null || !Complete)
-//            throw new InvalidOperationException("Cannot unwrap without a completed context");
-
-//        (byte[] unwrappedData, bool _1, int _2) = GSSAPI.Unwrap(_context, data);
-//        return unwrappedData;
-//    }
-
-//    public override uint MaxWrapSize(uint outputSize, bool confReq)
-//    {
-//        if (_context == null || !Complete)
-//            throw new InvalidOperationException("Cannot get max wrap size without a completed context");
-
-//        return GSSAPI.WrapSizeLimit(_context, confReq, 0, outputSize);
-//    }
-
-//    public override void Dispose()
-//    {
-//        _credential?.Dispose();
-//        _context?.Dispose();
-//        _targetSpn?.Dispose();
-//    }
-//}
-
-internal class SspiContext : SecurityContext
-{
+internal class SspiContext : SecurityContext {
     private readonly SafeSspiCredentialHandle _credential;
     private readonly byte[]? _bindingData;
     private readonly string _targetSpn;
     private readonly InitiatorContextRequestFlags _flags = InitiatorContextRequestFlags.ISC_REQ_MUTUAL_AUTH;
     private SafeSspiContextHandle? _context;
-    private UInt32 _blockSize = 0;
-    private UInt32 _trailerSize = 0;
-    private UInt32 _seqNo = 0;
+    private uint _blockSize = 0;
+    private uint _trailerSize = 0;
+    private uint _seqNo = 0;
 
     public SspiContext(string? username, string? password, AuthenticationMethod method, string target,
-        ChannelBindings? channelBindings, bool integrity, bool confidentiality)
-    {
+        ChannelBindings? channelBindings, bool integrity, bool confidentiality) {
         _bindingData = CreateChannelBindings(channelBindings);
         _targetSpn = target;
 
-        string package = Enum.GetName(typeof(AuthenticationMethod), method);
+        var package = Enum.GetName(typeof(AuthenticationMethod), method);
         WinNTAuthIdentity? identity = null;
-        if (!string.IsNullOrEmpty(username) || !string.IsNullOrEmpty(password))
-        {
+        if (!string.IsNullOrEmpty(username) || !string.IsNullOrEmpty(password)) {
             string? domain = null;
-            if (username?.Contains("\\") == true)
-            {
-                string[] stringSplit = username.Split(['\\'], 2);
+            if (username?.Contains("\\") == true) {
+                var stringSplit = username.Split(['\\'], 2);
                 domain = stringSplit[0];
                 username = stringSplit[1];
             }
 
             identity = new WinNTAuthIdentity(username, domain, password);
         }
+
         _credential = SSPI.AcquireCredentialsHandle(null, package, CredentialUse.SECPKG_CRED_OUTBOUND,
             identity).Creds;
 
         const InitiatorContextRequestFlags integrityFlags = InitiatorContextRequestFlags.ISC_REQ_INTEGRITY |
-            InitiatorContextRequestFlags.ISC_REQ_SEQUENCE_DETECT;
+                                                            InitiatorContextRequestFlags.ISC_REQ_SEQUENCE_DETECT;
 
         if (integrity)
             _flags |= integrityFlags;
@@ -284,56 +156,47 @@ public SspiContext(string? username, string? password, AuthenticationMethod meth
         if (confidentiality)
             _flags |= integrityFlags | InitiatorContextRequestFlags.ISC_REQ_CONFIDENTIALITY;
 
-        if (method == AuthenticationMethod.Kerberos)
-        {
+        if (method == AuthenticationMethod.Kerberos) {
             // Kerberos uses a special SASL wrapping mechanism and always requires integrity
             _flags |= integrityFlags;
-        }
-        else if (!integrity && !confidentiality)
-        {
+        } else if (!integrity && !confidentiality) {
             // GSS-SPNEGO uses the context flags to determine the protection applied and Kerberos always sets
             // INTEG by default. By setting this flag we unset INTEG allowing it to be used without any protection.
             _flags |= InitiatorContextRequestFlags.ISC_REQ_NO_INTEGRITY;
         }
     }
 
-    public override byte[] Step(byte[]? inputToken = null)
-    {
-        int bufferCount = 0;
+    public override byte[] Step(byte[]? inputToken = null) {
+        var bufferCount = 0;
         if (inputToken != null)
             bufferCount++;
 
         if (_bindingData != null)
             bufferCount++;
 
-        unsafe
-        {
-            fixed (byte* input = inputToken, cbBuffer = _bindingData)
-            {
+        unsafe {
+            fixed (byte* input = inputToken, cbBuffer = _bindingData) {
                 Span<Helpers.SecBuffer> inputBuffers = stackalloc Helpers.SecBuffer[bufferCount];
-                int idx = 0;
+                var idx = 0;
 
-                if (inputToken != null)
-                {
-                    inputBuffers[idx].cbBuffer = (UInt32)inputToken.Length;
-                    inputBuffers[idx].BufferType = (UInt32)SecBufferType.SECBUFFER_TOKEN;
+                if (inputToken != null) {
+                    inputBuffers[idx].cbBuffer = (uint)inputToken.Length;
+                    inputBuffers[idx].BufferType = (uint)SecBufferType.SECBUFFER_TOKEN;
                     inputBuffers[idx].pvBuffer = (IntPtr)input;
                     idx++;
                 }
 
-                if (_bindingData != null)
-                {
-                    inputBuffers[idx].cbBuffer = (UInt32)_bindingData.Length;
-                    inputBuffers[idx].BufferType = (UInt32)SecBufferType.SECBUFFER_CHANNEL_BINDINGS;
+                if (_bindingData != null) {
+                    inputBuffers[idx].cbBuffer = (uint)_bindingData.Length;
+                    inputBuffers[idx].BufferType = (uint)SecBufferType.SECBUFFER_CHANNEL_BINDINGS;
                     inputBuffers[idx].pvBuffer = (IntPtr)cbBuffer;
                 }
 
-                SspiSecContext context = SSPI.InitializeSecurityContext(_credential, _context, _targetSpn, _flags,
-                    TargetDataRep.SECURITY_NATIVE_DREP, inputBuffers, new[] { SecBufferType.SECBUFFER_TOKEN, });
+                var context = SSPI.InitializeSecurityContext(_credential, _context, _targetSpn, _flags,
+                    TargetDataRep.SECURITY_NATIVE_DREP, inputBuffers, [SecBufferType.SECBUFFER_TOKEN]);
                 _context = context.Context;
 
-                if (!context.MoreNeeded)
-                {
+                if (!context.MoreNeeded) {
                     Complete = true;
                     IntegrityAvailable =
                         (context.Flags & InitiatorContextReturnFlags.ISC_RET_INTEGRITY) != 0;
@@ -341,8 +204,7 @@ public override byte[] Step(byte[]? inputToken = null)
                         (context.Flags & InitiatorContextReturnFlags.ISC_RET_CONFIDENTIALITY) != 0;
 
                     Span<Helpers.SecPkgContext_Sizes> sizes = stackalloc Helpers.SecPkgContext_Sizes[1];
-                    fixed (Helpers.SecPkgContext_Sizes* sizesPtr = sizes)
-                    {
+                    fixed (Helpers.SecPkgContext_Sizes* sizesPtr = sizes) {
                         SSPI.QueryContextAttributes(_context, SecPkgAttribute.SECPKG_ATTR_SIZES,
                             (IntPtr)sizesPtr);
 
@@ -356,41 +218,36 @@ public override byte[] Step(byte[]? inputToken = null)
         }
     }
 
-    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt)
-    {
+    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt) {
         if (_context == null || !Complete)
             throw new InvalidOperationException("Cannot wrap without a completed context");
 
-        unsafe
-        {
-            ArrayPool<byte> shared = ArrayPool<byte>.Shared;
-            byte[] token = shared.Rent((int)_trailerSize);
-            byte[] padding = shared.Rent((int)_blockSize);
+        unsafe {
+            var shared = ArrayPool<byte>.Shared;
+            var token = shared.Rent((int)_trailerSize);
+            var padding = shared.Rent((int)_blockSize);
 
-            try
-            {
-                fixed (byte* tokenPtr = token, dataPtr = data, paddingPtr = padding)
-                {
+            try {
+                fixed (byte* tokenPtr = token, dataPtr = data, paddingPtr = padding) {
                     Span<Helpers.SecBuffer> buffers = stackalloc Helpers.SecBuffer[3];
-                    buffers[0].BufferType = (UInt32)SecBufferType.SECBUFFER_TOKEN;
+                    buffers[0].BufferType = (uint)SecBufferType.SECBUFFER_TOKEN;
                     buffers[0].cbBuffer = _trailerSize;
                     buffers[0].pvBuffer = (IntPtr)tokenPtr;
 
-                    buffers[1].BufferType = (UInt32)SecBufferType.SECBUFFER_DATA;
-                    buffers[1].cbBuffer = (UInt32)data.Length;
+                    buffers[1].BufferType = (uint)SecBufferType.SECBUFFER_DATA;
+                    buffers[1].cbBuffer = (uint)data.Length;
                     buffers[1].pvBuffer = (IntPtr)dataPtr;
 
-                    buffers[2].BufferType = (UInt32)SecBufferType.SECBUFFER_PADDING;
+                    buffers[2].BufferType = (uint)SecBufferType.SECBUFFER_PADDING;
                     buffers[2].cbBuffer = _blockSize;
                     buffers[2].pvBuffer = (IntPtr)paddingPtr;
 
-                    UInt32 qop = encrypt ? 0 : 0x80000001; // SECQOP_WRAP_NO_ENCRYPT
+                    var qop = encrypt ? 0 : 0x80000001; // SECQOP_WRAP_NO_ENCRYPT
                     SSPI.EncryptMessage(_context, qop, buffers, NextSeqNo());
 
-                    byte[] wrapped = new byte[buffers[0].cbBuffer + buffers[1].cbBuffer + buffers[2].cbBuffer];
-                    int offset = 0;
-                    if (buffers[0].cbBuffer > 0)
-                    {
+                    var wrapped = new byte[buffers[0].cbBuffer + buffers[1].cbBuffer + buffers[2].cbBuffer];
+                    var offset = 0;
+                    if (buffers[0].cbBuffer > 0) {
                         Buffer.BlockCopy(token, 0, wrapped, offset, (int)buffers[0].cbBuffer);
                         offset += (int)buffers[0].cbBuffer;
                     }
@@ -398,44 +255,38 @@ public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt)
                     Marshal.Copy((IntPtr)dataPtr, wrapped, offset, (int)buffers[1].cbBuffer);
                     offset += (int)buffers[1].cbBuffer;
 
-                    if (buffers[2].cbBuffer > 0)
-                    {
+                    if (buffers[2].cbBuffer > 0) {
                         Buffer.BlockCopy(padding, 0, wrapped, offset, (int)buffers[2].cbBuffer);
                         offset += (int)buffers[2].cbBuffer;
                     }
 
                     return wrapped;
                 }
-            }
-            finally
-            {
+            } finally {
                 shared.Return(token);
                 shared.Return(padding);
             }
         }
     }
 
-    public override byte[] Unwrap(ReadOnlySpan<byte> data)
-    {
+    public override byte[] Unwrap(ReadOnlySpan<byte> data) {
         if (_context == null || !Complete)
             throw new InvalidOperationException("Cannot wrap without a completed context");
 
-        unsafe
-        {
-            fixed (byte* dataPtr = data)
-            {
+        unsafe {
+            fixed (byte* dataPtr = data) {
                 Span<Helpers.SecBuffer> buffers = stackalloc Helpers.SecBuffer[2];
-                buffers[0].BufferType = (UInt32)SecBufferType.SECBUFFER_STREAM;
-                buffers[0].cbBuffer = (UInt32)data.Length;
+                buffers[0].BufferType = (uint)SecBufferType.SECBUFFER_STREAM;
+                buffers[0].cbBuffer = (uint)data.Length;
                 buffers[0].pvBuffer = (IntPtr)dataPtr;
 
-                buffers[1].BufferType = (UInt32)SecBufferType.SECBUFFER_DATA;
+                buffers[1].BufferType = (uint)SecBufferType.SECBUFFER_DATA;
                 buffers[1].cbBuffer = 0;
                 buffers[1].pvBuffer = IntPtr.Zero;
 
                 SSPI.DecryptMessage(_context, buffers, NextSeqNo());
 
-                byte[] unwrapped = new byte[buffers[1].cbBuffer];
+                var unwrapped = new byte[buffers[1].cbBuffer];
                 Marshal.Copy(buffers[1].pvBuffer, unwrapped, 0, unwrapped.Length);
 
                 return unwrapped;
@@ -443,52 +294,45 @@ public override byte[] Unwrap(ReadOnlySpan<byte> data)
         }
     }
 
-    public override UInt32 MaxWrapSize(UInt32 outputSize, bool confReq)
-    {
+    public override uint MaxWrapSize(uint outputSize, bool confReq) {
         throw new NotImplementedException(); // Not used in SSPI.
     }
 
-    private byte[]? CreateChannelBindings(ChannelBindings? bindings)
-    {
+    private byte[]? CreateChannelBindings(ChannelBindings? bindings) {
         if (bindings == null)
             return null;
 
-        int structOffset = Marshal.SizeOf<Helpers.SEC_CHANNEL_BINDINGS>();
-        int binaryLength = bindings.InitiatorAddr?.Length ?? 0 + bindings.AcceptorAddr?.Length ?? 0 +
+        var structOffset = Marshal.SizeOf<Helpers.SEC_CHANNEL_BINDINGS>();
+        var binaryLength = bindings.InitiatorAddr?.Length ?? 0 + bindings.AcceptorAddr?.Length ?? 0 +
             bindings.ApplicationData?.Length ?? 0;
-        byte[] bindingData = new byte[structOffset + binaryLength];
-        unsafe
-        {
-            fixed (byte* bindingPtr = bindingData)
-            {
-                Helpers.SEC_CHANNEL_BINDINGS* bindingStruct = (Helpers.SEC_CHANNEL_BINDINGS*)bindingPtr;
-
-                bindingStruct->dwInitiatorAddrType = (UInt32)bindings.InitiatorAddrType;
-                if (bindings.InitiatorAddr != null)
-                {
-                    bindingStruct->cbInitiatorLength = (UInt32)bindings.InitiatorAddr.Length;
-                    bindingStruct->dwInitiatorOffset = (UInt32)structOffset;
+        var bindingData = new byte[structOffset + binaryLength];
+        unsafe {
+            fixed (byte* bindingPtr = bindingData) {
+                var bindingStruct = (Helpers.SEC_CHANNEL_BINDINGS*)bindingPtr;
+
+                bindingStruct->dwInitiatorAddrType = (uint)bindings.InitiatorAddrType;
+                if (bindings.InitiatorAddr != null) {
+                    bindingStruct->cbInitiatorLength = (uint)bindings.InitiatorAddr.Length;
+                    bindingStruct->dwInitiatorOffset = (uint)structOffset;
                     Buffer.BlockCopy(bindings.InitiatorAddr, 0, bindingData, structOffset,
                         bindings.InitiatorAddr.Length);
 
                     structOffset += bindings.InitiatorAddr.Length;
                 }
 
-                bindingStruct->dwAcceptorAddrType = (UInt32)bindings.AcceptorAddrType;
-                if (bindings.AcceptorAddr != null)
-                {
-                    bindingStruct->cbAcceptorLength = (UInt32)bindings.AcceptorAddr.Length;
-                    bindingStruct->dwAcceptorOffset = (UInt32)structOffset;
+                bindingStruct->dwAcceptorAddrType = (uint)bindings.AcceptorAddrType;
+                if (bindings.AcceptorAddr != null) {
+                    bindingStruct->cbAcceptorLength = (uint)bindings.AcceptorAddr.Length;
+                    bindingStruct->dwAcceptorOffset = (uint)structOffset;
                     Buffer.BlockCopy(bindings.AcceptorAddr, 0, bindingData, structOffset,
                         bindings.AcceptorAddr.Length);
 
                     structOffset += bindings.AcceptorAddr.Length;
                 }
 
-                if (bindings.ApplicationData != null)
-                {
-                    bindingStruct->cbApplicationDataLength = (UInt32)bindings.ApplicationData.Length;
-                    bindingStruct->dwApplicationDataOffset = (UInt32)structOffset;
+                if (bindings.ApplicationData != null) {
+                    bindingStruct->cbApplicationDataLength = (uint)bindings.ApplicationData.Length;
+                    bindingStruct->dwApplicationDataOffset = (uint)structOffset;
                     Buffer.BlockCopy(bindings.ApplicationData, 0, bindingData, structOffset,
                         bindings.ApplicationData.Length);
                 }
@@ -498,16 +342,14 @@ public override UInt32 MaxWrapSize(UInt32 outputSize, bool confReq)
         return bindingData;
     }
 
-    private UInt32 NextSeqNo()
-    {
-        UInt32 seqNo = _seqNo;
+    private uint NextSeqNo() {
+        var seqNo = _seqNo;
         _seqNo++;
 
         return seqNo;
     }
 
-    public override void Dispose()
-    {
+    public override void Dispose() {
         _credential.Dispose();
         _context?.Dispose();
     }
diff --git a/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs b/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs
index ab606a12..d7cce233 100644
--- a/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs
+++ b/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs
@@ -7,11 +7,9 @@
 
 namespace SharpHoundCommonLib.ThirdParty.PSOpenAD;
 
-internal static partial class Helpers
-{
+internal static class Helpers {
     [StructLayout(LayoutKind.Sequential)]
-    public struct SEC_CHANNEL_BINDINGS
-    {
+    public struct SEC_CHANNEL_BINDINGS {
         public UInt32 dwInitiatorAddrType;
         public UInt32 cbInitiatorLength;
         public UInt32 dwInitiatorOffset;
@@ -23,8 +21,7 @@ public struct SEC_CHANNEL_BINDINGS
     }
 
     [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-    public struct SEC_WINNT_AUTH_IDENTITY_W
-    {
+    public struct SEC_WINNT_AUTH_IDENTITY_W {
         public unsafe char* User;
         public UInt32 UserLength;
         public unsafe char* Domain;
@@ -35,38 +32,33 @@ public struct SEC_WINNT_AUTH_IDENTITY_W
     }
 
     [StructLayout(LayoutKind.Sequential)]
-    public struct SECURITY_INTEGER
-    {
+    public struct SECURITY_INTEGER {
         public UInt32 LowPart;
         public Int32 HighPart;
     }
 
     [StructLayout(LayoutKind.Sequential)]
-    public struct SecBufferDesc
-    {
+    public struct SecBufferDesc {
         public UInt32 ulVersion;
         public UInt32 cBuffers;
         public IntPtr pBuffers;
     }
 
     [StructLayout(LayoutKind.Sequential)]
-    public struct SecBuffer
-    {
+    public struct SecBuffer {
         public UInt32 cbBuffer;
         public UInt32 BufferType;
         public IntPtr pvBuffer;
     }
 
     [StructLayout(LayoutKind.Sequential)]
-    public struct SecHandle
-    {
+    public struct SecHandle {
         public UIntPtr dwLower;
         public UIntPtr dwUpper;
     }
 
     [StructLayout(LayoutKind.Sequential)]
-    public struct SecPkgContext_Sizes
-    {
+    public struct SecPkgContext_Sizes {
         public UInt32 cbMaxToken;
         public UInt32 cbMaxSignature;
         public UInt32 cbBlockSize;
@@ -75,24 +67,21 @@ public struct SecPkgContext_Sizes
 }
 
 /// <summary>Result of <c>AcquireCredentialsHandle</c>.</summary>
-internal class SspiCredential
-{
+internal class SspiCredential {
     /// <summary>The handle to the SSPI credential.</summary>
     public SafeSspiCredentialHandle Creds { get; }
 
     /// <summary>The number of ticks (100s of nanoseconds) since 1601-01-01 until the credential expires.</summary>
-    public UInt64 Expiry { get; }
+    public ulong Expiry { get; }
 
-    public SspiCredential(SafeSspiCredentialHandle creds, UInt64 expiry)
-    {
+    public SspiCredential(SafeSspiCredentialHandle creds, ulong expiry) {
         Creds = creds;
         Expiry = expiry;
     }
 }
 
 /// <summary>Result of <c>InitializeSecurityContext</c>.</summary>
-internal class SspiSecContext
-{
+internal class SspiSecContext {
     /// <summary>The handle to the SSPI security context.</summary>
     public SafeSspiContextHandle Context { get; }
 
@@ -100,7 +89,7 @@ internal class SspiSecContext
     public byte[][] OutputBuffers { get; }
 
     /// <summary>The number of ticks (100s of nanoseconds) since 1601-01-01 until the context expires.</summary>
-    public UInt64 Expiry { get; }
+    public ulong Expiry { get; }
 
     /// <summary>The attributes used to describe the functionality available on the context.</summary>
     public InitiatorContextReturnFlags Flags { get; }
@@ -108,9 +97,8 @@ internal class SspiSecContext
     /// <summary>Whether more data is needed from the acceptor to complete the context.</summary>
     public bool MoreNeeded { get; }
 
-    public SspiSecContext(SafeSspiContextHandle context, byte[][] outputBuffers, UInt64 expiry,
-        InitiatorContextReturnFlags flags, bool moreNeeded)
-    {
+    public SspiSecContext(SafeSspiContextHandle context, byte[][] outputBuffers, ulong expiry,
+        InitiatorContextReturnFlags flags, bool moreNeeded) {
         Context = context;
         OutputBuffers = outputBuffers;
         Expiry = expiry;
@@ -119,12 +107,11 @@ public SspiSecContext(SafeSspiContextHandle context, byte[][] outputBuffers, UIn
     }
 }
 
-internal static class SSPI
-{
-    private const Int32 SEC_I_CONTINUE_NEEDED = 0x00090312;
+internal static class SSPI {
+    private const int SEC_I_CONTINUE_NEEDED = 0x00090312;
 
     [DllImport("Secur32.dll", CharSet = CharSet.Unicode)]
-    private static unsafe extern Int32 AcquireCredentialsHandleW(
+    private static unsafe extern int AcquireCredentialsHandleW(
         [MarshalAs(UnmanagedType.LPWStr)] string? pszPrincipal,
         [MarshalAs(UnmanagedType.LPWStr)] string pPackage,
         CredentialUse fCredentialUse,
@@ -136,48 +123,48 @@ private static unsafe extern Int32 AcquireCredentialsHandleW(
         out Helpers.SECURITY_INTEGER ptsExpiry);
 
     [DllImport("Secur32.dll", EntryPoint = "DecryptMessage")]
-    private static extern Int32 DecryptMessageNative(
+    private static extern int DecryptMessageNative(
         SafeSspiContextHandle phContext,
         ref Helpers.SecBufferDesc pMessage,
-        UInt32 MessageSeqNo,
-        out UInt32 pfQOP);
+        uint MessageSeqNo,
+        out uint pfQOP);
 
     [DllImport("Secur32.dll")]
-    public static extern Int32 DeleteSecurityContext(
+    public static extern int DeleteSecurityContext(
         IntPtr phContext);
 
     [DllImport("Secur32.dll", EntryPoint = "EncryptMessage")]
-    private static extern Int32 EncryptMessageNative(
+    private static extern int EncryptMessageNative(
         SafeSspiContextHandle phContext,
-        UInt32 fQOP,
+        uint fQOP,
         ref Helpers.SecBufferDesc pMessage,
-        UInt32 MessageSeqNo);
+        uint MessageSeqNo);
 
     [DllImport("Secur32.dll")]
-    public static extern Int32 FreeContextBuffer(
+    public static extern int FreeContextBuffer(
         IntPtr pvContextBuffer);
 
     [DllImport("Secur32.dll")]
-    public static extern Int32 FreeCredentialsHandle(
+    public static extern int FreeCredentialsHandle(
         IntPtr phCredential);
 
     [DllImport("Secur32.dll", CharSet = CharSet.Unicode)]
-    private static unsafe extern Int32 InitializeSecurityContextW(
+    private static unsafe extern int InitializeSecurityContextW(
         Helpers.SecHandle* phCredential,
         Helpers.SecHandle* phContext,
         [MarshalAs(UnmanagedType.LPWStr)] string pszTargetName,
         InitiatorContextRequestFlags fContextReq,
-        UInt32 Reserved1,
+        uint Reserved1,
         TargetDataRep TargetDataRep,
         Helpers.SecBufferDesc* pInput,
-        UInt32 Reserved2,
+        uint Reserved2,
         Helpers.SecHandle* phNewContext,
         Helpers.SecBufferDesc* pOutput,
         out InitiatorContextReturnFlags pfContextAttr,
         out Helpers.SECURITY_INTEGER ptsExpiry);
 
     [DllImport("Secur32.dll", EntryPoint = "QueryContextAttributes")]
-    private static extern Int32 QueryContextAttributesNative(
+    private static extern int QueryContextAttributesNative(
         SafeSspiContextHandle phContext,
         SecPkgAttribute ulAttribute,
         IntPtr pBuffer);
@@ -193,39 +180,35 @@ private static extern Int32 QueryContextAttributesNative(
     /// <exception href="SspiException">Error when retrieving the credential.</exception>
     /// <see cref="https://docs.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--general">AcquireCredentialsHandle</see>
     public static SspiCredential AcquireCredentialsHandle(string? principal, string package, CredentialUse usage,
-        WinNTAuthIdentity? identity)
-    {
-        string? user = identity?.Username;
-        string? domain = identity?.Domain;
-        string? pass = identity?.Password;
-
-        unsafe
-        {
+        WinNTAuthIdentity? identity) {
+        var user = identity?.Username;
+        var domain = identity?.Domain;
+        var pass = identity?.Password;
+
+        unsafe {
             Helpers.SEC_WINNT_AUTH_IDENTITY_W authData = new();
             Helpers.SEC_WINNT_AUTH_IDENTITY_W* authDataPtr = null;
-            fixed (char* userPtr = user, domainPtr = domain, passPtr = pass)
-            {
-                if (identity != null)
-                {
+            fixed (char* userPtr = user, domainPtr = domain, passPtr = pass) {
+                if (identity != null) {
                     authDataPtr = &authData;
                     authData.User = userPtr;
-                    authData.UserLength = (UInt16)(identity.Username?.Length ?? 0);
+                    authData.UserLength = (ushort)(identity.Username?.Length ?? 0);
                     authData.Domain = domainPtr;
-                    authData.DomainLength = (UInt16)(identity.Domain?.Length ?? 0);
+                    authData.DomainLength = (ushort)(identity.Domain?.Length ?? 0);
                     authData.Password = passPtr;
-                    authData.PasswordLength = (UInt16)(identity.Password?.Length ?? 0);
+                    authData.PasswordLength = (ushort)(identity.Password?.Length ?? 0);
                     authData.Flags = WinNTAuthIdentityFlags.SEC_WINNT_AUTH_IDENTITY_UNICODE;
                 }
 
                 SafeSspiCredentialHandle cred = new();
-                int res = AcquireCredentialsHandleW(principal, package, usage, IntPtr.Zero, authDataPtr, IntPtr.Zero,
+                var res = AcquireCredentialsHandleW(principal, package, usage, IntPtr.Zero, authDataPtr, IntPtr.Zero,
                     IntPtr.Zero, cred, out var expiryStruct);
 
                 if (res != 0)
                     throw new SspiException(res, "AcquireCredentialsHandle");
 
                 cred.SSPIFree = true;
-                UInt64 expiry = (UInt64)expiryStruct.HighPart << 32 | (UInt64)expiryStruct.LowPart;
+                var expiry = (ulong)expiryStruct.HighPart << 32 | (ulong)expiryStruct.LowPart;
                 return new SspiCredential(cred, expiry);
             }
         }
@@ -241,20 +224,16 @@ public static SspiCredential AcquireCredentialsHandle(string? principal, string
     /// <returns>The quality of protection that had applied to the encrypted message.</returns>
     /// <exception cref="SspiException">Failure trying to decrypt the message.</exception>
     /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/decryptmessage--general">DecryptMessage</see>
-    public static UInt32 DecryptMessage(SafeSspiContextHandle context, Span<Helpers.SecBuffer> message, UInt32 seqNo)
-    {
-        unsafe
-        {
-            fixed (Helpers.SecBuffer* messagePtr = message)
-            {
-                Helpers.SecBufferDesc bufferDesc = new()
-                {
+    public static uint DecryptMessage(SafeSspiContextHandle context, Span<Helpers.SecBuffer> message, uint seqNo) {
+        unsafe {
+            fixed (Helpers.SecBuffer* messagePtr = message) {
+                Helpers.SecBufferDesc bufferDesc = new() {
                     ulVersion = 0,
-                    cBuffers = (UInt32)message.Length,
+                    cBuffers = (uint)message.Length,
                     pBuffers = (IntPtr)messagePtr,
                 };
 
-                int res = DecryptMessageNative(context, ref bufferDesc, seqNo, out var qop);
+                var res = DecryptMessageNative(context, ref bufferDesc, seqNo, out var qop);
                 if (res != 0)
                     throw new SspiException(res, "DecryptMessage");
 
@@ -273,21 +252,17 @@ public static UInt32 DecryptMessage(SafeSspiContextHandle context, Span<Helpers.
     /// <param name="seqNo">The sequence number to apply to the encrypted message.</param>
     /// <exception cref="SspiException">Failure trying to entry the message.</exception>
     /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/encryptmessage--general">EncryptMessage</see>
-    public static void EncryptMessage(SafeSspiContextHandle context, UInt32 qop, Span<Helpers.SecBuffer> message,
-        UInt32 seqNo)
-    {
-        unsafe
-        {
-            fixed (Helpers.SecBuffer* messagePtr = message)
-            {
-                Helpers.SecBufferDesc bufferDesc = new()
-                {
+    public static void EncryptMessage(SafeSspiContextHandle context, uint qop, Span<Helpers.SecBuffer> message,
+        uint seqNo) {
+        unsafe {
+            fixed (Helpers.SecBuffer* messagePtr = message) {
+                Helpers.SecBufferDesc bufferDesc = new() {
                     ulVersion = 0,
-                    cBuffers = (UInt32)message.Length,
+                    cBuffers = (uint)message.Length,
                     pBuffers = (IntPtr)messagePtr,
                 };
 
-                int res = EncryptMessageNative(context, qop, ref bufferDesc, seqNo);
+                var res = EncryptMessageNative(context, qop, ref bufferDesc, seqNo);
                 if (res != 0)
                     throw new SspiException(res, "EncryptMessage");
             }
@@ -310,34 +285,27 @@ public static void EncryptMessage(SafeSspiContextHandle context, UInt32 qop, Spa
     /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/initializesecuritycontext--general">InitializeSecurityContext</see>
     public static SspiSecContext InitializeSecurityContext(SafeSspiCredentialHandle cred,
         SafeSspiContextHandle? context, string targetName, InitiatorContextRequestFlags contextReq,
-        TargetDataRep dataRep, ReadOnlySpan<Helpers.SecBuffer> input, IList<SecBufferType> outputBufferTypes)
-    {
+        TargetDataRep dataRep, ReadOnlySpan<Helpers.SecBuffer> input, IList<SecBufferType> outputBufferTypes) {
         contextReq |= InitiatorContextRequestFlags.ISC_REQ_ALLOCATE_MEMORY;
 
         Span<Helpers.SecBuffer> output = stackalloc Helpers.SecBuffer[outputBufferTypes.Count];
-        for (int i = 0; i < output.Length; i++)
-            output[i].BufferType = (UInt32)outputBufferTypes[i];
+        for (var i = 0; i < output.Length; i++)
+            output[i].BufferType = (uint)outputBufferTypes[i];
 
-        unsafe
-        {
-            fixed (Helpers.SecBuffer* inputBuffers = input, outputBuffers = output)
-            {
+        unsafe {
+            fixed (Helpers.SecBuffer* inputBuffers = input, outputBuffers = output) {
                 Helpers.SecHandle* credPtr = null;
-                if (cred != null)
-                {
+                if (cred != null) {
                     credPtr = (Helpers.SecHandle*)cred.DangerousGetHandle();
                 }
 
                 Helpers.SecHandle* inputContextPtr = null;
                 Helpers.SecHandle* outputContextPtr = null;
                 SafeSspiContextHandle newContext;
-                if (context == null || context.DangerousGetHandle() == IntPtr.Zero)
-                {
-                    newContext = new();
+                if (context == null || context.DangerousGetHandle() == IntPtr.Zero) {
+                    newContext = new SafeSspiContextHandle();
                     outputContextPtr = (Helpers.SecHandle*)newContext.DangerousGetHandle();
-                }
-                else
-                {
+                } else {
                     newContext = context;
                     inputContextPtr = (Helpers.SecHandle*)context.DangerousGetHandle();
                     outputContextPtr = inputContextPtr;
@@ -345,25 +313,23 @@ public static SspiSecContext InitializeSecurityContext(SafeSspiCredentialHandle
 
                 Helpers.SecBufferDesc inputBuffer = new();
                 Helpers.SecBufferDesc* inputPtr = null;
-                if (input.Length > 0)
-                {
+                if (input.Length > 0) {
                     inputBuffer.ulVersion = 0;
-                    inputBuffer.cBuffers = (UInt32)input.Length;
+                    inputBuffer.cBuffers = (uint)input.Length;
                     inputBuffer.pBuffers = (IntPtr)inputBuffers;
                     inputPtr = &inputBuffer;
                 }
 
                 Helpers.SecBufferDesc outputBuffer = new();
                 Helpers.SecBufferDesc* outputPtr = null;
-                if (output.Length > 0)
-                {
+                if (output.Length > 0) {
                     outputBuffer.ulVersion = 0;
-                    outputBuffer.cBuffers = (UInt32)output.Length;
+                    outputBuffer.cBuffers = (uint)output.Length;
                     outputBuffer.pBuffers = (IntPtr)outputBuffers;
                     outputPtr = &outputBuffer;
                 }
 
-                int res = InitializeSecurityContextW(credPtr, inputContextPtr, targetName, contextReq, 0, dataRep,
+                var res = InitializeSecurityContextW(credPtr, inputContextPtr, targetName, contextReq, 0, dataRep,
                     inputPtr, 0, outputContextPtr, outputPtr, out var contextattr, out var expiryStruct);
 
                 if (res != 0 && res != SEC_I_CONTINUE_NEEDED)
@@ -371,28 +337,23 @@ public static SspiSecContext InitializeSecurityContext(SafeSspiCredentialHandle
 
                 newContext.SSPIFree = true;
 
-                try
-                {
-                    bool moreNeeded = res == SEC_I_CONTINUE_NEEDED;
-                    UInt64 expiry = (UInt64)expiryStruct.HighPart << 32 | (UInt64)expiryStruct.LowPart;
+                try {
+                    var moreNeeded = res == SEC_I_CONTINUE_NEEDED;
+                    var expiry = (ulong)expiryStruct.HighPart << 32 | (ulong)expiryStruct.LowPart;
                     List<byte[]> outputTokens = new();
-                    foreach (Helpers.SecBuffer buffer in output)
-                    {
+                    foreach (var buffer in output) {
                         if (buffer.cbBuffer == 0)
                             continue;
 
-                        byte[] data = new byte[buffer.cbBuffer];
+                        var data = new byte[buffer.cbBuffer];
                         Marshal.Copy(buffer.pvBuffer, data, 0, data.Length);
                         outputTokens.Add(data);
                     }
 
                     return new SspiSecContext(newContext, outputTokens.ToArray(), expiry, contextattr,
                         moreNeeded);
-                }
-                finally
-                {
-                    foreach (Helpers.SecBuffer buffer in output)
-                    {
+                } finally {
+                    foreach (var buffer in output) {
                         if (buffer.pvBuffer != IntPtr.Zero)
                             FreeContextBuffer(buffer.pvBuffer);
                     }
@@ -408,44 +369,41 @@ public static SspiSecContext InitializeSecurityContext(SafeSspiCredentialHandle
     /// <param name="buffer">The buffer that will store the queried value.</param>
     /// <exception cref="SspiException">Failure trying to query the requested value.</exception>
     /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/querycontextattributes--general">QueryContextAttributes</see>
-    public static void QueryContextAttributes(SafeSspiContextHandle context, SecPkgAttribute attribute, IntPtr buffer)
-    {
-        int res = QueryContextAttributesNative(context, attribute, buffer);
+    public static void QueryContextAttributes(SafeSspiContextHandle context, SecPkgAttribute attribute, IntPtr buffer) {
+        var res = QueryContextAttributesNative(context, attribute, buffer);
         if (res != 0)
             throw new SspiException(res, "QueryContextAttributesNative");
     }
 }
 
-public class SspiException : AuthenticationException
-{
+public class SspiException : AuthenticationException {
     public int ErrorCode { get; } = -1;
 
-    public SspiException() { }
+    public SspiException() {
+    }
 
-    public SspiException(string message) : base(message) { }
+    public SspiException(string message) : base(message) {
+    }
 
     public SspiException(string message, Exception innerException) :
-        base(message, innerException)
-    { }
+        base(message, innerException) {
+    }
 
     public SspiException(int errorCode, string method)
-        : base(GetExceptionMessage(errorCode, method))
-    {
+        : base(GetExceptionMessage(errorCode, method)) {
         ErrorCode = errorCode;
     }
 
-    private static string GetExceptionMessage(int errorCode, string? method)
-    {
-        method = String.IsNullOrWhiteSpace(method) ? "SSPI Call" : method;
-        string errMsg = new Win32Exception(errorCode).Message;
+    private static string GetExceptionMessage(int errorCode, string? method) {
+        method = string.IsNullOrWhiteSpace(method) ? "SSPI Call" : method;
+        var errMsg = new Win32Exception(errorCode).Message;
 
-        return String.Format("{0} failed ({1}, Win32ErrorCode {2} - 0x{2:X8})", method, errMsg, errorCode);
+        return string.Format("{0} failed ({1}, Win32ErrorCode {2} - 0x{2:X8})", method, errMsg, errorCode);
     }
 }
 
 /// <summary>User identity information used to acquire a credential handle.</summary>
-internal class WinNTAuthIdentity
-{
+internal class WinNTAuthIdentity {
     /// <summary>The username of the identity.</summary>
     public string? Username { get; }
 
@@ -455,16 +413,14 @@ internal class WinNTAuthIdentity
     /// <summary>The password of the identity.</summary>
     public string? Password { get; }
 
-    public WinNTAuthIdentity(string? username, string? domain, string? password)
-    {
+    public WinNTAuthIdentity(string? username, string? domain, string? password) {
         Username = username;
         Domain = domain;
         Password = password;
     }
 }
 
-internal enum CredentialUse : uint
-{
+internal enum CredentialUse : uint {
     SECPKG_CRED_INBOUND = 0x00000001,
     SECPKG_CRED_OUTBOUND = 0x00000002,
     SECPKG_CRED_BOTH = 0x00000003,
@@ -474,8 +430,7 @@ internal enum CredentialUse : uint
 }
 
 [Flags]
-internal enum InitiatorContextRequestFlags : uint
-{
+internal enum InitiatorContextRequestFlags : uint {
     ISC_REQ_DELEGATE = 0x00000001,
     ISC_REQ_MUTUAL_AUTH = 0x00000002,
     ISC_REQ_REPLAY_DETECT = 0x00000004,
@@ -506,8 +461,7 @@ internal enum InitiatorContextRequestFlags : uint
 }
 
 [Flags]
-internal enum InitiatorContextReturnFlags : uint
-{
+internal enum InitiatorContextReturnFlags : uint {
     ISC_RET_DELEGATE = 0x00000001,
     ISC_RET_MUTUAL_AUTH = 0x00000002,
     ISC_RET_REPLAY_DETECT = 0x00000004,
@@ -537,15 +491,13 @@ internal enum InitiatorContextReturnFlags : uint
     ISC_RET_CONFIDENTIALITY_ONLY = 0x40000000,
 }
 
-internal enum SecBufferFlags : uint
-{
+internal enum SecBufferFlags : uint {
     SECBUFFER_READONLY_WITH_CHECKSUM = 0x10000000,
     SECBUFFER_RESERVED = 0x60000000,
     SECBUFFER_READONLY = 0x80000000,
 }
 
-internal enum SecBufferType : uint
-{
+internal enum SecBufferType : uint {
     SECBUFFER_EMPTY = 0,
     SECBUFFER_DATA = 1,
     SECBUFFER_TOKEN = 2,
@@ -572,8 +524,7 @@ internal enum SecBufferType : uint
     SECBUFFER_PRESHARED_KEY_IDENTITY = 23,
 }
 
-internal enum SecPkgAttribute : uint
-{
+internal enum SecPkgAttribute : uint {
     SECPKG_ATTR_SIZES = 0,
     SECPKG_ATTR_NAMES = 1,
     SECPKG_ATTR_LIFESPAN = 2,
@@ -613,58 +564,51 @@ internal enum SecPkgAttribute : uint
     SECPKG_ATTR_IS_LOOPBACK = 37,
 }
 
-internal enum TargetDataRep : uint
-{
+internal enum TargetDataRep : uint {
     SECURITY_NETWORK_DREP = 0x00000000,
     SECURITY_NATIVE_DREP = 0x00000010,
 }
 
-internal enum WinNTAuthIdentityFlags : uint
-{
+internal enum WinNTAuthIdentityFlags : uint {
     SEC_WINNT_AUTH_IDENTITY_ANSI = 1,
     SEC_WINNT_AUTH_IDENTITY_UNICODE = 2,
 }
 
-internal class SafeSspiCredentialHandle : SafeHandle
-{
+internal class SafeSspiCredentialHandle : SafeHandle {
     internal bool SSPIFree = false;
 
     internal SafeSspiCredentialHandle()
-        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true)
-    { }
+        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true) {
+    }
 
     public override bool IsInvalid => handle == IntPtr.Zero;
 
-    protected override bool ReleaseHandle()
-    {
-        if (SSPIFree)
-        {
+    protected override bool ReleaseHandle() {
+        if (SSPIFree) {
             SSPI.FreeCredentialsHandle(handle);
         }
+
         Marshal.FreeHGlobal(handle);
 
         return true;
     }
 }
 
-internal class SafeSspiContextHandle : SafeHandle
-{
+internal class SafeSspiContextHandle : SafeHandle {
     internal bool SSPIFree = false;
 
     internal SafeSspiContextHandle()
-        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true)
-    { }
+        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true) {
+    }
 
     internal SafeSspiContextHandle(IntPtr handle, bool ownsHandle)
-        : base(handle, ownsHandle)
-    { }
+        : base(handle, ownsHandle) {
+    }
 
     public override bool IsInvalid => handle == IntPtr.Zero;
 
-    protected override bool ReleaseHandle()
-    {
-        if (SSPIFree)
-        {
+    protected override bool ReleaseHandle() {
+        if (SSPIFree) {
             SSPI.DeleteSecurityContext(handle);
         }
 
diff --git a/src/SharpHoundRPC/SharpHoundRPC.csproj b/src/SharpHoundRPC/SharpHoundRPC.csproj
index 97607291..dab587b7 100644
--- a/src/SharpHoundRPC/SharpHoundRPC.csproj
+++ b/src/SharpHoundRPC/SharpHoundRPC.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
-        <TargetFramework>net462</TargetFramework>
+        <TargetFramework>net472</TargetFramework>
         <OutputType>library</OutputType>
         <PackageId>SharpHoundRPC</PackageId>
         <LangVersion>9</LangVersion>

From 129db7b0d1ed5c9f6e7bd95a2eaa27ff874d6c90 Mon Sep 17 00:00:00 2001
From: Rohan Vazarkar <rvazarkar@specterops.io>
Date: Mon, 16 Dec 2024 10:02:50 -0500
Subject: [PATCH 4/5] chore: small fixes

---
 src/CommonLib/Extensions.cs                 | 2 +-
 src/CommonLib/LdapProducerQueryGenerator.cs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/CommonLib/Extensions.cs b/src/CommonLib/Extensions.cs
index 570a2b58..e582b273 100644
--- a/src/CommonLib/Extensions.cs
+++ b/src/CommonLib/Extensions.cs
@@ -186,7 +186,7 @@ public static string LdapValue(this Guid s)
         /// <param name="methods"></param>
         /// <returns></returns>
         public static bool IsComputerCollectionSet(this CollectionMethod methods) {
-            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn | CollectionMethod.SmbInfo | CollectionMethod.SmbInfo;
+            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn | CollectionMethod.SmbInfo | CollectionMethod.WebClientService;
             return (methods & test) != 0;
         }
 
diff --git a/src/CommonLib/LdapProducerQueryGenerator.cs b/src/CommonLib/LdapProducerQueryGenerator.cs
index 14ac7db0..25c6cb9b 100644
--- a/src/CommonLib/LdapProducerQueryGenerator.cs
+++ b/src/CommonLib/LdapProducerQueryGenerator.cs
@@ -47,7 +47,7 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
             if (methods.HasFlag(CollectionMethod.SPNTargets))
                 properties.AddRange(CommonProperties.SPNTargetProps);
 
-            if (methods.HasFlag(CollectionMethod.DCRegistry) || methods.HasFlag(CollectionMethod.LdapServices))
+            if (methods.IsComputerCollectionSet())
                 properties.AddRange(CommonProperties.ComputerMethodProps);
 
             if (methods.HasFlag(CollectionMethod.SPNTargets)) {

From 22f0c103459fbeb736e227299a35f226fc04b8af Mon Sep 17 00:00:00 2001
From: Rohan Vazarkar <rvazarkar@specterops.io>
Date: Wed, 8 Jan 2025 10:33:38 -0500
Subject: [PATCH 5/5] chore: small fixes

---
 .../Ntlm/HttpNtlmAuthenticationService.cs        | 16 ++++++++--------
 src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs  |  3 +--
 src/CommonLib/OutputTypes/NtlmSession.cs         |  2 +-
 .../Processors/WebClientServiceProcessor.cs      |  1 +
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
index d535c011..75973403 100644
--- a/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
+++ b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
@@ -17,25 +17,25 @@ public HttpNtlmAuthenticationService(IHttpClientFactory httpClientFactory, ILogg
         _httpClientFactory = httpClientFactory;
     }
 
-    public async Task EnsureRequiresAuth(Uri Url, bool? useBadChannelBindings) {
-        if (Url == null)
+    public async Task EnsureRequiresAuth(Uri url, bool? useBadChannelBindings) {
+        if (url == null)
             throw new ArgumentException("Url property is null");
 
-        if (useBadChannelBindings == null && Url.Scheme == "https")
+        if (useBadChannelBindings == null && url.Scheme == "https")
             throw new ArgumentException("When using HTTPS, useBadChannelBindings must be set");
 
-        var supportedAuthSchemes = await GetSupportedNtlmAuthSchemesAsync(Url);
+        var supportedAuthSchemes = await GetSupportedNtlmAuthSchemesAsync(url);
 
-        _logger.LogDebug($"Supported NTLM auth schemes for {Url}: " + string.Join(",", supportedAuthSchemes));
+        _logger.LogDebug($"Supported NTLM auth schemes for {url}: " + string.Join(",", supportedAuthSchemes));
 
         foreach (var authScheme in supportedAuthSchemes) {
             if (useBadChannelBindings == null) {
-                await AuthWithBadChannelBindings(Url, authScheme);
+                await AuthWithBadChannelBindings(url, authScheme);
             } else {
                 if ((bool)useBadChannelBindings) {
-                    await AuthWithBadChannelBindings(Url, authScheme);
+                    await AuthWithBadChannelBindings(url, authScheme);
                 } else {
-                    await AuthWithChannelBindingAsync(Url, authScheme);
+                    await AuthWithChannelBindingAsync(url, authScheme);
                 }
             }
 
diff --git a/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
index f4a10914..83995a82 100644
--- a/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
+++ b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
@@ -22,8 +22,7 @@ public NtlmAuthenticationHandler(string targetService, ILogger logger = null)
         _logger = logger ?? Logging.LogProvider.CreateLogger("NtlmAuthenticationHandler");
         _targetService = targetService;
 
-        Options = new LdapAuthOptions()
-        {
+        Options = new LdapAuthOptions {
             Signing = false,
             Bindings = null
         };
diff --git a/src/CommonLib/OutputTypes/NtlmSession.cs b/src/CommonLib/OutputTypes/NtlmSession.cs
index 9a58a056..f17230ca 100644
--- a/src/CommonLib/OutputTypes/NtlmSession.cs
+++ b/src/CommonLib/OutputTypes/NtlmSession.cs
@@ -36,7 +36,7 @@ public override string ToString() {
             var targetUser = AccountDomain + "\\" + AccountName;
             var source = (SourceIp != null || SourcePort != null) ? $"{SourceIp}:{SourcePort}" : "";
 
-            return ($"  {TimeCreatedUtc?.ToLocalTime()},{Id},{targetUser},{AccountSid},{SourceHost},,{PackageName}");
+            return ($"{TimeCreatedUtc?.ToLocalTime()},{Id},{targetUser},{AccountSid},{SourceHost},{source},{PackageName}");
         }
 
         public static NtlmSession FromLogonEvent(EventRecord evnt) {
diff --git a/src/CommonLib/Processors/WebClientServiceProcessor.cs b/src/CommonLib/Processors/WebClientServiceProcessor.cs
index 6cab7308..d0688f21 100644
--- a/src/CommonLib/Processors/WebClientServiceProcessor.cs
+++ b/src/CommonLib/Processors/WebClientServiceProcessor.cs
@@ -39,6 +39,7 @@ public static extern SafeFileHandle CreateFile(
             IntPtr hTemplateFile);
 
         public static bool TestPathExists(string path) {
+            //The CreateFile API is used here because File.Create throws exceptions for pipes. Using these lower level APIs is easier to deal with
             using var handle = CreateFile(
                 path,
                 MAXIMUM_ALLOWED, // Request maximum allowed access