AD Sync — service and miiserver enum
Ctrl+F:
ADSync·Get-Item·Get-ItemProperty·miiserver.exe· Azure AD Connect
Azure AD Connect Sync (service name ADSync) runs on a Windows server and syncs on-prem AD to Azure AD. On a compromised sync server, these commands confirm the service exists, where binaries live, and version/path details for further abuse (credential stores, config files, DCSync-related paths).
Hub → PowerShell Snippets · cmdlet reference → PowerShell Cmdlets > 📌 7) Registry
Command 1 — ADSync service registry key
Get-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\ADSyncWhat it does
Get-Item returns the registry key object for the ADSync Windows service — same tree as regedit → HKLM\SYSTEM\CurrentControlSet\Services\ADSync.
You see the key container; use Get-ItemProperty on the same path for values (ImagePath, Start, ObjectName, etc.).
Read service values (companion command)
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ADSync
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ADSync |
Format-List -Property * -Force| Value (typical) | Meaning |
|---|---|
ImagePath | Binary that starts the service |
Start | 2 = Automatic, 3 = Manual |
ObjectName | Service account (often NT SERVICE\ADSync or domain account) |
DisplayName | Azure AD Connect Sync |
Alternative — Get-Service
Get-Service -Name ADSync
Get-CimInstance Win32_Service -Filter "Name='ADSync'" |
Select Name, State, StartName, PathNameCommand 2 — miiserver.exe file properties
Get-ItemProperty -Path "C:\Program Files\Microsoft Azure AD Sync\Bin\miiserver.exe" |
Format-List -Property * -ForceWhat it does
Get-ItemProperty on a file path returns the PowerShell file item property bag — size, dates, attributes, and VersionInfo (product version, company, original filename).
Format-List -Property * -Force prints every property (including hidden/default) — useful when hunting version strings, signing info, or paths referenced in metadata.
Why miiserver.exe?
miiserver.exe is the core Microsoft Identity Integration Server engine for Azure AD Connect Sync. Confirming it exists proves the full sync stack is installed (not just the ADSync service entry).
Related paths to check
Test-Path "C:\Program Files\Microsoft Azure AD Sync\"
Get-ChildItem "C:\Program Files\Microsoft Azure AD Sync\" -Recurse -ErrorAction SilentlyContinue |
Select FullName
# Config / cred-related (enum only — do not exfil outside lab rules)
Get-ChildItem "C:\Program Files\Microsoft Azure AD Sync\Data\" -ErrorAction SilentlyContinueWhen to use (OSCP / AD)
| Scenario | Action |
|---|---|
| Box mentions Azure AD Connect, Entra, hybrid AD | Run both commands |
| You have shell on server that syncs to cloud | Confirm ADSync + binary version |
| Privesc / lateral — high-value server role | Note service account from ObjectName / StartName |
| BloodHound / AD path to sync server | Validate before hunting sync credentials |
→ Active Directory · AD · PowerView
Full copy-paste block
# Service registry key
Get-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\ADSync
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ADSync |
Format-List -Property * -Force
# Sync engine binary
Get-ItemProperty -Path "C:\Program Files\Microsoft Azure AD Sync\Bin\miiserver.exe" |
Format-List -Property * -Force
# Quick service status
Get-Service ADSync -ErrorAction SilentlyContinueExternal docs
- Get-Item — Microsoft Learn
- Get-ItemProperty — Microsoft Learn
- SS64 — Get-Item · SS64 — Get-ItemProperty
Full cmdlet wiki → PowerShell Snippets > 📌 External references (detailed Windows / PowerShell wikis)