diff --git a/src/CommonLib/Enums/CollectionMethod.cs b/src/CommonLib/Enums/CollectionMethod.cs
index 0b5959e1..84c8ec91 100644
--- a/src/CommonLib/Enums/CollectionMethod.cs
+++ b/src/CommonLib/Enums/CollectionMethod.cs
@@ -1,10 +1,8 @@
 using System;
 
-namespace SharpHoundCommonLib.Enums
-{
+namespace SharpHoundCommonLib.Enums {
     [Flags]
-    public enum CollectionMethod
-    {
+    public enum CollectionMethod {
         None = 0,
         Group = 1,
         LocalAdmin = 1 << 1,
@@ -25,10 +23,18 @@ public enum CollectionMethod
         CARegistry = 1 << 16,
         DCRegistry = 1 << 17,
         CertServices = 1 << 18,
+        LdapServices = 1 << 19,
+        WebClientService = 1 << 21,
+        SmbInfo = 1 << 22,
+        EventLogs = 1 << 23,
         LocalGroups = DCOM | RDP | LocalAdmin | PSRemote,
-        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry,
-        DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup | CertServices,
-        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices,
-        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry
+        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry | WebClientService | SmbInfo,
+        DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup | CertServices | LdapServices | SmbInfo,
+
+        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices |
+                  LdapServices | SmbInfo,
+
+        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry | WebClientService |
+              LdapServices
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Enums/EventIds.cs b/src/CommonLib/Enums/EventIds.cs
new file mode 100644
index 00000000..ee93ed5c
--- /dev/null
+++ b/src/CommonLib/Enums/EventIds.cs
@@ -0,0 +1,6 @@
+namespace SharpHoundCommonLib.Enums;
+
+public class EventIds {
+    public static int LogonEvent = 4624;
+    public static int ValidateCredentialsEvent = 4776;
+}
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapErrorCodes.cs b/src/CommonLib/Enums/LdapErrorCodes.cs
index becf71c4..c6f81b62 100644
--- a/src/CommonLib/Enums/LdapErrorCodes.cs
+++ b/src/CommonLib/Enums/LdapErrorCodes.cs
@@ -1,12 +1,12 @@
-namespace SharpHoundCommonLib.Enums
-{
-    public enum LdapErrorCodes : int
-    {
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapErrorCodes : int {
         Success = 0,
+        StrongAuthRequired = 8,
+        SaslBindInProgress = 14,
         InvalidCredentials = 49,
         Busy = 51,
         ServerDown = 81,
         LocalError = 82,
-        KerberosAuthType = 83
+        KerberosAuthType = 83,
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapOption.cs b/src/CommonLib/Enums/LdapOption.cs
new file mode 100644
index 00000000..a0403253
--- /dev/null
+++ b/src/CommonLib/Enums/LdapOption.cs
@@ -0,0 +1,12 @@
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapOption : int {
+        Ssl = 0x0A,
+        ProtocolVersion = 0x11,
+        ResultCode = 0x31,
+        ServerError = 0x33,
+        ServerCertificate = 0x81,
+        Sign = 0x95,
+        Encrypt = 0x96,
+        Timeout = 0x5002,
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapOptionValue.cs b/src/CommonLib/Enums/LdapOptionValue.cs
new file mode 100644
index 00000000..16e5fb9a
--- /dev/null
+++ b/src/CommonLib/Enums/LdapOptionValue.cs
@@ -0,0 +1,13 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapOptionValue : int {
+        Off = 0,
+        On = 1,
+        Version3 = 3,
+    };
+}
\ No newline at end of file
diff --git a/src/CommonLib/Enums/LdapSupportedSaslMechanisms.cs b/src/CommonLib/Enums/LdapSupportedSaslMechanisms.cs
new file mode 100644
index 00000000..37736c70
--- /dev/null
+++ b/src/CommonLib/Enums/LdapSupportedSaslMechanisms.cs
@@ -0,0 +1,14 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Enums {
+    public static class LdapSupportedSaslMechanisms {
+        public const string GSSAPI = "GSSAPI";
+        public const string GSS_SPNEGO = "GSS-SPNEGO";
+        public const string EXTERNAL = "EXTERNAL";
+        public const string DIGEST_MD5 = "DIGEST_MD5";
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Extensions.cs b/src/CommonLib/Extensions.cs
index be102fd9..e582b273 100644
--- a/src/CommonLib/Extensions.cs
+++ b/src/CommonLib/Extensions.cs
@@ -186,7 +186,7 @@ public static string LdapValue(this Guid s)
         /// <param name="methods"></param>
         /// <returns></returns>
         public static bool IsComputerCollectionSet(this CollectionMethod methods) {
-            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn;
+            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn | CollectionMethod.SmbInfo | CollectionMethod.WebClientService;
             return (methods & test) != 0;
         }
 
diff --git a/src/CommonLib/Impersonate.cs b/src/CommonLib/Impersonate.cs
index f6e03aae..5c8ba694 100644
--- a/src/CommonLib/Impersonate.cs
+++ b/src/CommonLib/Impersonate.cs
@@ -86,11 +86,11 @@ public class Impersonator : IDisposable {
         /// <summary>
         /// Begins impersonation with the given credentials, Logon type and Logon provider.
         /// </summary>
-        ///<param name = "userName" > Name of the user.</param>
-        ///<param name = "domainName" > Name of the domain.</param>
-        ///<param name = "password" > The password. <see cref = "System.String" /></ param >
-        ///< param name="logonType">Type of the logon.</param>
-        ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></ param >
+        ///<param name="userName" > Name of the user.</param>
+        ///<param name="domainName" > Name of the domain.</param>
+        ///<param name="password" > The password.</param >
+        ///<param name="logonType">Type of the logon.</param>
+        ///<param name="logonProvider" > The logon provider. <see cref="Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider"/></param >
         public Impersonator(string userName, string domainName, string password, LogonType logonType,
             LogonProvider logonProvider) {
             Impersonate(userName, domainName, password, logonType, logonProvider);
@@ -125,10 +125,11 @@ public void Dispose() {
         /// </summary>
         ///<param name = "userName" > Name of the user.</param>
         ///<param name = "domainName" > Name of the domain.</param>
-        ///<param name = "password" > The password. <see cref = "System.String" /></ param >
-        ///< param name="logonType">Type of the logon.</param>
+        ///<param name = "password" > The password. <see cref = "System.String" /></param >
+        ///<param name="logonType">Type of the logon.</param>
         ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></ param >
-        public void Impersonate(string userName, string domainName, string password, LogonType logonType = LogonType.LOGON32_LOGON_INTERACTIVE,
+        public void Impersonate(string userName, string domainName, string password,
+            LogonType logonType = LogonType.LOGON32_LOGON_INTERACTIVE,
             LogonProvider logonProvider = LogonProvider.LOGON32_PROVIDER_DEFAULT) {
             UndoImpersonation();
 
@@ -149,14 +150,11 @@ public void Impersonate(string userName, string domainName, string password, Log
                             ref logonTokenDuplicate) != 0) {
                         var wi = new WindowsIdentity(logonTokenDuplicate);
                         wi.Impersonate(); // discard the returned identity context (which is the context of the application pool)
-                    }
-                    else
+                    } else
                         throw new Win32Exception(Marshal.GetLastWin32Error());
-                }
-                else
+                } else
                     throw new Win32Exception(Marshal.GetLastWin32Error());
-            }
-            finally {
+            } finally {
                 if (logonToken != IntPtr.Zero)
                     Win32NativeMethods.CloseHandle(logonToken);
 
diff --git a/src/CommonLib/LdapConnectionPool.cs b/src/CommonLib/LdapConnectionPool.cs
index 5ec804e5..1073f960 100644
--- a/src/CommonLib/LdapConnectionPool.cs
+++ b/src/CommonLib/LdapConnectionPool.cs
@@ -16,10 +16,10 @@
 using SharpHoundRPC.NetAPINative;
 
 namespace SharpHoundCommonLib {
-    internal class LdapConnectionPool : IDisposable{
+    internal class LdapConnectionPool : IDisposable {
         private readonly ConcurrentBag<LdapConnectionWrapper> _connections;
         private readonly ConcurrentBag<LdapConnectionWrapper> _globalCatalogConnection;
-        private readonly SemaphoreSlim _semaphore;
+        private readonly SemaphoreSlim _semaphore = null;
         private readonly string _identifier;
         private readonly string _poolIdentifier;
         private readonly LdapConfig _ldapConfig;
@@ -45,7 +45,7 @@ public LdapConnectionPool(string identifier, string poolIdentifier, LdapConfig c
             //     //If MaxConcurrentQueries is 0, we'll just disable the semaphore entirely
             //     _semaphore = null;
             // }
-            
+
             _identifier = identifier;
             _poolIdentifier = poolIdentifier;
             _ldapConfig = config;
@@ -53,14 +53,16 @@ public LdapConnectionPool(string identifier, string poolIdentifier, LdapConfig c
             _portScanner = scanner ?? new PortScanner();
             _nativeMethods = nativeMethods ?? new NativeMethods();
         }
-        
-        private async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)> GetLdapConnection(bool globalCatalog) {
+
+        private async Task<(bool Success, LdapConnectionWrapper ConnectionWrapper, string Message)> GetLdapConnection(
+            bool globalCatalog) {
             if (globalCatalog) {
                 return await GetGlobalCatalogConnectionAsync();
             }
+
             return await GetConnectionAsync();
         }
-        
+
         public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParameters queryParameters,
             [EnumeratorCancellation] CancellationToken cancellationToken = new()) {
             var setupResult = await SetupLdapQuery(queryParameters);
@@ -86,11 +88,14 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
             SearchResponse response = null;
             while (!cancellationToken.IsCancellationRequested) {
                 //Grab our semaphore here to take one of our query slots
-                if (_semaphore != null){
-                    _log.LogTrace("Query entering semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                if (_semaphore != null) {
+                    _log.LogTrace("Query entering semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     await _semaphore.WaitAsync(cancellationToken);
-                    _log.LogTrace("Query entered semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                    _log.LogTrace("Query entered semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                 }
+
                 try {
                     _log.LogTrace("Sending ldap request - {Info}", queryParameters.GetQueryInfo());
                     response = (SearchResponse)connectionWrapper.Connection.SendRequest(searchRequest);
@@ -117,7 +122,8 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                      * since non-paged queries do not require same server connections
                      */
                     queryRetryCount++;
-                    _log.LogDebug("Query - Attempting to recover from ServerDown for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), queryRetryCount);
+                    _log.LogDebug("Query - Attempting to recover from ServerDown for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), queryRetryCount);
                     ReleaseConnection(connectionWrapper, true);
 
                     for (var retryCount = 0; retryCount < MaxRetries; retryCount++) {
@@ -148,7 +154,8 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                      * The expectation is that given enough time, the server should stop being busy and service our query appropriately
                      */
                     busyRetryCount++;
-                    _log.LogDebug("Query - Executing busy backoff for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), busyRetryCount);
+                    _log.LogDebug("Query - Executing busy backoff for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), busyRetryCount);
                     var backoffDelay = GetNextBackoff(busyRetryCount);
                     await Task.Delay(backoffDelay, cancellationToken);
                 } catch (LdapException le) {
@@ -168,9 +175,11 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                 } finally {
                     // Always release our semaphore to prevent deadlocks
                     if (_semaphore != null) {
-                        _log.LogTrace("Query releasing semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());    
+                        _log.LogTrace("Query releasing semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                         _semaphore.Release();
-                        _log.LogTrace("Query released semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                        _log.LogTrace("Query released semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     }
                 }
 
@@ -197,7 +206,7 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> Query(LdapQueryParam
                 yield return LdapResult<IDirectoryObject>.Ok(new SearchResultEntryWrapper(entry));
             }
         }
-        
+
         public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParameters queryParameters,
             [EnumeratorCancellation] CancellationToken cancellationToken = new()) {
             var setupResult = await SetupLdapQuery(queryParameters);
@@ -225,11 +234,14 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
             LdapResult<IDirectoryObject> tempResult = null;
 
             while (!cancellationToken.IsCancellationRequested) {
-                if (_semaphore != null){
-                    _log.LogTrace("PagedQuery entering semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                if (_semaphore != null) {
+                    _log.LogTrace("PagedQuery entering semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     await _semaphore.WaitAsync(cancellationToken);
-                    _log.LogTrace("PagedQuery entered semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                    _log.LogTrace("PagedQuery entered semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                 }
+
                 SearchResponse response = null;
                 try {
                     _log.LogTrace("Sending paged ldap request - {Info}", queryParameters.GetQueryInfo());
@@ -247,15 +259,15 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                     }
                 } catch (LdapException le) when (le.ErrorCode == (int)LdapErrorCodes.ServerDown) {
                     /*
-                    * A ServerDown exception indicates that our connection is no longer valid for one of many reasons.
-                    * We'll want to release our connection back to the pool, but dispose it. We need a new connection,
-                    * and because this is not a paged query, we can get this connection from anywhere.
-                    *
-                    * We use queryRetryCount here to prevent an infinite retry loop from occurring
-                    *
-                    * Release our connection in a faulted state since the connection is defunct.
-                    * Paged queries require a connection to be made to the same server which we started the paged query on 
-                    */
+                     * A ServerDown exception indicates that our connection is no longer valid for one of many reasons.
+                     * We'll want to release our connection back to the pool, but dispose it. We need a new connection,
+                     * and because this is not a paged query, we can get this connection from anywhere.
+                     *
+                     * We use queryRetryCount here to prevent an infinite retry loop from occurring
+                     *
+                     * Release our connection in a faulted state since the connection is defunct.
+                     * Paged queries require a connection to be made to the same server which we started the paged query on
+                     */
                     if (serverName == null) {
                         _log.LogError(
                             "PagedQuery - Received server down exception without a known servername. Unable to generate new connection\n{Info}",
@@ -263,9 +275,11 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                         ReleaseConnection(connectionWrapper, true);
                         yield break;
                     }
-                    
-                    _log.LogDebug("PagedQuery - Attempting to recover from ServerDown for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), queryRetryCount);
-                    
+
+                    _log.LogDebug(
+                        "PagedQuery - Attempting to recover from ServerDown for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), queryRetryCount);
+
                     ReleaseConnection(connectionWrapper, true);
                     for (var retryCount = 0; retryCount < MaxRetries; retryCount++) {
                         var backoffDelay = GetNextBackoff(retryCount);
@@ -293,7 +307,8 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                      * The expectation is that given enough time, the server should stop being busy and service our query appropriately
                      */
                     busyRetryCount++;
-                    _log.LogDebug("PagedQuery - Executing busy backoff for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), busyRetryCount);
+                    _log.LogDebug("PagedQuery - Executing busy backoff for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), busyRetryCount);
                     var backoffDelay = GetNextBackoff(busyRetryCount);
                     await Task.Delay(backoffDelay, cancellationToken);
                 } catch (LdapException le) {
@@ -306,9 +321,11 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                             queryParameters);
                 } finally {
                     if (_semaphore != null) {
-                        _log.LogTrace("PagedQuery releasing semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());    
+                        _log.LogTrace("PagedQuery releasing semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                         _semaphore.Release();
-                        _log.LogTrace("PagedQuery released semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                        _log.LogTrace("PagedQuery released semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     }
                 }
 
@@ -351,7 +368,7 @@ public async IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQuery
                 pageControl.Cookie = pageResponse.Cookie;
             }
         }
-        
+
         private async Task<LdapQuerySetupResult> SetupLdapQuery(LdapQueryParameters queryParameters) {
             var result = new LdapQuerySetupResult();
             var (success, connectionWrapper, message) =
@@ -392,10 +409,10 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
                 yield return Result<string>.Fail(connectionResult.Message);
                 yield break;
             }
-            
+
             var index = 0;
             var step = 0;
-            
+
             //Start by using * as our upper index, which will automatically give us the range size
             var currentRange = $"{attributeName};range={index}-*";
             var complete = false;
@@ -414,7 +431,7 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
                 yield return Result<string>.Fail("Failed to create search request");
                 yield break;
             }
-            
+
             var queryRetryCount = 0;
             var busyRetryCount = 0;
 
@@ -422,22 +439,28 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
 
             while (!cancellationToken.IsCancellationRequested) {
                 SearchResponse response = null;
-                if (_semaphore != null){
-                    _log.LogTrace("RangedRetrieval entering semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                if (_semaphore != null) {
+                    _log.LogTrace("RangedRetrieval entering semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     await _semaphore.WaitAsync(cancellationToken);
-                    _log.LogTrace("RangedRetrieval entered semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                    _log.LogTrace("RangedRetrieval entered semaphore with {Count} remaining for query {Info}",
+                        _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                 }
+
                 try {
                     response = (SearchResponse)connectionWrapper.Connection.SendRequest(searchRequest);
                 } catch (LdapException le) when (le.ErrorCode == (int)ResultCode.Busy && busyRetryCount < MaxRetries) {
                     busyRetryCount++;
-                    _log.LogDebug("RangedRetrieval - Executing busy backoff for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), busyRetryCount);
+                    _log.LogDebug("RangedRetrieval - Executing busy backoff for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), busyRetryCount);
                     var backoffDelay = GetNextBackoff(busyRetryCount);
                     await Task.Delay(backoffDelay, cancellationToken);
                 } catch (LdapException le) when (le.ErrorCode == (int)LdapErrorCodes.ServerDown &&
                                                  queryRetryCount < MaxRetries) {
                     queryRetryCount++;
-                    _log.LogDebug("RangedRetrieval - Attempting to recover from ServerDown for query {Info} (Attempt {Count})", queryParameters.GetQueryInfo(), queryRetryCount);
+                    _log.LogDebug(
+                        "RangedRetrieval - Attempting to recover from ServerDown for query {Info} (Attempt {Count})",
+                        queryParameters.GetQueryInfo(), queryRetryCount);
                     ReleaseConnection(connectionWrapper, true);
                     for (var retryCount = 0; retryCount < MaxRetries; retryCount++) {
                         var backoffDelay = GetNextBackoff(retryCount);
@@ -472,9 +495,11 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
                         LdapResult<string>.Fail($"Caught unrecoverable exception: {e.Message}", queryParameters);
                 } finally {
                     if (_semaphore != null) {
-                        _log.LogTrace("RangedRetrieval releasing semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());    
+                        _log.LogTrace("RangedRetrieval releasing semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                         _semaphore.Release();
-                        _log.LogTrace("RangedRetrieval released semaphore with {Count} remaining for query {Info}", _semaphore.CurrentCount, queryParameters.GetQueryInfo());
+                        _log.LogTrace("RangedRetrieval released semaphore with {Count} remaining for query {Info}",
+                            _semaphore.CurrentCount, queryParameters.GetQueryInfo());
                     }
                 }
 
@@ -526,13 +551,13 @@ public async IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguish
 
             ReleaseConnection(connectionWrapper);
         }
-        
+
         private static TimeSpan GetNextBackoff(int retryCount) {
             return TimeSpan.FromSeconds(Math.Min(
                 MinBackoffDelay.TotalSeconds * Math.Pow(BackoffDelayMultiplier, retryCount),
                 MaxBackoffDelay.TotalSeconds));
         }
-        
+
         private bool CreateSearchRequest(LdapQueryParameters queryParameters,
             LdapConnectionWrapper connectionWrapper, out SearchRequest searchRequest) {
             string basePath;
@@ -543,7 +568,7 @@ private bool CreateSearchRequest(LdapQueryParameters queryParameters,
                 if (CallDsGetDcName(queryParameters.DomainName, out var info) && info != null) {
                     tempPath = Helpers.DomainNameToDistinguishedName(info.Value.DomainName);
                     connectionWrapper.SaveContext(queryParameters.NamingContext, basePath);
-                } else if (LdapUtils.GetDomain(queryParameters.DomainName,_ldapConfig,  out var domainObject)) {
+                } else if (LdapUtils.GetDomain(queryParameters.DomainName, _ldapConfig, out var domainObject)) {
                     tempPath = Helpers.DomainNameToDistinguishedName(domainObject.Name);
                 } else {
                     searchRequest = null;
@@ -559,8 +584,9 @@ private bool CreateSearchRequest(LdapQueryParameters queryParameters,
 
                 connectionWrapper.SaveContext(queryParameters.NamingContext, basePath);
             }
-            
-            if (string.IsNullOrWhiteSpace(queryParameters.SearchBase) && !string.IsNullOrWhiteSpace(queryParameters.RelativeSearchBase)) {
+
+            if (string.IsNullOrWhiteSpace(queryParameters.SearchBase) &&
+                !string.IsNullOrWhiteSpace(queryParameters.RelativeSearchBase)) {
                 basePath = $"{queryParameters.RelativeSearchBase},{basePath}";
             }
 
@@ -579,7 +605,7 @@ private bool CreateSearchRequest(LdapQueryParameters queryParameters,
 
             return true;
         }
-        
+
         private bool CallDsGetDcName(string domainName, out NetAPIStructs.DomainControllerInfo? info) {
             if (DCInfoCache.TryGetValue(domainName.ToUpper().Trim(), out info)) return info != null;
 
@@ -607,7 +633,7 @@ private bool CallDsGetDcName(string domainName, out NetAPIStructs.DomainControll
                 if (!success) {
                     return (false, null, message);
                 }
-            
+
                 connectionWrapper = connection;
             }
 
@@ -641,39 +667,40 @@ public void ReleaseConnection(LdapConnectionWrapper connectionWrapper, bool conn
             if (!connectionFaulted) {
                 if (connectionWrapper.GlobalCatalog) {
                     _globalCatalogConnection.Add(connectionWrapper);
+                } else {
+                    _connections.Add(connectionWrapper);
                 }
-                else {
-                    _connections.Add(connectionWrapper);    
-                }
-            }
-            else {
+            } else {
                 connectionWrapper.Connection.Dispose();
             }
         }
-    
+
         public void Dispose() {
             while (_connections.TryTake(out var wrapper)) {
                 wrapper.Connection.Dispose();
             }
         }
 
-        private async Task<(bool Success, LdapConnectionWrapper Connection, string Message)> CreateNewConnection(bool globalCatalog = false) {
+        private async Task<(bool Success, LdapConnectionWrapper Connection, string Message)> CreateNewConnection(
+            bool globalCatalog = false) {
             try {
                 if (!string.IsNullOrWhiteSpace(_ldapConfig.Server)) {
                     return CreateNewConnectionForServer(_ldapConfig.Server, globalCatalog);
                 }
 
                 if (CreateLdapConnection(_identifier.ToUpper().Trim(), globalCatalog, out var connectionWrapper)) {
-                    _log.LogDebug("Successfully created ldap connection for domain: {Domain} using strategy 1. SSL: {SSl}", _identifier, connectionWrapper.Connection.SessionOptions.SecureSocketLayer);
+                    _log.LogDebug(
+                        "Successfully created ldap connection for domain: {Domain} using strategy 1. SSL: {SSl}",
+                        _identifier, connectionWrapper.Connection.SessionOptions.SecureSocketLayer);
                     return (true, connectionWrapper, "");
                 }
-            
+
                 string tempDomainName;
-            
+
                 var dsGetDcNameResult = _nativeMethods.CallDsGetDcName(null, _identifier,
                     (uint)(NetAPIEnums.DSGETDCNAME_FLAGS.DS_FORCE_REDISCOVERY |
-                        NetAPIEnums.DSGETDCNAME_FLAGS.DS_RETURN_DNS_NAME |
-                        NetAPIEnums.DSGETDCNAME_FLAGS.DS_DIRECTORY_SERVICE_REQUIRED));
+                           NetAPIEnums.DSGETDCNAME_FLAGS.DS_RETURN_DNS_NAME |
+                           NetAPIEnums.DSGETDCNAME_FLAGS.DS_DIRECTORY_SERVICE_REQUIRED));
                 if (dsGetDcNameResult.IsSuccess) {
                     tempDomainName = dsGetDcNameResult.Value.DomainName;
 
@@ -684,7 +711,7 @@ public void Dispose() {
                             _identifier, tempDomainName);
                         return (true, connectionWrapper, "");
                     }
-                
+
                     var server = dsGetDcNameResult.Value.DomainControllerName.TrimStart('\\');
 
                     var result =
@@ -696,7 +723,7 @@ public void Dispose() {
                         return (true, result.connection, "");
                     }
                 }
-            
+
                 if (!LdapUtils.GetDomain(_identifier, _ldapConfig, out var domainObject) || domainObject.Name == null) {
                     //If we don't get a result here, we effectively have no other ways to resolve this domain, so we'll just have to exit out
                     _log.LogDebug(
@@ -705,8 +732,9 @@ public void Dispose() {
                     _excludedDomains.Add(_identifier);
                     return (false, null, "Unable to get domain object for further strategies");
                 }
+
                 tempDomainName = domainObject.Name.ToUpper().Trim();
-            
+
                 if (!tempDomainName.Equals(_identifier, StringComparison.OrdinalIgnoreCase) &&
                     CreateLdapConnection(tempDomainName, globalCatalog, out connectionWrapper)) {
                     _log.LogDebug(
@@ -714,7 +742,7 @@ public void Dispose() {
                         _identifier, tempDomainName);
                     return (true, connectionWrapper, "");
                 }
-            
+
                 var primaryDomainController = domainObject.PdcRoleOwner.Name;
                 var portConnectionResult =
                     await CreateLDAPConnectionWithPortCheck(primaryDomainController, globalCatalog);
@@ -724,7 +752,7 @@ public void Dispose() {
                         _identifier, primaryDomainController);
                     return (true, portConnectionResult.connection, "");
                 }
-            
+
                 foreach (DomainController dc in domainObject.DomainControllers) {
                     portConnectionResult =
                         await CreateLDAPConnectionWithPortCheck(dc.Name, globalCatalog);
@@ -742,27 +770,28 @@ public void Dispose() {
 
             return (false, null, "All attempted connections failed");
         }
-    
-        private (bool Success, LdapConnectionWrapper Connection, string Message ) CreateNewConnectionForServer(string identifier, bool globalCatalog = false) {
+
+        private (bool Success, LdapConnectionWrapper Connection, string Message ) CreateNewConnectionForServer(
+            string identifier, bool globalCatalog = false) {
             if (CreateLdapConnection(identifier, globalCatalog, out var serverConnection)) {
                 return (true, serverConnection, "");
             }
 
             return (false, null, $"Failed to create ldap connection for {identifier}");
         }
-    
+
         private bool CreateLdapConnection(string target, bool globalCatalog,
             out LdapConnectionWrapper connection) {
             var baseConnection = CreateBaseConnection(target, true, globalCatalog);
             if (TestLdapConnection(baseConnection, out var result)) {
-                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog, _poolIdentifier);
+                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog,
+                    _poolIdentifier);
                 return true;
             }
 
             try {
                 baseConnection.Dispose();
-            }
-            catch {
+            } catch {
                 //this is just in case
             }
 
@@ -773,43 +802,42 @@ private bool CreateLdapConnection(string target, bool globalCatalog,
 
             baseConnection = CreateBaseConnection(target, false, globalCatalog);
             if (TestLdapConnection(baseConnection, out result)) {
-                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog, _poolIdentifier);
+                connection = new LdapConnectionWrapper(baseConnection, result.SearchResultEntry, globalCatalog,
+                    _poolIdentifier);
                 return true;
             }
 
             try {
                 baseConnection.Dispose();
-            }
-            catch {
+            } catch {
                 //this is just in case
             }
 
             connection = null;
             return false;
         }
-    
+
         private LdapConnection CreateBaseConnection(string directoryIdentifier, bool ssl,
             bool globalCatalog) {
             _log.LogDebug("Creating connection for identifier {Identifier}", directoryIdentifier);
             var port = globalCatalog ? _ldapConfig.GetGCPort(ssl) : _ldapConfig.GetPort(ssl);
             var identifier = new LdapDirectoryIdentifier(directoryIdentifier, port, false, false);
             var connection = new LdapConnection(identifier) { Timeout = new TimeSpan(0, 0, 5, 0) };
-            
+
             //These options are important!
             connection.SessionOptions.ProtocolVersion = 3;
             //Referral chasing does not work with paged searches 
             connection.SessionOptions.ReferralChasing = ReferralChasingOptions.None;
             if (ssl) connection.SessionOptions.SecureSocketLayer = true;
-            
+
             if (_ldapConfig.DisableSigning || ssl) {
                 connection.SessionOptions.Signing = false;
                 connection.SessionOptions.Sealing = false;
-            }
-            else {
+            } else {
                 connection.SessionOptions.Signing = true;
                 connection.SessionOptions.Sealing = true;
             }
-            
+
             if (_ldapConfig.DisableCertVerification)
                 connection.SessionOptions.VerifyServerCertificate = (_, _) => true;
 
@@ -839,10 +867,10 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
             try {
                 //Attempt an initial bind. If this fails, likely auth is invalid, or its not a valid target
                 connection.Bind();
-            }
-            catch (LdapException e) {
+            } catch (LdapException e) {
                 //TODO: Maybe look at this and find a better way?
-                if (e.ErrorCode is (int)LdapErrorCodes.InvalidCredentials or (int)ResultCode.InappropriateAuthentication) {
+                if (e.ErrorCode is (int)LdapErrorCodes.InvalidCredentials
+                    or (int)ResultCode.InappropriateAuthentication) {
                     connection.Dispose();
                     throw new LdapAuthenticationException(e);
                 }
@@ -850,8 +878,7 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
                 testResult.Message = e.Message;
                 testResult.ErrorCode = e.ErrorCode;
                 return false;
-            }
-            catch (Exception e) {
+            } catch (Exception e) {
                 testResult.Message = e.Message;
                 return false;
             }
@@ -864,8 +891,7 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
                     SearchScope.Base, null);
 
                 response = (SearchResponse)connection.SendRequest(searchRequest);
-            }
-            catch (LdapException e) {
+            } catch (LdapException e) {
                 /*
                  * If we can't send the initial search request, its unlikely any other search requests will work so we will immediately return false
                  */
@@ -880,7 +906,7 @@ private bool TestLdapConnection(LdapConnection connection, out LdapConnectionTes
                  * across external trusts with kerberos authentication without Forest Search Order properly configured.
                  * Either way, this connection isn't useful for us because we're not going to get data, so return false
                  */
-            
+
                 connection.Dispose();
                 throw new NoLdapDataException();
             }
@@ -895,15 +921,14 @@ private class LdapConnectionTestResult {
             public IDirectoryObject SearchResultEntry { get; set; }
             public int ErrorCode { get; set; }
         }
-    
+
         private async Task<(bool success, LdapConnectionWrapper connection)> CreateLDAPConnectionWithPortCheck(
             string target, bool globalCatalog) {
             if (globalCatalog) {
                 if (await _portScanner.CheckPort(target, _ldapConfig.GetGCPort(true)) || (!_ldapConfig.ForceSSL &&
                         await _portScanner.CheckPort(target, _ldapConfig.GetGCPort(false))))
                     return (CreateLdapConnection(target, true, out var connection), connection);
-            }
-            else {
+            } else {
                 if (await _portScanner.CheckPort(target, _ldapConfig.GetPort(true)) || (!_ldapConfig.ForceSSL &&
                         await _portScanner.CheckPort(target, _ldapConfig.GetPort(false))))
                     return (CreateLdapConnection(target, true, out var connection), connection);
@@ -911,7 +936,7 @@ await _portScanner.CheckPort(target, _ldapConfig.GetPort(false))))
 
             return (false, null);
         }
-    
+
         private SearchRequest CreateSearchRequest(string distinguishedName, string ldapFilter,
             SearchScope searchScope,
             string[] attributes) {
diff --git a/src/CommonLib/LdapProducerQueryGenerator.cs b/src/CommonLib/LdapProducerQueryGenerator.cs
index 0d6580f8..25c6cb9b 100644
--- a/src/CommonLib/LdapProducerQueryGenerator.cs
+++ b/src/CommonLib/LdapProducerQueryGenerator.cs
@@ -9,11 +9,12 @@ public class LdapProducerQueryGenerator {
     public static GeneratedLdapParameters GenerateDefaultPartitionParameters(CollectionMethod methods) {
         var filter = new LdapFilter();
         var properties = new List<string>();
-        
+
         properties.AddRange(CommonProperties.BaseQueryProps);
         properties.AddRange(CommonProperties.TypeResolutionProps);
 
-        if (methods.HasFlag(CollectionMethod.ObjectProps) || methods.HasFlag(CollectionMethod.ACL) || methods.HasFlag(CollectionMethod.Container)) {
+        if (methods.HasFlag(CollectionMethod.ObjectProps) || methods.HasFlag(CollectionMethod.ACL) ||
+            methods.HasFlag(CollectionMethod.Container)) {
             filter = filter.AddComputers().AddDomains().AddUsers().AddContainers().AddGPOs().AddOUs().AddGroups();
 
             if (methods.HasFlag(CollectionMethod.Container)) {
@@ -39,14 +40,14 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
             if (methods.HasFlag(CollectionMethod.Trusts)) {
                 properties.AddRange(CommonProperties.DomainTrustProps);
             }
-            
+
             if (methods.HasFlag(CollectionMethod.GPOLocalGroup))
                 properties.AddRange(CommonProperties.GPOLocalGroupProps);
 
             if (methods.HasFlag(CollectionMethod.SPNTargets))
                 properties.AddRange(CommonProperties.SPNTargetProps);
 
-            if (methods.HasFlag(CollectionMethod.DCRegistry))
+            if (methods.IsComputerCollectionSet())
                 properties.AddRange(CommonProperties.ComputerMethodProps);
 
             if (methods.HasFlag(CollectionMethod.SPNTargets)) {
@@ -79,16 +80,16 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
             properties.AddRange(CommonProperties.GPOLocalGroupProps);
         }
 
-        if (methods.HasFlag(CollectionMethod.DCRegistry)) {
+        if (methods.HasFlag(CollectionMethod.DCRegistry) || methods.HasFlag(CollectionMethod.LdapServices)) {
             filter = filter.AddComputers(CommonFilters.DomainControllers);
             properties.AddRange(CommonProperties.ComputerMethodProps);
         }
-        
+
         if (methods.HasFlag(CollectionMethod.Group)) {
             filter = filter.AddGroups();
             properties.AddRange(CommonProperties.GroupResolutionProps);
         }
-        
+
         return new GeneratedLdapParameters {
             Filter = filter,
             Attributes = properties.Distinct().ToArray()
@@ -98,7 +99,7 @@ public static GeneratedLdapParameters GenerateDefaultPartitionParameters(Collect
     public static GeneratedLdapParameters GenerateConfigurationPartitionParameters(CollectionMethod methods) {
         var filter = new LdapFilter();
         var properties = new List<string>();
-        
+
         properties.AddRange(CommonProperties.BaseQueryProps);
         properties.AddRange(CommonProperties.TypeResolutionProps);
 
@@ -106,9 +107,8 @@ public static GeneratedLdapParameters GenerateConfigurationPartitionParameters(C
             methods.HasFlag(CollectionMethod.Container) || methods.HasFlag(CollectionMethod.CertServices)) {
             filter = filter.AddContainers().AddConfiguration().AddCertificateTemplates().AddCertificateAuthorities()
                 .AddEnterpriseCertificationAuthorities().AddIssuancePolicies();
-            
-            if (methods.HasFlag(CollectionMethod.ObjectProps))
-            {
+
+            if (methods.HasFlag(CollectionMethod.ObjectProps)) {
                 properties.AddRange(CommonProperties.ObjectPropsProps);
             }
 
diff --git a/src/CommonLib/LdapUtils.cs b/src/CommonLib/LdapUtils.cs
index a9166aff..a805d54d 100644
--- a/src/CommonLib/LdapUtils.cs
+++ b/src/CommonLib/LdapUtils.cs
@@ -182,7 +182,7 @@ public IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParame
             } catch {
                 //pass
             }
-           
+
 
             return (false, Label.Base);
         }
@@ -227,7 +227,7 @@ public IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParame
             } catch {
                 //pass
             }
-            
+
 
             return (false, Label.Base);
         }
@@ -361,7 +361,7 @@ public IAsyncEnumerable<LdapResult<IDirectoryObject>> PagedQuery(LdapQueryParame
             } catch {
                 //pass
             }
-            
+
 
             return (false, string.Empty);
         }
@@ -904,7 +904,6 @@ public async Task<bool> IsDomainController(string computerObjectId, string domai
                 _unresolvablePrincipals.Add(distinguishedName);
                 return (false, default);
             }
-            
         }
 
         public async Task<(bool Success, string DSHeuristics)> GetDSHueristics(string domain, string dn) {
@@ -961,7 +960,7 @@ public async IAsyncEnumerable<OutputBase> GetWellKnownPrincipalOutput() {
                 yield return entdc;
             }
         }
-        
+
         private async IAsyncEnumerable<Group> GetEnterpriseDCGroups() {
             var grouped = new ConcurrentDictionary<string, List<string>>(StringComparer.OrdinalIgnoreCase);
             var forestSidToName = new ConcurrentDictionary<string, string>(StringComparer.OrdinalIgnoreCase);
@@ -985,6 +984,7 @@ await GetDomainSidFromDomainName(forestName) is (true, var forestDomainSid)) {
                 if (!forestSidToName.TryGetValue(f.Key, out var forestName)) {
                     continue;
                 }
+
                 var group = new Group { ObjectIdentifier = $"{forestName}-S-1-5-9" };
                 group.Properties.Add("name", $"ENTERPRISE DOMAIN CONTROLLERS@{forestName}".ToUpper());
                 group.Properties.Add("domainsid", f.Key);
@@ -1203,6 +1203,15 @@ await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName)) {
                 return (true, res);
             }
 
+            res.ObjectType = await ComputeLabel(directoryObject, objectIdentifier, domain, utils);
+
+            directoryObject.TryGetProperty(LDAPProperties.SAMAccountName, out var samAccountName);
+            res.DisplayName = ComputeDisplayName(directoryObject, domain, res.ObjectType, samAccountName);
+            return (true, res);
+        }
+
+        private static async Task<Label> ComputeLabel(IDirectoryObject directoryObject, string objectIdentifier,
+            string domain, ILdapUtils utils) {
             if (!directoryObject.GetLabel(out var label)) {
                 if (await utils.ResolveIDAndType(objectIdentifier, domain) is (true, var typedPrincipal)) {
                     label = typedPrincipal.ObjectType;
@@ -1213,68 +1222,70 @@ await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName)) {
                 label = Label.User;
             }
 
-            res.ObjectType = label;
-
-            directoryObject.TryGetProperty(LDAPProperties.SAMAccountName, out var samAccountName);
+            return label;
+        }
 
+        private static string ComputeDisplayName(IDirectoryObject directoryObject, string domain, Label label,
+            string samAccountName) {
+            string displayName;
             switch (label) {
                 case Label.User:
                 case Label.Group:
                 case Label.Base:
-                    res.DisplayName = $"{samAccountName}@{domain}";
+                    displayName = $"{samAccountName}@{domain}";
                     break;
                 case Label.Computer: {
                     var shortName = samAccountName?.TrimEnd('$');
                     if (directoryObject.TryGetProperty(LDAPProperties.DNSHostName, out var dns)) {
-                        res.DisplayName = dns;
+                        displayName = dns;
                     } else if (!string.IsNullOrWhiteSpace(shortName)) {
-                        res.DisplayName = $"{shortName}.{domain}";
+                        displayName = $"{shortName}.{domain}";
                     } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
                                    out var canonicalName)) {
-                        res.DisplayName = $"{canonicalName}.{domain}";
+                        displayName = $"{canonicalName}.{domain}";
                     } else if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}.{domain}";
+                        displayName = $"{name}.{domain}";
                     } else {
-                        res.DisplayName = $"UNKNOWN.{domain}";
+                        displayName = $"UNKNOWN.{domain}";
                     }
 
                     break;
                 }
                 case Label.GPO:
                 case Label.IssuancePolicy: {
-                    if (directoryObject.TryGetProperty(LDAPProperties.DisplayName, out var displayName)) {
-                        res.DisplayName = $"{displayName}@{domain}";
+                    if (directoryObject.TryGetProperty(LDAPProperties.DisplayName, out var ldapDisplayName)) {
+                        displayName = $"{ldapDisplayName}@{domain}";
                     } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
                                    out var canonicalName)) {
-                        res.DisplayName = $"{canonicalName}@{domain}";
+                        displayName = $"{canonicalName}@{domain}";
                     } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
+                        displayName = $"UNKNOWN@{domain}";
                     }
 
                     break;
                 }
                 case Label.Domain:
-                    res.DisplayName = domain;
+                    displayName = domain;
                     break;
                 case Label.OU: {
                     if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}@{domain}";
+                        displayName = $"{name}@{domain}";
                     } else if (directoryObject.TryGetProperty(LDAPProperties.OU, out var ou)) {
-                        res.DisplayName = $"{ou}@{domain}";
+                        displayName = $"{ou}@{domain}";
                     } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
+                        displayName = $"UNKNOWN@{domain}";
                     }
 
                     break;
                 }
                 case Label.Container: {
                     if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}@{domain}";
+                        displayName = $"{name}@{domain}";
                     } else if (directoryObject.TryGetProperty(LDAPProperties.CanonicalName,
                                    out var canonicalName)) {
-                        res.DisplayName = $"{canonicalName}@{domain}";
+                        displayName = $"{canonicalName}@{domain}";
                     } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
+                        displayName = $"UNKNOWN@{domain}";
                     }
 
                     break;
@@ -1286,9 +1297,9 @@ await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName)) {
                 case Label.EnterpriseCA:
                 case Label.CertTemplate: {
                     if (directoryObject.TryGetProperty(LDAPProperties.Name, out var name)) {
-                        res.DisplayName = $"{name}@{domain}";
+                        displayName = $"{name}@{domain}";
                     } else {
-                        res.DisplayName = $"UNKNOWN@{domain}";
+                        displayName = $"UNKNOWN@{domain}";
                     }
 
                     break;
@@ -1297,8 +1308,7 @@ await utils.GetDomainNameFromSid(objectIdentifier) is (true, var domainName)) {
                     throw new ArgumentOutOfRangeException();
             }
 
-            res.DisplayName = res.DisplayName.ToUpper();
-            return (true, res);
+            return displayName.ToUpper();
         }
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/HttpClientFactory.cs b/src/CommonLib/Ntlm/HttpClientFactory.cs
new file mode 100644
index 00000000..74b8e6f5
--- /dev/null
+++ b/src/CommonLib/Ntlm/HttpClientFactory.cs
@@ -0,0 +1,35 @@
+using System;
+using System.Net;
+using System.Net.Http;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public interface IHttpClientFactory {
+    HttpClient CreateUnauthenticatedClient();
+    HttpClient CreateAuthenticatedHttpClient(Uri Url, string authPackage = "Kerberos");
+}
+
+public class HttpClientFactory : IHttpClientFactory {
+    public HttpClient CreateUnauthenticatedClient() {
+        var handler = new HttpClientHandler {
+            ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, cetChain, policyErrors) => true,
+            UseDefaultCredentials = false
+        };
+
+        return new HttpClient(handler);
+    }
+
+    public HttpClient CreateAuthenticatedHttpClient(Uri Url, string authPackage = "Kerberos") {
+        var handler = new HttpClientHandler {
+            Credentials = new CredentialCache() {
+                { Url, authPackage, CredentialCache.DefaultNetworkCredentials }
+            },
+
+            PreAuthenticate = true,
+            ServerCertificateCustomValidationCallback =
+                (httpRequestMessage, cert, cetChain, policyErrors) => { return true; },
+        };
+
+        return new HttpClient(handler);
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
new file mode 100644
index 00000000..75973403
--- /dev/null
+++ b/src/CommonLib/Ntlm/HttpNtlmAuthenticationService.cs
@@ -0,0 +1,162 @@
+using Microsoft.Extensions.Logging;
+using System;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Security.Authentication;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class HttpNtlmAuthenticationService {
+    private readonly ILogger _logger;
+    private readonly IHttpClientFactory _httpClientFactory;
+
+    public HttpNtlmAuthenticationService(IHttpClientFactory httpClientFactory, ILogger logger = null) {
+        _logger = logger ?? Logging.LogProvider.CreateLogger(nameof(HttpNtlmAuthenticationService));
+        _httpClientFactory = httpClientFactory;
+    }
+
+    public async Task EnsureRequiresAuth(Uri url, bool? useBadChannelBindings) {
+        if (url == null)
+            throw new ArgumentException("Url property is null");
+
+        if (useBadChannelBindings == null && url.Scheme == "https")
+            throw new ArgumentException("When using HTTPS, useBadChannelBindings must be set");
+
+        var supportedAuthSchemes = await GetSupportedNtlmAuthSchemesAsync(url);
+
+        _logger.LogDebug($"Supported NTLM auth schemes for {url}: " + string.Join(",", supportedAuthSchemes));
+
+        foreach (var authScheme in supportedAuthSchemes) {
+            if (useBadChannelBindings == null) {
+                await AuthWithBadChannelBindings(url, authScheme);
+            } else {
+                if ((bool)useBadChannelBindings) {
+                    await AuthWithBadChannelBindings(url, authScheme);
+                } else {
+                    await AuthWithChannelBindingAsync(url, authScheme);
+                }
+            }
+
+            // If we've got here, everything has worked and it's accessible, so return
+            return;
+        }
+    }
+
+    private async Task<string[]> GetSupportedNtlmAuthSchemesAsync(Uri url) {
+        var httpClient = _httpClientFactory.CreateUnauthenticatedClient();
+
+        using var getRequest = new HttpRequestMessage(HttpMethod.Get, url);
+        using var getResponse = await httpClient.SendAsync(getRequest);
+        return ExtractAuthSchemes(getResponse);
+    }
+
+    private string[] ExtractAuthSchemes(HttpResponseMessage response) {
+        if (response.StatusCode == HttpStatusCode.OK) {
+            throw new AuthNotRequiredException(
+                "Authorization was not solicited when enumerating Authentication schemes");
+        }
+
+        // We expect to get an Unauthorized. If not, something is off
+        if (response.StatusCode != HttpStatusCode.Unauthorized) {
+            if (response.StatusCode == HttpStatusCode.Forbidden) {
+                throw new HttpForbiddenException("Forbidden when enumerating Auth schemes");
+            } else if (response.StatusCode == HttpStatusCode.InternalServerError) {
+                throw new HttpServerErrorException("Server Error when enumerating Auth schemes");
+            } else {
+                // Use .NET's exceptions to make things easy
+                response.EnsureSuccessStatusCode();
+            }
+        }
+
+        if (response.Headers.WwwAuthenticate == null) {
+            throw new InvalidOperationException("WWW-Authenticate header is missing");
+        }
+
+        var schemes = response.Headers.WwwAuthenticate
+            .Select(header => header.Scheme)
+            .Where(scheme => scheme == "NTLM" || scheme == "Negotiate")
+            .Distinct()
+            .ToArray();
+
+        return schemes;
+    }
+
+    private async Task AuthWithBadChannelBindings(Uri url, string authScheme) {
+        var httpClient = _httpClientFactory.CreateUnauthenticatedClient();
+        var transport = new HttpTransport(httpClient, url, authScheme, _logger);
+        var ntlmAuthHandler = new NtlmAuthenticationHandler($"HTTP/{url.Host}");
+
+        var response = (HttpResponseMessage)await ntlmAuthHandler.PerformNtlmAuthenticationAsync(transport);
+
+        if (response.StatusCode == HttpStatusCode.OK) {
+            return;
+        } else if (response.StatusCode == HttpStatusCode.Unauthorized) {
+            throw new HttpUnauthorizedException(
+                $"401 Unauthorized when accessing {url} with {authScheme} and no signing");
+        } else if (response.StatusCode == HttpStatusCode.Forbidden) {
+            throw new HttpForbiddenException($"403 Forbidden when accessing {url} with {authScheme} and no signing");
+        }
+
+        response.EnsureSuccessStatusCode();
+    }
+
+    private async Task<bool> AuthWithChannelBindingAsync(Uri url, string authScheme) {
+        var handler = new HttpClientHandler {
+            ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, cetChain, policyErrors) => true,
+        };
+
+        var credentialCache = new CredentialCache();
+        credentialCache.Add(url, authScheme, CredentialCache.DefaultNetworkCredentials);
+
+        handler.Credentials = credentialCache;
+        handler.PreAuthenticate = true;
+
+        using var client = new HttpClient(handler);
+
+        try {
+            HttpResponseMessage response = await client.GetAsync(url);
+            return response.StatusCode == HttpStatusCode.OK;
+        } catch (AuthenticationException ex) {
+            _logger.LogWarning(ex, $"Authentication failed for {url} with {authScheme}");
+            return false;
+        }
+    }
+}
+
+[Serializable]
+internal class HttpUnauthorizedException : Exception {
+    public HttpUnauthorizedException() {
+    }
+
+    public HttpUnauthorizedException(string message) : base(message) {
+    }
+}
+
+[Serializable]
+internal class HttpForbiddenException : Exception {
+    public HttpForbiddenException() {
+    }
+
+    public HttpForbiddenException(string message) : base(message) {
+    }
+}
+
+[Serializable]
+internal class HttpServerErrorException : Exception {
+    public HttpServerErrorException() {
+    }
+
+    public HttpServerErrorException(string message) : base(message) {
+    }
+}
+
+[Serializable]
+internal class AuthNotRequiredException : Exception {
+    public AuthNotRequiredException() {
+    }
+
+    public AuthNotRequiredException(string message) : base(message) {
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/HttpTransport.cs b/src/CommonLib/Ntlm/HttpTransport.cs
new file mode 100644
index 00000000..508b9c2d
--- /dev/null
+++ b/src/CommonLib/Ntlm/HttpTransport.cs
@@ -0,0 +1,69 @@
+using Microsoft.Extensions.Logging;
+using System;
+using System.Linq;
+using System.Net.Http;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class HttpTransport : INtlmTransport
+{
+    private readonly ILogger _logger;
+    private readonly HttpClient _httpClient;
+    private readonly Uri _url;
+    private readonly string _authScheme;
+
+    public HttpTransport(HttpClient httpClient, Uri url, string authScheme, ILogger logger = null)
+    {
+        _logger = logger ?? Logging.LogProvider.CreateLogger(nameof(HttpTransport));
+        _httpClient = httpClient;
+        _url = url;
+        _authScheme = authScheme;
+    }
+
+    public async Task<byte[]> NegotiateAsync(byte[] negotiateMessage)
+    {
+        var requestMessage = new HttpRequestMessage(HttpMethod.Get, _url);
+        var messageBase64 = Convert.ToBase64String(negotiateMessage);
+        requestMessage.Headers.Add("Authorization", $"{_authScheme} {messageBase64}");
+
+        var response = await _httpClient.SendAsync(requestMessage);
+
+        if (!response.Headers.Contains("WWW-Authenticate"))
+        {
+            throw new InvalidOperationException("No WWW-Authenticate header found in response");
+        }
+
+        var authHeaders = response.Headers.WwwAuthenticate.Where(a => a.Scheme == _authScheme).ToArray();
+        if (!authHeaders.Any())
+        {
+            throw new InvalidOperationException($"No WWW-Authenticate header found in response. Auth Scheme: {_authScheme}");
+        }
+
+        var challengeMessageB64 = authHeaders.First().Parameter;
+        if (challengeMessageB64 == null)
+        {
+            throw new MissingChallengeException($"No challenge received from the server. Auth Scheme: {_authScheme}");
+        }
+
+        return Convert.FromBase64String(challengeMessageB64);
+    }
+
+    public async Task<Object> AuthenticateAsync(byte[] authenticateMessage)
+    {
+        var requestMessage = new HttpRequestMessage(HttpMethod.Get, _url);
+        var messageBase64 = Convert.ToBase64String(authenticateMessage);
+        requestMessage.Headers.Add("Authorization", $"{_authScheme} {messageBase64}");
+
+        var response = await _httpClient.SendAsync(requestMessage);
+        return response;
+    }
+}
+
+public class MissingChallengeException : Exception
+{
+    public MissingChallengeException(string message): base(message)
+    {
+    }
+}
+
diff --git a/src/CommonLib/Ntlm/INtlmTransport.cs b/src/CommonLib/Ntlm/INtlmTransport.cs
new file mode 100644
index 00000000..b29a4f3f
--- /dev/null
+++ b/src/CommonLib/Ntlm/INtlmTransport.cs
@@ -0,0 +1,9 @@
+using System;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public interface INtlmTransport {
+    Task<byte[]> NegotiateAsync(byte[] negotiateMessage);
+    Task<object> AuthenticateAsync(byte[] authenticateMessage);
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/LdapNative.cs b/src/CommonLib/Ntlm/LdapNative.cs
new file mode 100644
index 00000000..e8cca6ce
--- /dev/null
+++ b/src/CommonLib/Ntlm/LdapNative.cs
@@ -0,0 +1,301 @@
+#nullable enable
+
+using Microsoft.Win32.SafeHandles;
+using SharpHoundCommonLib.Enums;
+using System;
+using System.Runtime.InteropServices;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class SafeLdapHandle : SafeHandleZeroOrMinusOneIsInvalid {
+    internal SafeLdapHandle(IntPtr handle) : base(true) {
+        this.handle = handle;
+    }
+
+    protected override bool ReleaseHandle() {
+        if (!IsInvalid) {
+            var result = NativeMethods.ldap_unbind_s(handle);
+            return result == 0;
+        }
+
+        return true;
+    }
+}
+
+public class LdapConnection : IDisposable {
+    private SafeLdapHandle? _handle;
+    private bool _disposed;
+
+    public SafeLdapHandle Handle {
+        get {
+            ThrowIfDisposed();
+            return _handle ?? throw new InvalidOperationException("LDAP connection not initialized");
+        }
+    }
+
+    private void ThrowIfDisposed() {
+        if (_disposed) {
+            throw new ObjectDisposedException(nameof(LdapConnection));
+        }
+    }
+
+    private string? GetServerError() {
+        ThrowIfDisposed();
+
+        try {
+            var result = NativeMethods.ldap_get_option(
+                Handle,
+                LdapOption.ServerError,
+                out IntPtr errorMessagePtr
+            );
+
+            if (result != 0 || errorMessagePtr == IntPtr.Zero)
+                return null;
+
+            try {
+                return Marshal.PtrToStringAnsi(errorMessagePtr);
+            } finally {
+                NativeMethods.ldap_memfree(errorMessagePtr);
+            }
+        } catch {
+            // If anything goes wrong getting the server error,
+            // return null rather than throw since we're already
+            // in error handling code
+            return null;
+        }
+    }
+
+    public void CheckError(int result, string operation) {
+        if (result == (int)LdapErrorCodes.Success) return;
+
+        var lastError = NativeMethods.LdapGetLastError();
+        var serverError = GetServerError();
+        throw new LdapNativeException(
+            $"LDAP operation failed. Operation: {operation}. API error code: {result}",
+            lastError,
+            serverError
+        );
+    }
+
+    public void Initialize(string hostName, int port) {
+        ThrowIfDisposed();
+
+        var handle = NativeMethods.ldap_init(hostName, port);
+        if (handle == IntPtr.Zero) {
+            var lastError = NativeMethods.LdapGetLastError();
+            throw new LdapNativeException($"Failed to initialize LDAP connection", lastError);
+        }
+
+        _handle = new SafeLdapHandle(handle);
+    }
+
+    public void Connect(int timeout = -1) {
+        ThrowIfDisposed();
+
+        var timeoutPtr = IntPtr.Zero;
+        try {
+            if (timeout >= 0) {
+                var ldapTimeout = new LDAP_TIMEVAL {
+                    tv_sec = (int)(new TimeSpan(0, 0, timeout).Ticks / TimeSpan.TicksPerSecond),
+                };
+                timeoutPtr = Marshal.AllocHGlobal(Marshal.SizeOf(ldapTimeout));
+                Marshal.StructureToPtr(ldapTimeout, timeoutPtr, false);
+            }
+
+            var result = NativeMethods.ldap_connect(Handle, timeoutPtr);
+            CheckError(result, "Connecting to LDAP server");
+        } finally {
+            if (timeoutPtr != IntPtr.Zero) {
+                Marshal.FreeHGlobal(timeoutPtr);
+            }
+        }
+    }
+
+    private T GetOption<T>(LdapOption option) where T : struct {
+        ThrowIfDisposed();
+
+        if (typeof(T) == typeof(int)) {
+            int value;
+            var result = NativeMethods.ldap_get_option(Handle, option, out value);
+            CheckError(result, $"Getting LDAP option {option}");
+            return (T)(object)value;
+        }
+
+        throw new ArgumentException($"Unsupported option type: {typeof(T).Name}");
+    }
+
+    public void SetOption(LdapOption option, LdapOptionValue value) {
+        ThrowIfDisposed();
+
+        // Get current value
+        var currentValue = GetOption<int>(option);
+        var newValue = (int)value;
+
+        // Only set if different
+        if (currentValue != newValue) {
+#pragma warning disable CS8604 // Possible null reference argument.
+            var result = NativeMethods.ldap_set_option(_handle, option, ref newValue);
+#pragma warning restore CS8604 // Possible null reference argument.
+            CheckError(result, $"Setting LDAP option {option}");
+
+            // Verify the change
+            var verifyValue = GetOption<int>(option);
+            if (verifyValue != newValue) {
+                throw new LdapNativeException(
+                    $"Failed to verify option change for {option}. Expected {newValue} but got {verifyValue}",
+                    NativeMethods.LdapGetLastError());
+            }
+        }
+    }
+
+    public void SetOption(LdapOption option, IntPtr value) {
+#pragma warning disable CS8604 // Possible null reference argument.
+        var result = NativeMethods.ldap_set_option(_handle, option, value);
+#pragma warning restore CS8604 // Possible null reference argument.
+        CheckError(result, $"Setting LDAP option {option}");
+    }
+
+    private int GetResultCode() {
+        ThrowIfDisposed();
+
+        int resultCode;
+        var result = NativeMethods.ldap_get_option(
+            Handle,
+            LdapOption.ResultCode,
+            out resultCode
+        );
+
+        CheckError(result, "Getting LDAP result code");
+        return resultCode;
+    }
+
+    public byte[] SaslBind(string distinguishedName, string mechanism, byte[] credential) {
+        ThrowIfDisposed();
+
+        var credPtr = IntPtr.Zero;
+        try {
+            // Create berval structure for credentials
+            var berval = new BERVAL {
+                bv_len = credential.Length,
+                bv_val = Marshal.AllocHGlobal(credential.Length)
+            };
+
+            Marshal.Copy(credential, 0, berval.bv_val, credential.Length);
+
+            credPtr = Marshal.AllocHGlobal(Marshal.SizeOf<BERVAL>());
+            Marshal.StructureToPtr(berval, credPtr, false);
+
+            // Perform SASL bind
+            var result = NativeMethods.ldap_sasl_bind_s(
+                Handle,
+                distinguishedName,
+                mechanism,
+                credPtr,
+                IntPtr.Zero, // No server controls
+                IntPtr.Zero, // No client controls
+                out var response
+            );
+
+            if (result != (int)LdapErrorCodes.Success &&
+                result != (int)LdapErrorCodes.SaslBindInProgress) {
+                throw new LdapNativeException("SASL bind failed", result, GetServerError());
+            }
+
+            var bindResultCode = GetResultCode();
+
+            if (bindResultCode != (int)LdapErrorCodes.Success &&
+                bindResultCode != (int)LdapErrorCodes.SaslBindInProgress) {
+                throw new LdapNativeException("SASL bind result failed", bindResultCode, GetServerError());
+            }
+
+            if (response == IntPtr.Zero)
+                throw new InvalidOperationException("Server did return a challenge");
+
+            var responseBerval = Marshal.PtrToStructure<BERVAL>(response);
+            var responseData = new byte[responseBerval.bv_len];
+            Marshal.Copy(responseBerval.bv_val, responseData, 0, responseBerval.bv_len);
+            return responseData;
+        } finally {
+            if (credPtr != IntPtr.Zero) {
+                var berval = Marshal.PtrToStructure<BERVAL>(credPtr);
+                if (berval.bv_val != IntPtr.Zero) {
+                    Marshal.FreeHGlobal(berval.bv_val);
+                }
+
+                Marshal.FreeHGlobal(credPtr);
+            }
+
+            // Freeing the memory always results in crashes. Is it managed by something else?
+            //if (response != IntPtr.Zero)
+            //{
+            //    var responseBerval = Marshal.PtrToStructure<NativeMethods.berval>(response);
+            //    if (responseBerval.bv_val != IntPtr.Zero)
+            //    {
+            //        Marshal.FreeHGlobal(responseBerval.bv_val);
+            //    }
+            //    Marshal.FreeHGlobal(response);
+            //}
+        }
+    }
+
+    public void Dispose() {
+        if (!_disposed) {
+            _handle?.Dispose();
+            _handle = null;
+            _disposed = true;
+        }
+    }
+}
+
+[StructLayout(LayoutKind.Sequential)]
+public struct LDAP_TIMEVAL {
+    public int tv_sec;
+    public int tv_usec;
+}
+
+[StructLayout(LayoutKind.Sequential)]
+public struct BERVAL {
+    public int bv_len;
+    public IntPtr bv_val;
+}
+
+public class NativeMethods {
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern IntPtr ldap_init(string Host, int Port);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_connect(SafeLdapHandle ld, IntPtr timeout);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_set_option(SafeLdapHandle ld, LdapOption option, ref int value);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_set_option(SafeLdapHandle ld, LdapOption option, IntPtr value);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_get_option(SafeLdapHandle ld, LdapOption option, out int value);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_get_option(SafeLdapHandle ld, LdapOption option, out IntPtr value);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern void ldap_memfree(IntPtr ptr);
+
+    [DllImport("Wldap32.dll", EntryPoint = "ldap_sasl_bind_s", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_sasl_bind_s(
+        SafeLdapHandle ld,
+        string dn,
+        string mechanism,
+        IntPtr cred,
+        IntPtr serverctrls,
+        IntPtr clientctrls,
+        out IntPtr msgidp);
+
+    [DllImport("Wldap32.dll", CallingConvention = CallingConvention.Cdecl)]
+    public static extern int ldap_unbind_s(IntPtr ld);
+
+    [DllImport("wldap32.dll", EntryPoint = "LdapGetLastError")]
+    public static extern int LdapGetLastError();
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/LdapNativeException.cs b/src/CommonLib/Ntlm/LdapNativeException.cs
new file mode 100644
index 00000000..f39ddcba
--- /dev/null
+++ b/src/CommonLib/Ntlm/LdapNativeException.cs
@@ -0,0 +1,15 @@
+using System;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class LdapNativeException : Exception {
+    public int ErrorCode { get; }
+    public string ServerErrorMessage { get; }
+
+    public LdapNativeException(string message, int errorCode, string serverErrorMessage = null)
+        : base(
+            $"{message}. LDAP error code: {errorCode}{(string.IsNullOrEmpty(serverErrorMessage) ? "" : $". Server error: {serverErrorMessage}")}") {
+        ErrorCode = errorCode;
+        ServerErrorMessage = serverErrorMessage;
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/LdapTransport.cs b/src/CommonLib/Ntlm/LdapTransport.cs
new file mode 100644
index 00000000..be94eec1
--- /dev/null
+++ b/src/CommonLib/Ntlm/LdapTransport.cs
@@ -0,0 +1,98 @@
+#nullable enable
+
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Enums;
+using System;
+using System.Runtime.InteropServices;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+public class LdapTransport(ILogger logger, Uri ldapEndpoint) : INtlmTransport, IDisposable {
+    private LdapConnection? _ldap;
+    private bool _disposed;
+
+    [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+    public delegate bool VerifyServerCert(
+        IntPtr Connection,
+        IntPtr pServerCert
+    );
+
+    public bool IsSecureLdap {
+        get { return ldapEndpoint.Scheme == "ldaps"; }
+    }
+
+    private void ThrowIfDisposed() {
+        if (_disposed) {
+            throw new ObjectDisposedException(nameof(LdapConnection));
+        }
+    }
+
+    private void ThrowIfHandleNull() {
+        if (_ldap == null) {
+            throw new NullReferenceException("LDAP handle is null");
+        }
+    }
+
+    public void InitializeConnectionAsync(int timeout = -1) {
+        if (_ldap == null) {
+            _ldap = new LdapConnection();
+            try {
+                _ldap.Initialize(ldapEndpoint.Host, ldapEndpoint.Port);
+                _ldap.SetOption(LdapOption.ProtocolVersion, LdapOptionValue.Version3);
+
+                if (IsSecureLdap) {
+                    _ldap.SetOption(
+                        LdapOption.ServerCertificate,
+                        Marshal.GetFunctionPointerForDelegate<VerifyServerCert>((connection, serverCert) => true)
+                    );
+
+                    // Not necessary to call. Internally, it automagically sets it via the LDAPS port specified
+                    //_ldap.SetOption(LdapOption.Ssl, LdapOptionValue.On);
+
+                    // Not setting Signing/Encryption since the API returns LDAP_UNWILLING_TO_PERFORM when SSL is enabled
+                    //_ldap.SetOption(LdapOption.Sign, LdapOptionValue.On);
+                    //_ldap.SetOption(LdapOption.Encrypt, LdapOptionValue.On);
+                }
+
+                _ldap.Connect(timeout);
+                logger.LogDebug($"LDAP connection established to {ldapEndpoint.Host}:{ldapEndpoint.Port}");
+            } catch (Exception) {
+                _ldap.Dispose();
+                _ldap = null;
+                throw;
+            }
+        }
+    }
+
+    public Task<byte[]> NegotiateAsync(byte[] negotiateMessage) {
+        ThrowIfDisposed();
+        ThrowIfHandleNull();
+
+        return Task.Run(() => _ldap!.SaslBind("", LdapSupportedSaslMechanisms.GSS_SPNEGO, negotiateMessage));
+    }
+
+    public async Task<Object> AuthenticateAsync(byte[] authenticateMessage) {
+        ThrowIfDisposed();
+        ThrowIfHandleNull();
+
+        return await Task.Run(() => {
+            InitializeConnectionAsync();
+            var bytes = _ldap!.SaslBind("", LdapSupportedSaslMechanisms.GSS_SPNEGO, authenticateMessage);
+            return bytes;
+        });
+    }
+
+    public void Dispose() {
+        if (!_disposed) {
+            if (_ldap != null) {
+                _ldap.Dispose();
+                _ldap = null;
+            }
+
+            _disposed = true;
+        }
+    }
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
new file mode 100644
index 00000000..83995a82
--- /dev/null
+++ b/src/CommonLib/Ntlm/NtlmAuthenticationHandler.cs
@@ -0,0 +1,57 @@
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Processors;
+using SharpHoundCommonLib.ThirdParty.PSOpenAD;
+using System;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Ntlm;
+
+interface INtlmAuthenticationHandler
+{
+    Task<object> PerformNtlmAuthenticationAsync(INtlmTransport transport);
+}
+
+public class NtlmAuthenticationHandler : INtlmAuthenticationHandler
+{
+    private readonly ILogger _logger;
+    private readonly string _targetService;
+    public LdapAuthOptions Options { get; set; }
+
+    public NtlmAuthenticationHandler(string targetService, ILogger logger = null)
+    {
+        _logger = logger ?? Logging.LogProvider.CreateLogger("NtlmAuthenticationHandler");
+        _targetService = targetService;
+
+        Options = new LdapAuthOptions {
+            Signing = false,
+            Bindings = null
+        };
+    }
+
+    public async Task<object> PerformNtlmAuthenticationAsync(INtlmTransport transport)
+    {
+        using var context = new SspiContext(
+                null,
+                null,
+                AuthenticationMethod.NTLM,
+                _targetService,
+                Options.Bindings,
+                Options.Signing,
+                Options.Signing
+            );
+
+        // NEGOTIATE
+        var negotiateMsgBytes = context.Step();
+
+        // CHALLENGE
+        var challengeMessageBytes = await transport.NegotiateAsync(negotiateMsgBytes);
+
+        // AUTHENTICATE
+        var authenticateMsgBytes = context.Step(challengeMessageBytes);
+
+        // Perform final authentication
+        var response = await transport.AuthenticateAsync(authenticateMsgBytes);
+
+        return response;
+    }
+}
diff --git a/src/CommonLib/OutputTypes/APIResult.cs b/src/CommonLib/OutputTypes/APIResult.cs
index 81c65b29..a6e9a05f 100644
--- a/src/CommonLib/OutputTypes/APIResult.cs
+++ b/src/CommonLib/OutputTypes/APIResult.cs
@@ -1,8 +1,38 @@
-namespace SharpHoundCommonLib.OutputTypes
-{
-    public class APIResult
-    {
+namespace SharpHoundCommonLib.OutputTypes {
+#nullable enable
+    public class APIResult {
         public bool Collected { get; set; }
-        public string FailureReason { get; set; }
+        public string? FailureReason { get; set; }
     }
+
+    public class ApiResult<T> : APIResult {
+        public T? Results { get; set; }
+
+        public ApiResult() {
+            Results = default(T);
+            Collected = false;
+            FailureReason = null;
+        }
+
+        public ApiResult(T? data) {
+            Results = data;
+            Collected = data != null;
+            FailureReason = null;
+        }
+
+        public static ApiResult<T> CreateSuccess(T result) {
+            return new ApiResult<T>(result) {
+                Collected = true,
+                FailureReason = null
+            };
+        }
+
+        public static ApiResult<T> CreateError(string message) {
+            return new ApiResult<T>(default) {
+                Collected = false,
+                FailureReason = message
+            };
+        }
+    }
+#nullable disable
 }
\ No newline at end of file
diff --git a/src/CommonLib/OutputTypes/CAHttpEndpoint.cs b/src/CommonLib/OutputTypes/CAHttpEndpoint.cs
new file mode 100644
index 00000000..29ec91fd
--- /dev/null
+++ b/src/CommonLib/OutputTypes/CAHttpEndpoint.cs
@@ -0,0 +1,64 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.OutputTypes {
+    public enum CAEnrollmentEndpointType {
+        // The Certificate Authority Web Enrollment server role, an ASP web application
+        WebEnrollmentApplication,
+
+        // The Certificate Enrollment Web Service (CES) server role, a SOAP-based web service
+        EnrollmentWebService,
+
+        // The Network Device Enrollment Service (NDES), which uses the SCEP protocol to obtain certificates.
+        NDES, // NDES
+
+        // ICertPassage Remote Protocol (MS-ICPR), an RPC protcol
+        RPC, // 
+
+        // The Windows Client Certificate Enrollment Protocol (MS-WCCE), a set of DCOM interfaces for certificate enrollment
+        DCOM,
+    }
+
+    public enum CAEnrollmentEndpointScanResult {
+        // Endpoint is vulnerable due to using HTTP (not HTTPS) with NTLM auth (ESC8)
+        Vulnerable_NtlmHttpEndpoint,
+
+        // Endpoint is vulnerable due to using HTTP (not HTTPS) with Kerberos auth
+        Vulnerable_KerberosHttpEndpoint,
+
+        // Endpoint is vulnerable due to not requiring channel binding for the HTTPS endpoint (ESC8)
+        Vulnerable_NtlmHttpsNoChannelBinding,
+
+
+        // Offset the not vulnerable conditions in case we want to add additional
+
+        // Endpoint is not vulnerable due to not existing
+        NotVulnerable_PortInaccessible = 0x100,
+
+        // The server did not return an NTLM challenge (e.g., when Negotiate:Kerberos is enabled)
+        NotVulnerable_NoNtlmChallenge,
+
+        // 404 NotFound when accessing the endpoint
+        NotVulnerable_PathNotFound,
+
+        // Returned if the IIS is configured to require SSL (so no HTTP possible)
+        NotVulnerable_PathForbidden,
+
+        // 500 Server Error when visiting a Url
+        NotVulnerable_ServerError,
+
+        // Endpoint is not vulnerable due requiring ChannelBinding or only supporting Kerberos authentication (or both)
+        NotVulnerable_NtlmChannelBindingRequired,
+
+        Error = 0xFFFF
+    }
+
+    public class CAEnrollmentEndpoint(Uri url, CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult status) {
+        public Uri Url { get; set; } = url;
+        public CAEnrollmentEndpointType Type { get; set; } = type;
+        public CAEnrollmentEndpointScanResult Status { get; set; } = status;
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/OutputTypes/Computer.cs b/src/CommonLib/OutputTypes/Computer.cs
index 879013d5..dedad361 100644
--- a/src/CommonLib/OutputTypes/Computer.cs
+++ b/src/CommonLib/OutputTypes/Computer.cs
@@ -1,37 +1,75 @@
-using System;
+using System.Collections.Generic;
 
-namespace SharpHoundCommonLib.OutputTypes
-{
+namespace SharpHoundCommonLib.OutputTypes {
     /// <summary>
     ///     Represents a computer object in Active Directory. Contains all the properties BloodHound cares about
     /// </summary>
-    public class Computer : OutputBase
-    {
+    public class Computer : OutputBase {
         public string PrimaryGroupSID { get; set; }
-        public TypedPrincipal[] AllowedToDelegate { get; set; } = Array.Empty<TypedPrincipal>();
-        public TypedPrincipal[] AllowedToAct { get; set; } = Array.Empty<TypedPrincipal>();
-        public TypedPrincipal[] HasSIDHistory { get; set; } = Array.Empty<TypedPrincipal>();
-        public TypedPrincipal[] DumpSMSAPassword { get; set; } = Array.Empty<TypedPrincipal>();
+        public TypedPrincipal[] AllowedToDelegate { get; set; } = [];
+        public TypedPrincipal[] AllowedToAct { get; set; } = [];
+        public TypedPrincipal[] HasSIDHistory { get; set; } = [];
+        public TypedPrincipal[] DumpSMSAPassword { get; set; } = [];
         public SessionAPIResult Sessions { get; set; } = new();
         public SessionAPIResult PrivilegedSessions { get; set; } = new();
         public SessionAPIResult RegistrySessions { get; set; } = new();
-        public LocalGroupAPIResult[] LocalGroups { get; set; } = Array.Empty<LocalGroupAPIResult>();
-        public UserRightsAssignmentAPIResult[] UserRights { get; set; } = Array.Empty<UserRightsAssignmentAPIResult>();
+        public LocalGroupAPIResult[] LocalGroups { get; set; } = [];
+        public UserRightsAssignmentAPIResult[] UserRights { get; set; } = [];
         public DCRegistryData DCRegistryData { get; set; } = new();
         public ComputerStatus Status { get; set; }
         public bool IsDC { get; set; }
         public bool UnconstrainedDelegation { get; set; }
         public string DomainSID { get; set; }
+
+#pragma warning disable CS8632 // The annotation for nullable reference types should only be used in code within a '#nullable' annotations context.
+        public ApiResult<bool> IsWebClientRunning { get; set; }
+        public LdapService? LdapServices { get; set; }
+        public ApiResult<SmbInfo>? SmbInfo { get; set; }
+        public ApiResult<NtlmSessionResult>? NtlmSessions { get; set; }
+#pragma warning restore CS8632 // The annotation for nullable reference types should only be used in code within a '#nullable' annotations context.
+    }
+
+    public class LdapService(
+        bool hasLdap,
+        bool hasLdaps,
+        ApiResult<bool> isSigningRequired,
+        ApiResult<bool> isChannelBindingRequired) {
+        // Is the LDAP port accesible?
+        public bool HasLdap { get; set; } = hasLdap;
+
+        // Is the LDAPS port accessible?
+        public bool HasLdaps { get; set; } = hasLdaps;
+
+        // For LDAP, is signing required?
+        public ApiResult<bool> IsSigningRequired { get; set; } = isSigningRequired;
+
+        // For LDAPS, is EPA(ChannelBinding) required?
+        public ApiResult<bool> IsChannelBindingDisabled { get; set; } = isChannelBindingRequired;
+
+        public override string ToString() {
+            return $"""
+                    HasLdap: {HasLdap}
+                    HasLdaps: {HasLdaps}
+                    IsSigningRequired: {IsSigningRequired}
+                    IsChannelBindingDisabled: {IsChannelBindingDisabled}
+                    """;
+        }
+    }
+
+
+    public class SmbInfo {
+        public bool? SigningEnabled;
+        public string OsVersion;
+        public string OsBuild;
+        public string DnsComputerName { get; internal set; }
     }
 
-    public class DCRegistryData
-    {
+    public class DCRegistryData {
         public IntRegistryAPIResult CertificateMappingMethods { get; set; }
         public IntRegistryAPIResult StrongCertificateBindingEnforcement { get; set; }
     }
 
-    public class ComputerStatus
-    {
+    public class ComputerStatus {
         public bool Connectable { get; set; }
         public string Error { get; set; }
 
@@ -40,10 +78,8 @@ public class ComputerStatus
         public static string PortNotOpen => "PortNotOpen";
         public static string Success => "Success";
 
-        public CSVComputerStatus GetCSVStatus(string computerName)
-        {
-            return new CSVComputerStatus
-            {
+        public CSVComputerStatus GetCSVStatus(string computerName) {
+            return new CSVComputerStatus {
                 Status = Error,
                 Task = "CheckAvailability",
                 ComputerName = computerName
diff --git a/src/CommonLib/OutputTypes/EnterpriseCA.cs b/src/CommonLib/OutputTypes/EnterpriseCA.cs
index 658f38a6..50268a33 100644
--- a/src/CommonLib/OutputTypes/EnterpriseCA.cs
+++ b/src/CommonLib/OutputTypes/EnterpriseCA.cs
@@ -5,5 +5,6 @@ public class EnterpriseCA : OutputBase
         public string HostingComputer { get; set; }
         public CARegistryData CARegistryData { get; set; }
         public TypedPrincipal[] EnabledCertTemplates { get; set; }
+        public ApiResult<CAEnrollmentEndpoint>[] HttpEnrollmentEndpoints { get; set; }
     }
 }
\ No newline at end of file
diff --git a/src/CommonLib/OutputTypes/NtlmSession.cs b/src/CommonLib/OutputTypes/NtlmSession.cs
new file mode 100644
index 00000000..f17230ca
--- /dev/null
+++ b/src/CommonLib/OutputTypes/NtlmSession.cs
@@ -0,0 +1,105 @@
+#nullable enable
+using SharpHoundCommonLib.Processors;
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Eventing.Reader;
+using SharpHoundCommonLib.Enums;
+
+namespace SharpHoundCommonLib.OutputTypes {
+    public class NtlmSessionResult {
+        public List<NtlmSession>? Sessions { get; set; }
+        public long CollectionDurationMs { get; set; }
+    }
+
+    public class NtlmSession(
+        DateTime? timeCreatedUtc,
+        SecurityLogId id,
+        string? accountSid,
+        string accountName,
+        string? accountDomain,
+        string sourceHost,
+        string? sourceIp,
+        string? sourcePort,
+        string packageName
+    ) {
+        public DateTime? TimeCreatedUtc { get; set; } = timeCreatedUtc;
+        public SecurityLogId Id { get; set; } = id;
+        public string? AccountSid { get; set; } = accountSid;
+        public string AccountName { get; set; } = accountName;
+        public string? AccountDomain { get; set; } = accountDomain;
+        public string SourceHost { get; set; } = sourceHost; // The host the auth originated from
+        public string? SourceIp { get; set; } = sourceIp;
+        public string? SourcePort { get; set; } = sourcePort;
+        public string? PackageName { get; set; } = packageName;
+
+        public override string ToString() {
+            var targetUser = AccountDomain + "\\" + AccountName;
+            var source = (SourceIp != null || SourcePort != null) ? $"{SourceIp}:{SourcePort}" : "";
+
+            return ($"{TimeCreatedUtc?.ToLocalTime()},{Id},{targetUser},{AccountSid},{SourceHost},{source},{PackageName}");
+        }
+
+        public static NtlmSession FromLogonEvent(EventRecord evnt) {
+            if (evnt.Id != EventIds.LogonEvent)
+                throw new ArgumentException("Not a logon event");
+
+            //var subjectUserSid = eventDetail.Properties[0].Value.ToString();
+            //var subjectUserName = eventDetail.Properties[1].Value.ToString();
+            //var subjectDomainName = eventDetail.Properties[2].Value.ToString();
+            //var subjectLogonId = eventDetail.Properties[3].Value.ToString();
+            var targetUserSid = evnt.Properties[4].Value.ToString();
+            var targetUserName = evnt.Properties[5].Value.ToString();
+            var targetDomainName = evnt.Properties[6].Value.ToString();
+            //var targetLogonId = eventDetail.Properties[7].Value.ToString();
+            //var logonType = eventDetail.Properties[8].Value.ToString();
+            //var logonType = $"{(SECURITY_LOGON_TYPE)(int.Parse(eventDetail.Properties[8].Value.ToString()))}";
+            //var logonProcessName = eventDetail.Properties[9].Value.ToString();
+            //var authenticationPackageName = eventDetail.Properties[10].Value.ToString();
+            var workstationName = evnt.Properties[11].Value.ToString();
+            //var logonGuid = eventDetail.Properties[12].Value.ToString();
+            //var transmittedServices = eventDetail.Properties[13].Value.ToString();
+            var lmPackageName = evnt.Properties[14].Value.ToString();
+            //var keyLength = eventDetail.Properties[15].Value.ToString();
+            //var processId = eventDetail.Properties[16].Value.ToString();
+            //var processName = eventDetail.Properties[17].Value.ToString();
+            var ipAddress = evnt.Properties[18].Value.ToString();
+            var ipPort = evnt.Properties[19].Value.ToString();
+
+
+            return new NtlmSession(
+                evnt.TimeCreated?.ToUniversalTime(),
+                SecurityLogId.Logon,
+                targetUserSid,
+                targetUserName,
+                targetDomainName,
+                workstationName,
+                ipAddress,
+                ipPort,
+                lmPackageName
+            );
+        }
+
+        public static NtlmSession FromValidateCredentialEvent(EventRecord evnt) {
+            if (evnt.Id != EventIds.ValidateCredentialsEvent)
+                throw new ArgumentException("Not a validate credential event");
+
+            var packageName = evnt.Properties[0].Value.ToString();
+            var targetUserName = evnt.Properties[1].Value.ToString();
+            var workstation = evnt.Properties[2].Value.ToString();
+            //var status = evt.Properties[3].Value.ToString();
+
+            return new NtlmSession(
+                evnt.TimeCreated?.ToUniversalTime(),
+                SecurityLogId.Logon,
+                null,
+                targetUserName,
+                null,
+                workstation,
+                null,
+                null,
+                packageName
+            );
+        }
+    }
+}
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/CAEnrollmentProcessor.cs b/src/CommonLib/Processors/CAEnrollmentProcessor.cs
new file mode 100644
index 00000000..0e106781
--- /dev/null
+++ b/src/CommonLib/Processors/CAEnrollmentProcessor.cs
@@ -0,0 +1,179 @@
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Ntlm;
+using SharpHoundCommonLib.OutputTypes;
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Http;
+using System.Net.Sockets;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors {
+    public class CAEnrollmentProcessor {
+        private readonly string _caDnsHostname;
+        private readonly string _caName;
+        private readonly ILogger _logger;
+        private readonly IHttpClientFactory _httpClientFactory;
+
+        public CAEnrollmentProcessor(string caDnsHostname, string caName, ILogger log = null) {
+            ServicePointManager.SecurityProtocol |=
+                SecurityProtocolType.Ssl3
+                | SecurityProtocolType.Tls12
+                | SecurityProtocolType.Tls11
+                | SecurityProtocolType.Tls;
+
+            _caDnsHostname = caDnsHostname;
+            _caName = caName;
+            _logger = log ?? Logging.LogProvider.CreateLogger("CAEnrollmentProcessor");
+
+            _httpClientFactory = new HttpClientFactory();
+        }
+
+
+        public async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>> ScanAsync() {
+            var endpoints = new List<ApiResult<CAEnrollmentEndpoint>>();
+
+            try {
+                var webEnrollmentTask = ScanHttpEndpoint(CAEnrollmentEndpointType.WebEnrollmentApplication);
+                var webServiceTask = ScanHttpEndpoint(CAEnrollmentEndpointType.EnrollmentWebService);
+
+                await Task.WhenAll(
+                    webEnrollmentTask,
+                    webServiceTask
+                );
+
+                endpoints.AddRange(await webEnrollmentTask);
+                endpoints.AddRange(await webServiceTask);
+            } catch (Exception ex) {
+                _logger.LogError(ex, "An error occurred while scanning enrollment endpoints");
+            }
+
+            return endpoints;
+        }
+
+        private async Task<IEnumerable<ApiResult<CAEnrollmentEndpoint>>>
+            ScanHttpEndpoint(CAEnrollmentEndpointType type) {
+            var endpoints = new List<ApiResult<CAEnrollmentEndpoint>>();
+            var (httpUrl, httpsUrl) = BuildEnrollmentUrls(type);
+
+
+            // Check 1 - ESC8 via HTTP
+            // Is the HTTP URL accessible via NTLM? If so, it's vulnerable to NTLM relay
+            var endpoint = await GetNtlmEndpoint(httpUrl, null, type,
+                CAEnrollmentEndpointScanResult.Vulnerable_NtlmHttpEndpoint);
+            endpoints.Add(endpoint);
+
+            // Check 2 - ESC8 via HTTPS w/o channel binding (EPA)
+            // Is the HTTPS URL accessible via NTLM with bad channel bindings? (i.e. channel binding is not enforced)
+            var esc8Https = await GetNtlmEndpoint(
+                httpsUrl,
+                useBadChannelBinding: true,
+                type,
+                CAEnrollmentEndpointScanResult.Vulnerable_NtlmHttpsNoChannelBinding
+            );
+            endpoints.Add(esc8Https);
+
+            // TODO: For completeness/awareness, check if the endpoint is accessible via NTLM with valid Channel Bindings?
+
+            return endpoints;
+        }
+
+        private (Uri httpUrl, Uri httpsUrl) BuildEnrollmentUrls(CAEnrollmentEndpointType type) {
+            switch (type) {
+                case CAEnrollmentEndpointType.WebEnrollmentApplication:
+                    return (new Uri($"http://{_caDnsHostname}/certsrv/"),
+                        new Uri($"https://{_caDnsHostname}/certsrv/"));
+
+                case CAEnrollmentEndpointType.EnrollmentWebService:
+                    return (new Uri($"http://{_caDnsHostname}/{_caName}_CES_Kerberos/service.svc"),
+                        new Uri($"https://{_caDnsHostname}/{_caName}_CES_Kerberos/service.svc"));
+
+                default:
+                    throw new ArgumentException("Unhandled enrollment endpoint type");
+            }
+        }
+
+
+        private async Task<ApiResult<CAEnrollmentEndpoint>> GetNtlmEndpoint(Uri url, bool? useBadChannelBinding,
+            CAEnrollmentEndpointType type, CAEnrollmentEndpointScanResult scanResult) {
+            var authService = new HttpNtlmAuthenticationService(
+                new HttpClientFactory()
+            );
+
+            var output = new CAEnrollmentEndpoint(url, type, scanResult);
+
+            try {
+                await authService.EnsureRequiresAuth(url, useBadChannelBinding);
+                return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+            } catch (HttpRequestException ex) {
+                if (ex.InnerException is WebException) {
+                    var webEx = (WebException)ex.InnerException;
+
+
+                    if (webEx.InnerException is SocketException) {
+                        output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PortInaccessible;
+                        return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+                    }
+
+                    if (webEx.Status == WebExceptionStatus.NameResolutionFailure) {
+                        return ApiResult<CAEnrollmentEndpoint>.CreateError("Could not resolve hostname");
+                    }
+
+                    if (webEx.Response is HttpWebResponse httpResponse) {
+                        HttpStatusCode statusCode = httpResponse.StatusCode;
+
+                        switch (statusCode) {
+                            case HttpStatusCode.NotFound:
+                                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathNotFound;
+                                break;
+                            case HttpStatusCode.Forbidden:
+                                // Returned if the IIS is configured to require SSL (so no HTTP possible)
+                                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathForbidden;
+                                break;
+                            default:
+                                return ApiResult<CAEnrollmentEndpoint>
+                                    .CreateError(
+                                        $"Unexpected status code '{statusCode}' for the URL {url}. UseBadChannelBindings: {useBadChannelBinding}");
+                        }
+
+                        return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+                    }
+                    Console.WriteLine($"WebException occurred: {ex}");
+
+                    return ApiResult<CAEnrollmentEndpoint>
+                        .CreateError(
+                            $"Unhandled WebException. Url: {url}. Exception: {webEx}. Inner: {webEx.InnerException}  Data: {webEx.Data}");
+                }
+
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateError(
+                        $"HttpRequestException occured checking NTLM accessibility for URL: {url}. Exception: {ex}");
+            } catch (HttpUnauthorizedException ex) {
+                if (useBadChannelBinding == true) {
+                    output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_NtlmChannelBindingRequired;
+                    return ApiResult<CAEnrollmentEndpoint>.CreateSuccess(output);
+                }
+
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateError(
+                        $"401 Unauthorized exception checking NTLM accessibility for URL: {url}. Exception: {ex}");
+            } catch (HttpForbiddenException) {
+                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathForbidden;
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateSuccess(output);
+            } catch (HttpServerErrorException) {
+                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_PathNotFound;
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateSuccess(output);
+            } catch (MissingChallengeException) {
+                output.Status = CAEnrollmentEndpointScanResult.NotVulnerable_NoNtlmChallenge;
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateSuccess(output);
+            } catch (Exception ex) {
+                return ApiResult<CAEnrollmentEndpoint>
+                    .CreateError(
+                        $"Unhandled exception checking NTLM accessibility for URL: {url}. BadChannelBindings: {useBadChannelBinding}.  Exception: {ex}");
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Processors/CertAbuseProcessor.cs b/src/CommonLib/Processors/CertAbuseProcessor.cs
index 8c1cc787..5698a89e 100644
--- a/src/CommonLib/Processors/CertAbuseProcessor.cs
+++ b/src/CommonLib/Processors/CertAbuseProcessor.cs
@@ -29,7 +29,7 @@ public CertAbuseProcessor(ILdapUtils utils, ILogger log = null)
         }
 
         /// <summary>
-        /// This function should be called with the security data fetched from <see cref="GetCARegistryValues"/>.
+        /// This function should be called with the security data fetched from <see cref="GetCASecurity"/>.
         /// The resulting ACEs will contain the owner of the CA as well as Management rights.
         /// </summary>
         /// <param name="security"></param>
@@ -149,10 +149,12 @@ public async Task<AceRegistryAPIResult> ProcessRegistryEnrollmentPermissions(str
         }
         
         /// <summary>
-        /// This function should be called with the enrollment data fetched from <see cref="GetCARegistryValues"/>.
-        /// The resulting items will contain enrollment agent restrictions
+        /// This function will retrieve the enrollment agent restrictions from a ca
         /// </summary>
-        /// <param name="enrollmentAgentRestrictions"></param>
+        /// <param name="caName"></param>
+        /// <param name="objectDomain"></param>
+        /// <param name="computerName"></param>
+        /// <param name="computerObjectId"></param>
         /// <returns></returns>
         public async Task<EnrollmentAgentRegistryAPIResult> ProcessEAPermissions(string caName, string objectDomain, string computerName, string computerObjectId)
         {
@@ -245,7 +247,6 @@ private RegistryResult GetEnrollmentAgentRights(string target, string caName)
         /// <param name="target"></param>
         /// <param name="caName"></param>
         /// <returns></returns>
-        /// <exception cref="Exception"></exception>
         [ExcludeFromCodeCoverage]
         public BoolRegistryAPIResult IsUserSpecifiesSanEnabled(string target, string caName)
         {
@@ -281,7 +282,6 @@ public BoolRegistryAPIResult IsUserSpecifiesSanEnabled(string target, string caN
         /// <param name="target"></param>
         /// <param name="caName"></param>
         /// <returns></returns>
-        /// <exception cref="Exception"></exception>
         [ExcludeFromCodeCoverage]
         public BoolRegistryAPIResult RoleSeparationEnabled(string target, string caName)
         {
diff --git a/src/CommonLib/Processors/ComputerSessionProcessor.cs b/src/CommonLib/Processors/ComputerSessionProcessor.cs
index 2c9a4673..35f5f122 100644
--- a/src/CommonLib/Processors/ComputerSessionProcessor.cs
+++ b/src/CommonLib/Processors/ComputerSessionProcessor.cs
@@ -50,12 +50,12 @@ public ComputerSessionProcessor(ILdapUtils utils,
         /// <returns></returns>
         public async Task<SessionAPIResult> ReadUserSessions(string computerName, string computerSid,
             string computerDomain, TimeSpan timeout = default) {
-
             if (timeout == default) {
                 timeout = TimeSpan.FromMinutes(2);
             }
+
             var ret = new SessionAPIResult();
-            
+
             _log.LogDebug("Running NetSessionEnum for {ObjectName}", computerName);
 
             var result = await Task.Run(() => {
@@ -172,7 +172,7 @@ public async Task<SessionAPIResult> ReadUserSessionsPrivileged(string computerNa
             if (timeout == default) {
                 timeout = TimeSpan.FromMinutes(2);
             }
-            
+
             _log.LogDebug("Running NetWkstaUserEnum for {ObjectName}", computerName);
 
             var result = await Task.Run(() => {
@@ -198,7 +198,7 @@ public async Task<SessionAPIResult> ReadUserSessionsPrivileged(string computerNa
 
                 return result;
             }).TimeoutAfter(timeout);
-            
+
             if (result.IsFailed) {
                 await SendComputerStatus(new CSVComputerStatus {
                     Status = result.GetErrorStatus(),
@@ -224,7 +224,7 @@ await SendComputerStatus(new CSVComputerStatus {
             foreach (var wkstaUserInfo in result.Value) {
                 var domain = wkstaUserInfo.LogonDomain;
                 var username = wkstaUserInfo.Username;
-                
+
                 //If we dont have a domain or the domain has a space, ignore this object as it's unusable for us
                 if (string.IsNullOrWhiteSpace(domain) || domain.Contains(" ")) {
                     continue;
@@ -256,7 +256,7 @@ await SendComputerStatus(new CSVComputerStatus {
         public async Task<SessionAPIResult> ReadUserSessionsRegistry(string computerName, string computerDomain,
             string computerSid) {
             var ret = new SessionAPIResult();
-            
+
             _log.LogDebug("Running RegSessionEnum for {ObjectName}", computerName);
 
             RegistryKey key = null;
diff --git a/src/CommonLib/Processors/DCLdapProcessor.cs b/src/CommonLib/Processors/DCLdapProcessor.cs
new file mode 100644
index 00000000..4cfddd22
--- /dev/null
+++ b/src/CommonLib/Processors/DCLdapProcessor.cs
@@ -0,0 +1,165 @@
+#nullable enable
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.Enums;
+using SharpHoundCommonLib.Ntlm;
+using SharpHoundCommonLib.OutputTypes;
+using SharpHoundCommonLib.ThirdParty.PSOpenAD;
+using System;
+using System.Diagnostics.CodeAnalysis;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors;
+
+public class LdapAuthOptions {
+    public bool Signing { get; set; }
+    public ChannelBindings? Bindings { get; set; }
+}
+
+public class DCLdapProcessor {
+    private readonly ILogger _log;
+    private readonly PortScanner _scanner;
+    private readonly int _portScanTimeout;
+    private readonly int _ldapTimeout;
+    private readonly Uri _ldapEndpoint;
+    private readonly Uri _ldapSslEndpoint;
+
+    private readonly string SEC_E_UNSUPPORTED_FUNCTION = "80090302";
+    private readonly string SEC_E_BAD_BINDINGS = "80090346";
+
+
+    public DCLdapProcessor(int portScanTimeout, string dcHostname, ILogger log) {
+        _log = log;
+        _scanner = new PortScanner();
+        _portScanTimeout = portScanTimeout;
+        _ldapTimeout = portScanTimeout / 1000;
+        _ldapEndpoint = new Uri($"ldap://{dcHostname}:389");
+        _ldapSslEndpoint = new Uri($"ldaps://{dcHostname}:636");
+    }
+
+    public async Task<LdapService> Scan() {
+        var hasLdap = await TestLdapPort();
+        var hasLdaps = await TestLdapsPort();
+        ApiResult<bool> isSigningRequired = new(),
+            isChannelBindingDisabled = new();
+
+        if (hasLdap) {
+            isSigningRequired = await CheckIsNtlmSigningRequired();
+        }
+
+        if (hasLdaps) {
+            isChannelBindingDisabled = await CheckIsChannelBindingDisabled();
+        }
+
+        return new LdapService(
+            hasLdap,
+            hasLdaps,
+            isSigningRequired,
+            isChannelBindingDisabled
+        );
+    }
+
+    /// <summary>
+    /// Tests if the specified Ldap port is open
+    /// </summary>
+    /// <returns>bool</returns>
+    [ExcludeFromCodeCoverage]
+    public async Task<bool> TestLdapPort() {
+        return await _scanner.CheckPort(_ldapEndpoint.Host, _ldapEndpoint.Port, _portScanTimeout);
+    }
+
+    [ExcludeFromCodeCoverage]
+    public async Task<bool> TestLdapsPort() {
+        return await _scanner.CheckPort(_ldapSslEndpoint.Host, _ldapSslEndpoint.Port, _portScanTimeout);
+    }
+
+    public async Task<ApiResult<bool>> CheckIsNtlmSigningRequired() {
+        try {
+            var options = new LdapAuthOptions() {
+                Signing = false
+            };
+            var accessibleWithoutSigning = await Authenticate(_ldapEndpoint, options);
+
+            return ApiResult<bool>.CreateSuccess(accessibleWithoutSigning == false);
+        } catch (Exception ex) {
+            return ApiResult<bool>.CreateError($"CheckIsNtlmSigningRequired failed: {ex}");
+        }
+    }
+
+    // Checks if EPA is enabled. Does so by trying to auth with wrong channel bindings.
+    // If auth is successful despite the wrong bindings, then EPA is not required.
+    // Note: Ideally we'd check if it works under 3 conditions:
+    // 1) No channel bindings to check if configured to "Never"
+    // 2) Invalid bindings to check if configured to "Always" (would error)
+    // 3) Correct bindings to ensure NTLM auth is enabled
+    // However, as of right now we only do #2. We can't do #1 right now since the
+    // Window's SSPI APIs (InitSecurityContext) always add channel bindings.
+    public async Task<ApiResult<bool>> CheckIsChannelBindingDisabled() {
+        try {
+            // 1) Can we connect with *invalid* bindings
+
+            var bindings = new ChannelBindings {
+                ApplicationData = [0, 0, 0, 0]
+            };
+            var accessibleWithNoBindings = await Authenticate(_ldapSslEndpoint, new LdapAuthOptions() {
+                Signing = false,
+                Bindings = bindings
+            });
+
+            return ApiResult<bool>.CreateSuccess(accessibleWithNoBindings);
+        } catch (Exception ex) {
+            return ApiResult<bool>.CreateError($"CheckIsNtlmSigningRequired failed: {ex}");
+        }
+    }
+
+    private async Task<bool> Authenticate(Uri endpoint, LdapAuthOptions options) {
+        var host = endpoint.Host;
+        var auth = new NtlmAuthenticationHandler($"LDAP/{host.ToUpper()}") {
+            Options = options
+        };
+        var transport = new LdapTransport(_log, endpoint);
+
+        try {
+            transport.InitializeConnectionAsync(_ldapTimeout);
+            await auth.PerformNtlmAuthenticationAsync(transport);
+            return true;
+        } catch (LdapNativeException ex) {
+            switch (ex.ErrorCode) {
+                case (int)LdapErrorCodes.InvalidCredentials:
+                    // If NTLM is blocked via GPO, the server returns the following error message:
+                    //   "80090302: LdapErr: DSID-0C090816, comment: AcceptSecurityContext error, data 1, v6673"
+                    //   0x80090302 == SEC_E_UNSUPPORTED_FUNCTION
+                    if (ex.ServerErrorMessage.StartsWith(SEC_E_UNSUPPORTED_FUNCTION)) {
+                        _log.LogDebug("LDAP endpoint '{endpoint}' does not support NTLM", endpoint);
+                        return false;
+                    }
+
+                    if (ex.ServerErrorMessage.StartsWith(SEC_E_BAD_BINDINGS)) {
+                        _log.LogDebug("Bad bindings with the LDAPS endpoint '{endpoint}'. Server error: {serverError}",
+                            endpoint, ex.ServerErrorMessage);
+                        return false;
+                    } else {
+                        _log.LogError(
+                            "Unhandled LDAP InvalidCred error code during LDAP test: {ex}, Server error: {err}", ex,
+                            ex.ServerErrorMessage);
+                        break;
+                    }
+                case (int)LdapErrorCodes.StrongAuthRequired:
+                    _log.LogDebug("LDAP requires signing. Endpoint: {endpoint}", endpoint);
+                    return false;
+                case (int)LdapErrorCodes.ServerDown:
+                    _log.LogDebug("LDAP endpoint '{endpoint}' not accessible", endpoint);
+                    return false;
+                default:
+                    _log.LogError("Unhandled LdapException error code during LDAP test: {ex}, Server error: {err}", ex,
+                        ex.ServerErrorMessage);
+                    break;
+            }
+        } catch (Exception ex) {
+            _log.LogError("An unhandled error occurred during the LDAP test: {ex}", ex);
+        }
+
+        return false;
+    }
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/DCRegistryProcessor.cs b/src/CommonLib/Processors/DCRegistryProcessor.cs
index 0bd5bad0..bdc5a6d5 100644
--- a/src/CommonLib/Processors/DCRegistryProcessor.cs
+++ b/src/CommonLib/Processors/DCRegistryProcessor.cs
@@ -24,7 +24,6 @@ public DCRegistryProcessor(ILdapUtils utils, ILogger log = null)
         /// <remarks>https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16</remarks>
         /// <param name="target"></param>
         /// <returns>IntRegistryAPIResult</returns>
-        /// <exception cref="Exception"></exception>
         [ExcludeFromCodeCoverage]
         public IntRegistryAPIResult GetCertificateMappingMethods(string target)
         {
@@ -57,7 +56,6 @@ public IntRegistryAPIResult GetCertificateMappingMethods(string target)
         /// <remarks>https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16</remarks>
         /// <param name="target"></param>
         /// <returns>IntRegistryAPIResult</returns>
-        /// <exception cref="Exception"></exception>
         [ExcludeFromCodeCoverage]
         public IntRegistryAPIResult GetStrongCertificateBindingEnforcement(string target)
         {
diff --git a/src/CommonLib/Processors/EventLogProcessor.cs b/src/CommonLib/Processors/EventLogProcessor.cs
new file mode 100644
index 00000000..97dbe865
--- /dev/null
+++ b/src/CommonLib/Processors/EventLogProcessor.cs
@@ -0,0 +1,296 @@
+#nullable enable
+using Microsoft.Extensions.Logging;
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Eventing.Reader;
+using System.Diagnostics;
+using System.Threading.Tasks;
+using SharpHoundCommonLib.OutputTypes;
+using System.Net;
+
+namespace SharpHoundCommonLib.Processors {
+    [Flags]
+    public enum EventLogCollection {
+        InboundNtlmSessions,
+        DomainControllerNtlmAuth,
+    }
+
+    public class EventLogProcessor(
+        ILdapUtils utils,
+        ILogger log,
+        string host,
+        string domain,
+        EventLogCollection collectionType,
+        int numDays = 7,
+        int readEventDelayMs = 5,
+        int readEventTimeoutMs = 10000,
+        NetworkCredential? localAdminCredential = null
+    ) {
+        private readonly TimeSpan _readEventTimeoutMs = TimeSpan.FromMilliseconds(readEventTimeoutMs);
+
+        #region Event Log XPath Queries
+
+        /* Logic for non-DC machines:
+         * - Collect from the Security event log
+         * - Get 4624 events (Logon Events) in the last X days
+         * - Filter where LogonType=3 (Network Logon) since for NTLM we're interested in inbound network auth attempts
+         * - Filter on either of these:
+         *   - NTLMv2 and KeyLength=0 (indicates signing is disabled)
+         *   - NTLMV1 (doesn't support signing)
+         *
+         * Example event XML data:
+         * <EventData>
+         *   <Data Name="SubjectUserSid">S-1-0-0</Data>
+         *   <Data Name="SubjectUserName">-</Data>
+         *   <Data Name="SubjectDomainName">-</Data>
+         *   <Data Name="SubjectLogonId">0x0</Data>
+         *   <Data Name="TargetUserSid">S-1-5-21-3821320868-1508310791-3575676346-1103</Data>
+         *   <Data Name="TargetUserName">itadmin</Data>
+         *   <Data Name="TargetDomainName">CORP</Data>
+         *   <Data Name="TargetLogonId">0x21eacfe9</Data>
+         *   <Data Name="LogonType">3</Data>
+         *   <Data Name="LogonProcessName">NtLmSsp</Data>
+         *   <Data Name="AuthenticationPackageName">NTLM</Data>
+         *   <Data Name="WorkstationName">WIN11</Data>
+         *   <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
+         *   <Data Name="TransmittedServices">-</Data>
+         *   <Data Name="LmPackageName">NTLM V2</Data>
+         *   <Data Name="KeyLength">0</Data>
+         *   <Data Name="ProcessId">0x0</Data>
+         *   <Data Name="ProcessName">-</Data>
+         *   <Data Name="IpAddress">192.168.230.101</Data>
+         *   <Data Name="IpPort">54303</Data>
+         *   <Data Name="ImpersonationLevel">%%1833</Data>
+         *   <Data Name="RestrictedAdminMode">-</Data>
+         *   <Data Name="RemoteCredentialGuard">-</Data>
+         *   <Data Name="TargetOutboundUserName">-</Data>
+         *   <Data Name="TargetOutboundDomainName">-</Data>
+         *   <Data Name="VirtualAccount">%%1843</Data>
+         *   <Data Name="TargetLinkedLogonId">0x0</Data>
+         *   <Data Name="ElevatedToken">%%1842</Data>
+         * </EventData>
+         */
+        private readonly string _noSigningXpathEvents = @"
+<QueryList>
+  <Query Id='0' Path='Security'>
+    <Select Path='Security'>
+      *[System[
+        (EventID=4624)
+        and
+        (TimeCreated[timediff(@SystemTime) &lt;= {0}])
+      ]]
+      and
+      *[EventData[
+        (
+          (Data[@Name='LogonType']=3)
+          and
+          (
+            (Data[@Name='LmPackageName']='NTLM V2' and Data[@Name='KeyLength']=0)
+            or
+            (Data[@Name='LmPackageName']='NTLM V1')
+          )
+        )
+      ]]
+    </Select>
+  </Query>
+</QueryList>
+".Trim();
+
+        /* Logic for DC machines:
+         * - Collect from the Security event log
+         * - Get 4776 events (Logon Events) in the last X days. This event is only generated for NTLM auth.
+         * - Filter on:
+         *      Status=0 (Successful auth)
+         *
+         * - Example event XML data:
+          <Event>
+            <EventData>
+              <Data Name="PackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data>
+              <Data Name="TargetUserName">lowpriv</Data>
+              <Data Name="Workstation">DESKTOP-P8UDQ3B</Data>
+              <Data Name="Status">0x0</Data>
+            </EventData>
+          </Event>
+        */
+        private readonly string _dcNtlmAuthXpathEvents = @"
+<QueryList>
+  <Query Id=""0"" Path=""Security"">
+    <Select Path=""Security"">
+      *[System[
+        (EventID=4776)
+        and
+        (TimeCreated[timediff(@SystemTime) &lt;= {0}])
+      ]]
+      and
+      *[EventData[
+        (
+          (Data[@Name='Status']=""0x0"")
+        )
+      ]]
+    </Select>
+  </Query>
+</QueryList>
+";
+
+        #endregion // Event Log XPath Queries
+
+        public ApiResult<NtlmSessionResult> ReadEvents() {
+            var result = new NtlmSessionResult();
+            string query;
+            var timeFilterMs = TimeSpan.FromDays(numDays).TotalMilliseconds;
+
+            switch (collectionType) {
+                case EventLogCollection.DomainControllerNtlmAuth:
+                    query = string.Format(_dcNtlmAuthXpathEvents, timeFilterMs);
+                    break;
+                case EventLogCollection.InboundNtlmSessions:
+                    query = string.Format(_noSigningXpathEvents, timeFilterMs);
+                    break;
+                default:
+                    throw new InvalidOperationException("Invalid option");
+            }
+
+
+            try {
+                var sw = Stopwatch.StartNew();
+                result.Sessions = CollectEvents(query);
+                sw.Stop();
+
+                result.CollectionDurationMs = sw.ElapsedMilliseconds;
+
+                log.LogDebug(
+                    $"Processed {result.Sessions.Count} event logs in {sw.Elapsed}. Event Log Collection Type: {collectionType}");
+
+                return ApiResult<NtlmSessionResult>.CreateSuccess(result);
+            } catch (UnauthorizedAccessException) {
+                return ApiResult<NtlmSessionResult>.CreateError("Access Denied");
+            } catch (Exception ex) {
+                return ApiResult<NtlmSessionResult>.CreateError($"Unexpected exception: {ex}");
+            }
+        }
+
+        private List<NtlmSession> CollectEvents(string query) {
+            var ntlmSessions = new List<NtlmSession>();
+            var dupCheck = new HashSet<string>();
+
+            using var logReader = GetEventLogReader(host, "Security", query);
+
+            for (var evnt = logReader.ReadEvent(_readEventTimeoutMs);
+                 evnt != null;
+                 evnt = logReader.ReadEvent()) {
+                var eventId = (SecurityLogId)evnt.Id;
+                var parsed = ProcessSecurityEvent(evnt, eventId).Result;
+                // Don't return another if we've already got the info
+                if (dupCheck.Add(GetHashString(parsed))) {
+                    ntlmSessions.Add(parsed);
+                }
+
+                if (readEventDelayMs > 0) {
+                    System.Threading.Thread.Sleep(readEventDelayMs);
+                }
+            }
+
+            return ntlmSessions;
+        }
+
+        private string GetHashString(NtlmSession s) {
+            return $"{s.AccountDomain}{s.AccountName}{s.AccountSid}{s.PackageName}{s.SourceIp}{s.SourceHost}";
+        }
+
+        private async Task<string?> ResolveNameToSid(string username, string domain) {
+            var (matchSuccess, sids) = await utils.GetGlobalCatalogMatches(username, domain);
+            if (matchSuccess) {
+                if (sids.Length > 1) {
+                    log.LogError("More than one SID was returned for the user '{user}'. SIDs: {sids}", username,
+                        string.Join(",", sids));
+                    return null;
+                }
+
+                return sids[0];
+            } else {
+                var (success, principal) = await utils.ResolveAccountName(username, domain);
+
+                if (!success) return null;
+
+                return principal.ObjectIdentifier;
+            }
+        }
+
+        private async Task<NtlmSession> ProcessSecurityEvent(EventRecord evnt, SecurityLogId eventId) {
+            NtlmSession session;
+
+            switch (eventId) {
+                case SecurityLogId.Logon:
+                    session = NtlmSession.FromLogonEvent(evnt);
+                    return session;
+
+                case SecurityLogId.ValidateCredential:
+
+                    session = NtlmSession.FromValidateCredentialEvent(evnt);
+
+                    // The Validate Credential event does not return the domain or account sid
+                    // so try and find those
+                    var sid = await ResolveNameToSid(session.AccountName, domain);
+
+                    session.AccountSid = sid?.ToString();
+                    session.AccountDomain = domain;
+
+                    return session;
+
+                default:
+                    throw new InvalidOperationException("Unhandled security event log ID");
+            }
+        }
+
+
+        private EventLogReader GetEventLogReader(string host, string path, string query) {
+            var eventsQuery = new EventLogQuery(path, PathType.LogName, query) { ReverseDirection = true };
+            if (!string.IsNullOrEmpty(host)) {
+                EventLogSession session;
+                if (localAdminCredential == null) {
+                    session = new EventLogSession(
+                        host,
+                        null,
+                        null,
+                        null,
+                        SessionAuthentication.Negotiate
+                    );
+                } else {
+                    session = new EventLogSession(
+                        host,
+                        localAdminCredential.Domain,
+                        localAdminCredential.UserName,
+                        localAdminCredential.SecurePassword,
+                        SessionAuthentication.Negotiate
+                    );
+                }
+
+                eventsQuery.Session = session;
+            }
+
+            var logReader = new EventLogReader(eventsQuery);
+            return logReader;
+        }
+    }
+
+    public enum SecurityLogId {
+        Logon = 4624,
+        ValidateCredential = 4776
+    }
+
+    public enum SecurityLogLogonType : uint {
+        Interactive = 2, // logging on interactively.
+        Network, // logging using a network.
+        Batch, // logon for a batch process.
+        Service, // logon for a service account.
+        Proxy, // Not supported.
+        Unlock, // Tattempt to unlock a workstation.
+        NetworkCleartext, // network logon with cleartext credentials
+        NewCredentials, // caller can clone its current token and specify new credentials for outbound connections
+        RemoteInteractive, // terminal server session that is both remote and interactive
+        CachedInteractive, // attempt to use the cached credentials without going out across the network
+        CachedRemoteInteractive, // same as RemoteInteractive, except used internally for auditing purposes
+        CachedUnlock // attempt to unlock a workstation
+    }
+}
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/SmbProcessor.cs b/src/CommonLib/Processors/SmbProcessor.cs
new file mode 100644
index 00000000..41692493
--- /dev/null
+++ b/src/CommonLib/Processors/SmbProcessor.cs
@@ -0,0 +1,385 @@
+#nullable enable
+
+using Microsoft.Extensions.Logging;
+using SharpHoundCommonLib.OutputTypes;
+using System;
+using System.Collections.Specialized;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors {
+    public class SmbProcessor(int timeoutMs, ILogger? log = null) {
+        private readonly ILogger _log = log ?? Logging.LogProvider.CreateLogger("SmbProcessor");
+
+        public async Task<ApiResult<SmbInfo>> Scan(string host) {
+            var scanner = new SmbScanner();
+            var result = await scanner.Scan(host, 445, timeoutMs);
+
+            if (result.Success && result.Info != null) {
+                var info = new SmbInfo() {
+                    SigningEnabled = result.Info.SmbSigning,
+                    OsVersion = result.Info.OsVersion,
+                    OsBuild = result.Info.OsBuildNumber.ToString(),
+                    DnsComputerName = result.Info.DnsComputerName,
+                };
+
+                return ApiResult<SmbInfo>.CreateSuccess(info);
+            } else {
+                return ApiResult<SmbInfo>.CreateError(result.ErrorMessage ?? "Unknown error");
+            }
+        }
+    }
+
+
+    public enum SmbVersion {
+        Unknown,
+        SMBv1,
+        SMBv2
+    }
+
+    public class SmbScanResult {
+        public SmbScanResult(string host) {
+            Host = host;
+        }
+
+        public string Host { get; set; }
+        public bool Success { get; set; }
+        public string? ErrorMessage { get; set; }
+        public NTLMInfo? Info { get; set; }
+        public SmbVersion SmbVersion { get; set; }
+    }
+
+    public class SMBPacket {
+        public SMBPacket(bool signingEnabled) {
+            if (signingEnabled) {
+                SMB_Signing = signingEnabled;
+                SMB_Session_Key_Length = [0x00, 0x00];
+                SMB_Negotiate_Flags = [0x15, 0x82, 0x08, 0xa0];
+            } else {
+                SMB_Signing = signingEnabled;
+                SMB_Session_Key_Length = [0x00, 0x00];
+                SMB_Negotiate_Flags = [0x05, 0x80, 0x08, 0xa0];
+            }
+        }
+
+        public OrderedDictionary? Packet_SMB_Header { get; set; }
+        public OrderedDictionary? Packet_SMB2_Header { get; set; }
+        public OrderedDictionary? Packet_SMB_Data { get; set; }
+        public OrderedDictionary? Packet_SMB2_Data { get; set; }
+        public OrderedDictionary? Packet_NTLMSSP_Negotiate { get; set; }
+        public OrderedDictionary? Packet_NTLMSSP_Auth { get; set; }
+        public OrderedDictionary? Packet_RPC_Data { get; set; }
+        public OrderedDictionary? Packet_SCM_Data { get; set; }
+        public bool SMB_Signing { get; set; }
+        public byte[]? SMB_Session_ID { get; set; }
+        public byte[] SMB_Session_Key_Length { get; set; }
+        public byte[] SMB_Negotiate_Flags { get; set; }
+        public byte[]? Session_Key { get; set; }
+    }
+
+    public class NTLMInfo {
+        public string? NativeOs { get; set; }
+        public string? NativeLanManager { get; set; }
+        public string? NbtDomainName { get; set; }
+        public string? NbtComputer { get; set; }
+        public string? DomainName { get; set; }
+        public short OsBuildNumber { get; set; }
+        public string? OsVersion { get; set; }
+        public string? DnsComputerName { get; set; }
+        public string? DnsDomainName { get; set; }
+        public string? DnsTreeName { get; set; }
+        public DateTime TimeStamp { get; set; }
+        public bool SmbSigning { get; set; }
+
+        public static NTLMInfo FromBytes(byte[] buf) {
+            var ntlminfo = new NTLMInfo();
+            var ntlmsspNegotiate = BitConverter.ToString(buf).Replace("-", "");
+            int off;
+            off = ntlmsspNegotiate.IndexOf("4E544C4D53535000", StringComparison.Ordinal) / 2;
+            var ntlmsspNegotiateLen = (ntlmsspNegotiate.Length - ntlmsspNegotiate.IndexOf("4E544C4D53535000", StringComparison.Ordinal)) / 2;
+            var ntlm = new byte[ntlmsspNegotiateLen];
+            Array.Copy(buf, off, ntlm, 0, ntlmsspNegotiateLen);
+
+            ntlmsspNegotiateLen = BitConverter.ToInt16(ntlm, 0xc);
+            off = BitConverter.ToInt16(ntlm, 0x10);
+            ntlminfo.OsBuildNumber = BitConverter.ToInt16(ntlm, off - 6);
+            ntlminfo.OsVersion = $@"{ntlm[off - 8]}.{ntlm[off - 7]}";
+
+            off += ntlmsspNegotiateLen;
+            int type = BitConverter.ToInt16(ntlm, off);
+
+            while (type != 0) {
+                off += 2;
+                ntlmsspNegotiateLen = BitConverter.ToInt16(ntlm, off);
+                off += 2;
+                switch (type) {
+                    case 1:
+                        ntlminfo.NbtComputer = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
+                        break;
+                    case 2:
+                        ntlminfo.NbtDomainName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
+                        break;
+                    case 3:
+                        ntlminfo.DnsComputerName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
+                        break;
+                    case 4:
+                        ntlminfo.DnsDomainName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
+                        break;
+                    case 5:
+                        ntlminfo.DnsTreeName = Encoding.Unicode.GetString(ntlm, off, ntlmsspNegotiateLen);
+                        break;
+                    case 7:
+                        ntlminfo.TimeStamp = DateTime.FromFileTime(BitConverter.ToInt64(ntlm, off));
+                        break;
+                }
+
+                off += ntlmsspNegotiateLen;
+                type = BitConverter.ToInt16(ntlm, off);
+            }
+
+            return ntlminfo;
+        }
+    }
+
+    public class SmbScanner {
+        public async Task<SmbScanResult> Scan(string host, int port, int timeoutMs = 10000) {
+            var result = new SmbScanResult(host) {
+                Success = false,
+                SmbVersion = SmbVersion.Unknown
+            };
+
+            TcpClient? smbClient = null;
+
+            try {
+                smbClient = await ConnectAsync(host, port, timeoutMs);
+
+                if (!smbClient.Connected) {
+                    result.ErrorMessage = "SMBInfo can't connect!";
+                    return result;
+                }
+
+                var smbClientStream = smbClient.GetStream();
+
+                using var operationCts = new System.Threading.CancellationTokenSource(timeoutMs);
+
+                if (port == 139) {
+                    await SendStreamAsync(smbClientStream, GetNtbiosTCPData(), operationCts.Token);
+                }
+
+                byte[] smbClientReceive;
+                try {
+                    // Try SMBv1 first
+                    smbClientReceive =
+                        await SendStreamAsync(smbClientStream, GetNegotiateSMBv1Data(), operationCts.Token);
+
+                    var singingEnabled = BitConverter.ToString(smbClientReceive).Replace("-", "").Substring(78, 2) ==
+                                         "0F";
+
+                    smbClientReceive = await SendStreamAsync(smbClientStream, GetNTLMSSPNegotiatev1Data(),
+                        operationCts.Token);
+
+                    int len = BitConverter.ToInt16(smbClientReceive, 43);
+                    string[]? ss = null;
+
+                    if (Encoding.Unicode.GetString(smbClientReceive, len + 47, smbClientReceive.Length - len - 47)
+                        .Split('\0')[0].ToLower().Contains("windows")) {
+                        ss = Encoding.Unicode.GetString(smbClientReceive, len + 47, smbClientReceive.Length - len - 47)
+                            .Split('\0');
+                    } else {
+                        ss = Encoding.Unicode.GetString(smbClientReceive, len + 48, smbClientReceive.Length - len - 48)
+                            .Split('\0');
+                    }
+
+                    if (ss.Length >= 2) {
+                        result.Info = NTLMInfo.FromBytes(smbClientReceive);
+                        result.Info.NativeOs = ss[0];
+                        result.Info.NativeLanManager = ss[1];
+                        result.Info.SmbSigning = singingEnabled;
+                    }
+
+                    result.SmbVersion = SmbVersion.SMBv1;
+                    result.Success = true;
+                } catch {
+                    // If SMBv1 fails, try SMBv2 with a new connection
+                    if (smbClient != null) {
+                        smbClient.Close();
+                    }
+
+                    smbClient = await ConnectAsync(host, port, 10000);
+                    smbClientStream = smbClient.GetStream();
+
+                    smbClientReceive =
+                        await SendStreamAsync(smbClientStream, GetNegotiateSMBv2Data1(), operationCts.Token);
+                    if (BitConverter.ToString([
+                            smbClientReceive[4], smbClientReceive[5], smbClientReceive[6], smbClientReceive[7]
+                        ]).ToLower() == "ff-53-4d-42") {
+                        result.ErrorMessage = "Could not connect with SMBv2";
+                        return result;
+                    }
+
+                    var signingEnabled = BitConverter.ToString(new byte[] { smbClientReceive[70] }) == "03";
+                    var smbPackets = new SMBPacket(signingEnabled);
+
+
+                    await SendStreamAsync(smbClientStream, GetNegotiateSMBv2Data2(), operationCts.Token);
+                    smbClientReceive = await SendStreamAsync(smbClientStream, GetNTLMSSPNegotiatev2Data(smbPackets),
+                        operationCts.Token);
+
+                    result.Info = NTLMInfo.FromBytes(smbClientReceive);
+                    result.Info.SmbSigning = smbPackets.SMB_Signing;
+
+                    result.SmbVersion = SmbVersion.SMBv2;
+                    result.Success = true;
+                }
+            } catch (Exception ex) {
+                result.ErrorMessage = ex.Message;
+            } finally {
+                smbClient?.Close();
+            }
+
+            return result;
+        }
+
+        private static async Task<TcpClient> ConnectAsync(string host, int port, int timeoutMs) {
+            using var connectCts = new System.Threading.CancellationTokenSource(timeoutMs + 100);
+            var client = new TcpClient();
+
+            client.Client.SendTimeout = timeoutMs;
+            client.Client.ReceiveTimeout = timeoutMs;
+
+            try {
+                var connectTask = client.ConnectAsync(host, port);
+                if (await Task.WhenAny(connectTask, Task.Delay(timeoutMs, connectCts.Token)) != connectTask) {
+                    client.Close();
+                    throw new TimeoutException($"Connection to {host}:{port} timed out after {timeoutMs}ms");
+                }
+
+                await connectTask;
+                return client;
+            } catch (Exception ex) when (ex is SocketException || ex is TimeoutException) {
+                client.Close();
+                throw new TimeoutException($"Connection to {host}:{port} timed out after {timeoutMs}ms", ex);
+            } catch {
+                client.Close();
+                throw;
+            }
+        }
+
+        private static async Task<byte[]> SendStreamAsync(NetworkStream stream, byte[] BytesToSend,
+            System.Threading.CancellationToken cancellationToken) {
+            var bytesReceived = new byte[2048];
+            await stream.WriteAsync(BytesToSend, 0, BytesToSend.Length, cancellationToken);
+            await stream.FlushAsync(cancellationToken);
+            await stream.ReadAsync(bytesReceived, 0, bytesReceived.Length, cancellationToken);
+            return bytesReceived;
+        }
+
+        private static byte[] GetNtbiosTCPData() {
+            byte[] NetbiosTCPData = {
+                0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46, 0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45, 0x46,
+                0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46, 0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
+                0x41, 0x43, 0x41, 0x00, 0x20, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41,
+                0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
+                0x41, 0x41, 0x41, 0x00
+            };
+            return NetbiosTCPData;
+        }
+
+        private static byte[] GetNegotiateSMBv1Data() {
+            byte[] NegotiateSMBv1Data = {
+                0x00, 0x00, 0x00, 0x85, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xC8,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4E, 0x45, 0x54, 0x57, 0x4F,
+                0x52, 0x4B, 0x20, 0x50, 0x52, 0x4F, 0x47, 0x52, 0x41, 0x4D, 0x20, 0x31, 0x2E, 0x30, 0x00, 0x02,
+                0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x31, 0x2E, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6E, 0x64, 0x6F,
+                0x77, 0x73, 0x20, 0x66, 0x6F, 0x72, 0x20, 0x57, 0x6F, 0x72, 0x6B, 0x67, 0x72, 0x6F, 0x75, 0x70,
+                0x73, 0x20, 0x33, 0x2E, 0x31, 0x61, 0x00, 0x02, 0x4C, 0x4D, 0x31, 0x2E, 0x32, 0x58, 0x30, 0x30,
+                0x32, 0x00, 0x02, 0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x32, 0x2E, 0x31, 0x00, 0x02, 0x4E, 0x54,
+                0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32, 0x00
+            };
+            return NegotiateSMBv1Data;
+        }
+
+        private static byte[] GetNTLMSSPNegotiatev1Data() {
+            byte[] NTLMSSPNegotiatev1Data = {
+                0x00, 0x00, 0x01, 0x0A, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
+                0x00, 0x00, 0x40, 0x00, 0x0C, 0xFF, 0x00, 0x0A, 0x01, 0x04, 0x41, 0x32, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x4A, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0xA0, 0xCF, 0x00, 0x60,
+                0x48, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x02, 0xA0, 0x3E, 0x30, 0x3C, 0xA0, 0x0E, 0x30,
+                0x0C, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0A, 0xA2, 0x2A, 0x04,
+                0x28, 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x82, 0x08,
+                0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x05, 0x02, 0xCE, 0x0E, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00,
+                0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
+                0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,
+                0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00,
+                0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00,
+                0x50, 0x00, 0x61, 0x00, 0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00,
+                0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00, 0x20, 0x00,
+                0x35, 0x00, 0x2E, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00
+            };
+            return NTLMSSPNegotiatev1Data;
+        }
+
+        private static byte[] GetNegotiateSMBv2Data1() {
+            byte[] NegotiateSMBData = {
+                0x00, 0x00, 0x00, 0x45, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00,
+                0x00, 0x00, 0x00, 0x18, 0x01, 0x48, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF,
+                0xAC, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x22, 0x00, 0x02,
+                0x4E, 0x54, 0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32,
+                0x00, 0x02, 0x53, 0x4D, 0x42, 0x20, 0x32, 0x2E, 0x30, 0x30,
+                0x32, 0x00, 0x02, 0x53, 0x4D, 0x42, 0x20, 0x32, 0x2E, 0x3F,
+                0x3F, 0x3F, 0x00
+            };
+            return NegotiateSMBData;
+        }
+
+        private static byte[] GetNegotiateSMBv2Data2() {
+            byte[] NegotiateSMB2Data = {
+                0x00, 0x00, 0x00, 0x68, 0xFE, 0x53, 0x4D, 0x42, 0x40, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x00,
+                0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x02, 0x02, 0x10, 0x02
+            };
+            return NegotiateSMB2Data;
+        }
+
+        private static byte[] GetNTLMSSPNegotiatev2Data(SMBPacket SMBPackets) {
+            byte[] NTLMSSPNegotiateData = {
+                0x00, 0x00, 0x00, 0x9A, 0xFE, 0x53, 0x4D, 0x42, 0x40, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00,
+                0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x58, 0x00, 0x42, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x60, 0x40, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05,
+                0x05, 0x02, 0xA0, 0x36, 0x30, 0x34, 0xA0, 0x0E, 0x30, 0x0C,
+                0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02,
+                0x02, 0x0A, 0xA2, 0x22, 0x04, 0x20, 0x4E, 0x54, 0x4C, 0x4D,
+                0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00,
+                SMBPackets.SMB_Negotiate_Flags[0], SMBPackets.SMB_Negotiate_Flags[1],
+                SMBPackets.SMB_Negotiate_Flags[2], SMBPackets.SMB_Negotiate_Flags[3],
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+            };
+            return NTLMSSPNegotiateData;
+        }
+    }
+}
+
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs b/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
index b9b582fb..7a849618 100644
--- a/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
+++ b/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
@@ -9,25 +9,21 @@
 using SharpHoundRPC.Shared;
 using SharpHoundRPC.Wrappers;
 
-namespace SharpHoundCommonLib.Processors
-{
-    public class UserRightsAssignmentProcessor
-    {
+namespace SharpHoundCommonLib.Processors {
+    public class UserRightsAssignmentProcessor {
         public delegate Task ComputerStatusDelegate(CSVComputerStatus status);
 
         private readonly ILogger _log;
         private readonly ILdapUtils _utils;
 
-        public UserRightsAssignmentProcessor(ILdapUtils  utils, ILogger log = null)
-        {
+        public UserRightsAssignmentProcessor(ILdapUtils utils, ILogger log = null) {
             _utils = utils;
             _log = log ?? Logging.LogProvider.CreateLogger("UserRightsAssignmentProcessor");
         }
 
         public event ComputerStatusDelegate ComputerStatusEvent;
 
-        public virtual SharpHoundRPC.Result<ILSAPolicy> OpenLSAPolicy(string computerName)
-        {
+        public virtual SharpHoundRPC.Result<ILSAPolicy> OpenLSAPolicy(string computerName) {
             var result = LSAPolicy.OpenPolicy(computerName);
             if (result.IsFailed) return SharpHoundRPC.Result<ILSAPolicy>.Fail(result.SError);
 
@@ -35,8 +31,7 @@ public virtual SharpHoundRPC.Result<ILSAPolicy> OpenLSAPolicy(string computerNam
         }
 
         public IAsyncEnumerable<UserRightsAssignmentAPIResult> GetUserRightsAssignments(ResolvedSearchResult result,
-            string[] desiredPrivileges = null)
-        {
+            string[] desiredPrivileges = null) {
             return GetUserRightsAssignments(result.DisplayName, result.ObjectId, result.Domain,
                 result.IsDomainController, desiredPrivileges);
         }
@@ -52,18 +47,17 @@ public IAsyncEnumerable<UserRightsAssignmentAPIResult> GetUserRightsAssignments(
         /// <param name="timeout"></param>
         /// <returns></returns>
         public async IAsyncEnumerable<UserRightsAssignmentAPIResult> GetUserRightsAssignments(string computerName,
-            string computerObjectId, string computerDomain, bool isDomainController, string[] desiredPrivileges = null, TimeSpan timeout = default)
-        {
+            string computerObjectId, string computerDomain, bool isDomainController, string[] desiredPrivileges = null,
+            TimeSpan timeout = default) {
             if (timeout == default) {
                 timeout = TimeSpan.FromMinutes(2);
             }
+
             var policyOpenResult = await Task.Run(() => OpenLSAPolicy(computerName)).TimeoutAfter(timeout);
-            if (!policyOpenResult.IsSuccess)
-            {
+            if (!policyOpenResult.IsSuccess) {
                 _log.LogDebug("LSAOpenPolicy failed on {ComputerName} with status {Status}", computerName,
                     policyOpenResult.Error);
-                await SendComputerStatus(new CSVComputerStatus
-                {
+                await SendComputerStatus(new CSVComputerStatus {
                     Task = "LSAOpenPolicy",
                     ComputerName = computerName,
                     Status = policyOpenResult.Error
@@ -75,15 +69,13 @@ await SendComputerStatus(new CSVComputerStatus
             desiredPrivileges ??= LSAPrivileges.DesiredPrivileges;
 
             SecurityIdentifier machineSid;
-            if (!Cache.GetMachineSid(computerObjectId, out var temp))
-            {
-                var getMachineSidResult = await Task.Run(() => server.GetLocalDomainInformation()).TimeoutAfter(timeout);
-                if (getMachineSidResult.IsFailed)
-                {
+            if (!Cache.GetMachineSid(computerObjectId, out var temp)) {
+                var getMachineSidResult =
+                    await Task.Run(() => server.GetLocalDomainInformation()).TimeoutAfter(timeout);
+                if (getMachineSidResult.IsFailed) {
                     _log.LogWarning("Failed to get machine sid for {Server}: {Status}. Abandoning URA collection",
                         computerName, getMachineSidResult.SError);
-                    await SendComputerStatus(new CSVComputerStatus
-                    {
+                    await SendComputerStatus(new CSVComputerStatus {
                         ComputerName = computerName,
                         Status = getMachineSidResult.SError,
                         Task = "LSAGetMachineSID"
@@ -93,30 +85,26 @@ await SendComputerStatus(new CSVComputerStatus
 
                 machineSid = new SecurityIdentifier(getMachineSidResult.Value.Sid);
                 Cache.AddMachineSid(computerObjectId, getMachineSidResult.Value.Sid);
-            }
-            else
-            {
+            } else {
                 machineSid = new SecurityIdentifier(temp);
             }
 
-            foreach (var privilege in desiredPrivileges)
-            {
-                _log.LogTrace("Getting principals for privilege {Priv} on computer {ComputerName}", privilege, computerName);
-                var ret = new UserRightsAssignmentAPIResult
-                {
+            foreach (var privilege in desiredPrivileges) {
+                _log.LogTrace("Getting principals for privilege {Priv} on computer {ComputerName}", privilege,
+                    computerName);
+                var ret = new UserRightsAssignmentAPIResult {
                     Collected = false,
                     Privilege = privilege
                 };
 
                 //Ask for all principals with the specified privilege. 
-                var enumerateAccountsResult = await Task.Run(() => server.GetResolvedPrincipalsWithPrivilege(privilege)).TimeoutAfter(timeout);
-                if (enumerateAccountsResult.IsFailed)
-                {
+                var enumerateAccountsResult = await Task.Run(() => server.GetResolvedPrincipalsWithPrivilege(privilege))
+                    .TimeoutAfter(timeout);
+                if (enumerateAccountsResult.IsFailed) {
                     _log.LogDebug(
                         "LSAEnumerateAccountsWithUserRight failed on {ComputerName} with status {Status} for privilege {Privilege}",
                         computerName, policyOpenResult.Error, privilege);
-                    await SendComputerStatus(new CSVComputerStatus
-                    {
+                    await SendComputerStatus(new CSVComputerStatus {
                         ComputerName = computerName,
                         Status = enumerateAccountsResult.SError,
                         Task = "LSAEnumerateAccountsWithUserRight"
@@ -127,11 +115,11 @@ await SendComputerStatus(new CSVComputerStatus
                     if (enumerateAccountsResult.IsTimeout) {
                         yield break;
                     }
+
                     continue;
                 }
 
-                await SendComputerStatus(new CSVComputerStatus
-                {
+                await SendComputerStatus(new CSVComputerStatus {
                     ComputerName = computerName,
                     Status = CSVComputerStatus.StatusSuccess,
                     Task = "LSAEnumerateAccountsWithUserRight"
@@ -140,16 +128,16 @@ await SendComputerStatus(new CSVComputerStatus
                 var resolved = new List<TypedPrincipal>();
                 var names = new List<NamedPrincipal>();
 
-                foreach (var value in enumerateAccountsResult.Value)
-                {
+                foreach (var value in enumerateAccountsResult.Value) {
                     var (sid, name, use, _) = value;
-                    _log.LogTrace("Got principal {Name} with sid {SID} and use {Use} for privilege {Priv} on computer {ComputerName}", name, sid.Value, use, privilege, computerName);
+                    _log.LogTrace(
+                        "Got principal {Name} with sid {SID} and use {Use} for privilege {Priv} on computer {ComputerName}",
+                        name, sid.Value, use, privilege, computerName);
                     //Check if our sid is filtered
                     if (Helpers.IsSidFiltered(sid.Value))
                         continue;
 
-                    if (isDomainController)
-                    {
+                    if (isDomainController) {
                         var result = await ResolveDomainControllerPrincipal(sid.Value, computerDomain);
                         if (result != null)
                             resolved.Add(result);
@@ -157,19 +145,20 @@ await SendComputerStatus(new CSVComputerStatus
                     }
 
                     //If we get a local well known principal, we need to convert it using the computer's domain sid
-                    if (await _utils.ConvertLocalWellKnownPrincipal(sid, computerObjectId, computerDomain) is (true, var principal))
-                    {
-                        _log.LogTrace("Got Well Known Principal {SID} on computer {Computer} for privilege {Privilege} and type {Type}", principal.ObjectIdentifier, computerName, privilege, principal.ObjectType);
+                    if (await _utils.ConvertLocalWellKnownPrincipal(sid, computerObjectId, computerDomain) is
+                        (true, var principal)) {
+                        _log.LogTrace(
+                            "Got Well Known Principal {SID} on computer {Computer} for privilege {Privilege} and type {Type}",
+                            principal.ObjectIdentifier, computerName, privilege, principal.ObjectType);
                         resolved.Add(principal);
                         continue;
                     }
 
                     //If the security identifier starts with the machine sid, we need to resolve it as a local account
-                    if (sid.IsEqualDomainSid(machineSid))
-                    {
-                        _log.LogTrace("Got local account {sid} on computer {Computer} for privilege {Privilege}", sid.Value, computerName, privilege);
-                        var objectType = use switch
-                        {
+                    if (sid.IsEqualDomainSid(machineSid)) {
+                        _log.LogTrace("Got local account {sid} on computer {Computer} for privilege {Privilege}",
+                            sid.Value, computerName, privilege);
+                        var objectType = use switch {
                             SharedEnums.SidNameUse.User => Label.LocalUser,
                             SharedEnums.SidNameUse.Group => Label.LocalGroup,
                             SharedEnums.SidNameUse.Alias => Label.LocalGroup,
@@ -184,14 +173,12 @@ await SendComputerStatus(new CSVComputerStatus
                         var groupRid = sid.Rid();
                         var newSid = $"{computerObjectId}-{groupRid}";
                         if (name != null)
-                            names.Add(new NamedPrincipal
-                            {
+                            names.Add(new NamedPrincipal {
                                 ObjectId = newSid,
                                 PrincipalName = name
                             });
 
-                        resolved.Add(new TypedPrincipal
-                        {
+                        resolved.Add(new TypedPrincipal {
                             ObjectIdentifier = newSid,
                             ObjectType = objectType
                         });
@@ -210,19 +197,17 @@ await SendComputerStatus(new CSVComputerStatus
             }
         }
 
-        private async Task<TypedPrincipal> ResolveDomainControllerPrincipal(string sid, string computerDomain)
-        {
+        private async Task<TypedPrincipal> ResolveDomainControllerPrincipal(string sid, string computerDomain) {
             //If the server is a domain controller and we have a well known group, use the domain value
             if (await _utils.GetWellKnownPrincipal(sid, computerDomain) is (true, var wellKnown))
                 return wellKnown;
             //Otherwise, do a domain lookup
-            var domainPrinciple =  await _utils.ResolveIDAndType(sid, computerDomain);
+            var domainPrinciple = await _utils.ResolveIDAndType(sid, computerDomain);
             return domainPrinciple.Principal;
         }
 
 
-        private async Task SendComputerStatus(CSVComputerStatus status)
-        {
+        private async Task SendComputerStatus(CSVComputerStatus status) {
             if (ComputerStatusEvent is not null) await ComputerStatusEvent.Invoke(status);
         }
     }
diff --git a/src/CommonLib/Processors/WebClientServiceProcessor.cs b/src/CommonLib/Processors/WebClientServiceProcessor.cs
new file mode 100644
index 00000000..d0688f21
--- /dev/null
+++ b/src/CommonLib/Processors/WebClientServiceProcessor.cs
@@ -0,0 +1,88 @@
+using Microsoft.Extensions.Logging;
+using Microsoft.Win32.SafeHandles;
+using SharpHoundCommonLib.OutputTypes;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Processors {
+    public class WebClientServiceProcessor(ILogger log = null) {
+        private readonly ILogger _log = log ?? Logging.LogProvider.CreateLogger("WebClientServiceProcessor");
+
+        // Define constants
+        public const uint MAXIMUM_ALLOWED = 0x02000000;
+        public const uint FILE_SHARE_READ = 0x00000001;
+        public const uint FILE_SHARE_WRITE = 0x00000002;
+        public const uint FILE_SHARE_DELETE = 0x00000004;
+        public const uint OPEN_EXISTING = 3;
+
+        // Error constants
+        public const uint ERROR_FILE_NOT_FOUND = 0x80070002;
+        public const uint ERROR_ACCESS_DENIED = 0x80070005;
+        public const uint ERROR_BAD_NETPATH = 0x80070035;
+        public const uint ERROR_NETNAME_DELETED = 0x80070040;
+        public const uint ERROR_NETWORK_ACCESS_DENIED = 0x80070041;
+        public const uint ERROR_LOGON_FAILURE = 0x8007052E;
+
+        [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
+        public static extern SafeFileHandle CreateFile(
+            string lpFileName,
+            uint dwDesiredAccess,
+            uint dwShareMode,
+            IntPtr lpSecurityAttributes,
+            uint dwCreationDisposition,
+            uint dwFlagsAndAttributes,
+            IntPtr hTemplateFile);
+
+        public static bool TestPathExists(string path) {
+            //The CreateFile API is used here because File.Create throws exceptions for pipes. Using these lower level APIs is easier to deal with
+            using var handle = CreateFile(
+                path,
+                MAXIMUM_ALLOWED, // Request maximum allowed access
+                FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, // Allow all share modes
+                IntPtr.Zero,
+                OPEN_EXISTING,
+                0,
+                IntPtr.Zero
+            );
+
+            var result = Marshal.GetHRForLastWin32Error();
+
+            if (handle.IsInvalid) {
+                switch ((uint)result) {
+                    case ERROR_ACCESS_DENIED:
+                        return true;
+                    case ERROR_BAD_NETPATH:
+                    case ERROR_FILE_NOT_FOUND:
+                    case ERROR_NETNAME_DELETED:
+                    case ERROR_NETWORK_ACCESS_DENIED:
+                        return false;
+                    default:
+                        Marshal.ThrowExceptionForHR(result);
+                        break;
+                }
+            }
+
+            return true;
+        }
+
+        public async Task<ApiResult<bool>> IsWebClientRunning(string computerName) {
+            // When the service is running, this named pipe is present
+            var pipePath = @$"\\{computerName}\pipe\DAV RPC SERVICE";
+
+            return await Task.Run(() => {
+                try {
+                    var exists = TestPathExists(pipePath);
+
+                    return ApiResult<bool>.CreateSuccess(exists);
+                } catch (Exception ex) {
+                    return ApiResult<bool>.CreateError(ex.ToString());
+                }
+            });
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/CommonLib/Properties/launchSettings.json b/src/CommonLib/Properties/launchSettings.json
new file mode 100644
index 00000000..59fd23c6
--- /dev/null
+++ b/src/CommonLib/Properties/launchSettings.json
@@ -0,0 +1,8 @@
+{
+  "profiles": {
+    "SharpHoundCommonLib": {
+      "commandName": "Project",
+      "commandLineArgs": "-C CertServices"
+    }
+  }
+}
\ No newline at end of file
diff --git a/src/CommonLib/SharpHoundCommonLib.csproj b/src/CommonLib/SharpHoundCommonLib.csproj
index 96588f20..864b05de 100644
--- a/src/CommonLib/SharpHoundCommonLib.csproj
+++ b/src/CommonLib/SharpHoundCommonLib.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
-        <TargetFramework>net462</TargetFramework>
+        <TargetFramework>net472</TargetFramework>
         <OutputType>library</OutputType>
         <PackageId>SharpHoundCommon</PackageId>
         <LangVersion>default</LangVersion>
@@ -26,6 +26,7 @@
         <Reference Include="System.DirectoryServices" />
         <Reference Include="System.DirectoryServices.AccountManagement" />
         <Reference Include="System.DirectoryServices.Protocols" />
+        <Reference Include="System.Net.Http" />
     </ItemGroup>
     <ItemGroup>
         <Folder Include="Properties" />
@@ -35,6 +36,7 @@
     </ItemGroup>
     <PropertyGroup>
         <TargetsForTfmSpecificBuildOutput>$(TargetsForTfmSpecificBuildOutput);CopyProjectReferencesToPackage</TargetsForTfmSpecificBuildOutput>
+        <AllowUnsafeBlocks>True</AllowUnsafeBlocks>
     </PropertyGroup>
     <Target Name="CopyProjectReferencesToPackage" DependsOnTargets="BuildOnlySettings;ResolveReferences">
         <ItemGroup>
diff --git a/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs b/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
new file mode 100644
index 00000000..396ad993
--- /dev/null
+++ b/src/CommonLib/ThirdParty/PSOpenAD/Authentication.cs
@@ -0,0 +1,357 @@
+#nullable enable
+using System;
+using System.Buffers;
+using System.Runtime.InteropServices;
+
+namespace SharpHoundCommonLib.ThirdParty.PSOpenAD;
+
+public enum AuthenticationMethod {
+    /// <summary>Selects the best auth mechanism available.</summary>
+    Default,
+
+    /// <summary>No authentication.</summary>
+    Anonymous,
+
+    /// <summary>
+    /// Simple auth with a plaintext username and password, should only be used with LDAPS or StartTLS.
+    /// </summary>
+    Simple,
+
+    /// <summary>GSSAPI/SSPI Negotiate (SASL GSS-SPNEGO) authentication.</summary>
+    Negotiate,
+
+    /// <summary>GSSAPI/SSPI Kerberos (SASL GSSAPI) authentication</summary>
+    Kerberos,
+
+    /// <summary>Authentication using a client provided X.509 Certificate for LDAP or StartTLS.</summary>
+    Certificate,
+
+    // <summary>Authentication using NTLM</summary>
+    NTLM
+}
+
+/// <summary>Details on an authentication mechanism for the local client.</summary>
+public sealed class AuthenticationProvider {
+    /// <summary>The authentication mechanism this represents.</summary>
+    public AuthenticationMethod Method { get; }
+
+    /// <summary>The SASL mechanism identifier for this provider.</summary>
+    public string SaslId { get; }
+
+    /// <summary>Whether the client can use this provider.</summary>
+    public bool Available { get; }
+
+    /// <summary>Whether this authentication mechanism can sign/encrypt data over a non-TLS connection.</summary>
+    public bool CanSign { get; }
+
+    /// <summary>Further details on why the mechanism is not available.</summary>
+    public string Details { get; }
+
+    public AuthenticationProvider(AuthenticationMethod method, string saslId, bool available, bool canSign,
+        string details) {
+        Method = method;
+        SaslId = saslId;
+        Available = available;
+        CanSign = canSign;
+        Details = details;
+    }
+}
+
+internal enum GssapiProvider {
+    None,
+    MIT,
+    Heimdal,
+    GSSFramework,
+    SSPI,
+}
+
+[Flags]
+internal enum SASLSecurityFlags : byte {
+    None = 0,
+    NoSecurity = 1,
+    Integrity = 2,
+    Confidentiality = 4,
+}
+
+public class ChannelBindings {
+    public int InitiatorAddrType { get; set; }
+    public byte[]? InitiatorAddr { get; set; }
+    public int AcceptorAddrType { get; set; }
+    public byte[]? AcceptorAddr { get; set; }
+    public byte[]? ApplicationData { get; set; }
+}
+
+internal abstract class SecurityContext : IDisposable {
+    public bool Complete { get; internal set; }
+    public bool IntegrityAvailable { get; internal set; }
+    public bool ConfidentialityAvailable { get; internal set; }
+
+    public abstract byte[] Step(byte[]? inputToken = null);
+    public abstract byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt);
+    public abstract byte[] Unwrap(ReadOnlySpan<byte> data);
+
+    public abstract uint MaxWrapSize(uint outputSize, bool confReq);
+
+    public abstract void Dispose();
+    ~SecurityContext() => Dispose();
+}
+
+internal class ExternalContext : SecurityContext {
+    private bool _called;
+
+    public override byte[] Step(byte[]? inputToken = null) {
+        // No actual tokens are exchanged but we need to return at least 1 empty array and set it to be completed
+        // on the next call
+        Complete = _called;
+        _called = true; // Next call with set Complete = true
+
+        return Array.Empty<byte>();
+    }
+
+    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt) => Array.Empty<byte>();
+    public override byte[] Unwrap(ReadOnlySpan<byte> data) => Array.Empty<byte>();
+    public override uint MaxWrapSize(uint outputSize, bool confReq) => 0;
+
+    public override void Dispose() {
+    }
+}
+
+internal class SspiContext : SecurityContext {
+    private readonly SafeSspiCredentialHandle _credential;
+    private readonly byte[]? _bindingData;
+    private readonly string _targetSpn;
+    private readonly InitiatorContextRequestFlags _flags = InitiatorContextRequestFlags.ISC_REQ_MUTUAL_AUTH;
+    private SafeSspiContextHandle? _context;
+    private uint _blockSize = 0;
+    private uint _trailerSize = 0;
+    private uint _seqNo = 0;
+
+    public SspiContext(string? username, string? password, AuthenticationMethod method, string target,
+        ChannelBindings? channelBindings, bool integrity, bool confidentiality) {
+        _bindingData = CreateChannelBindings(channelBindings);
+        _targetSpn = target;
+
+        var package = Enum.GetName(typeof(AuthenticationMethod), method);
+        WinNTAuthIdentity? identity = null;
+        if (!string.IsNullOrEmpty(username) || !string.IsNullOrEmpty(password)) {
+            string? domain = null;
+            if (username?.Contains("\\") == true) {
+                var stringSplit = username.Split(['\\'], 2);
+                domain = stringSplit[0];
+                username = stringSplit[1];
+            }
+
+            identity = new WinNTAuthIdentity(username, domain, password);
+        }
+
+        _credential = SSPI.AcquireCredentialsHandle(null, package, CredentialUse.SECPKG_CRED_OUTBOUND,
+            identity).Creds;
+
+        const InitiatorContextRequestFlags integrityFlags = InitiatorContextRequestFlags.ISC_REQ_INTEGRITY |
+                                                            InitiatorContextRequestFlags.ISC_REQ_SEQUENCE_DETECT;
+
+        if (integrity)
+            _flags |= integrityFlags;
+
+        if (confidentiality)
+            _flags |= integrityFlags | InitiatorContextRequestFlags.ISC_REQ_CONFIDENTIALITY;
+
+        if (method == AuthenticationMethod.Kerberos) {
+            // Kerberos uses a special SASL wrapping mechanism and always requires integrity
+            _flags |= integrityFlags;
+        } else if (!integrity && !confidentiality) {
+            // GSS-SPNEGO uses the context flags to determine the protection applied and Kerberos always sets
+            // INTEG by default. By setting this flag we unset INTEG allowing it to be used without any protection.
+            _flags |= InitiatorContextRequestFlags.ISC_REQ_NO_INTEGRITY;
+        }
+    }
+
+    public override byte[] Step(byte[]? inputToken = null) {
+        var bufferCount = 0;
+        if (inputToken != null)
+            bufferCount++;
+
+        if (_bindingData != null)
+            bufferCount++;
+
+        unsafe {
+            fixed (byte* input = inputToken, cbBuffer = _bindingData) {
+                Span<Helpers.SecBuffer> inputBuffers = stackalloc Helpers.SecBuffer[bufferCount];
+                var idx = 0;
+
+                if (inputToken != null) {
+                    inputBuffers[idx].cbBuffer = (uint)inputToken.Length;
+                    inputBuffers[idx].BufferType = (uint)SecBufferType.SECBUFFER_TOKEN;
+                    inputBuffers[idx].pvBuffer = (IntPtr)input;
+                    idx++;
+                }
+
+                if (_bindingData != null) {
+                    inputBuffers[idx].cbBuffer = (uint)_bindingData.Length;
+                    inputBuffers[idx].BufferType = (uint)SecBufferType.SECBUFFER_CHANNEL_BINDINGS;
+                    inputBuffers[idx].pvBuffer = (IntPtr)cbBuffer;
+                }
+
+                var context = SSPI.InitializeSecurityContext(_credential, _context, _targetSpn, _flags,
+                    TargetDataRep.SECURITY_NATIVE_DREP, inputBuffers, [SecBufferType.SECBUFFER_TOKEN]);
+                _context = context.Context;
+
+                if (!context.MoreNeeded) {
+                    Complete = true;
+                    IntegrityAvailable =
+                        (context.Flags & InitiatorContextReturnFlags.ISC_RET_INTEGRITY) != 0;
+                    ConfidentialityAvailable =
+                        (context.Flags & InitiatorContextReturnFlags.ISC_RET_CONFIDENTIALITY) != 0;
+
+                    Span<Helpers.SecPkgContext_Sizes> sizes = stackalloc Helpers.SecPkgContext_Sizes[1];
+                    fixed (Helpers.SecPkgContext_Sizes* sizesPtr = sizes) {
+                        SSPI.QueryContextAttributes(_context, SecPkgAttribute.SECPKG_ATTR_SIZES,
+                            (IntPtr)sizesPtr);
+
+                        _trailerSize = sizes[0].cbSecurityTrailer;
+                        _blockSize = sizes[0].cbBlockSize;
+                    }
+                }
+
+                return context.OutputBuffers.Length > 0 ? context.OutputBuffers[0] : Array.Empty<byte>();
+            }
+        }
+    }
+
+    public override byte[] Wrap(ReadOnlySpan<byte> data, bool encrypt) {
+        if (_context == null || !Complete)
+            throw new InvalidOperationException("Cannot wrap without a completed context");
+
+        unsafe {
+            var shared = ArrayPool<byte>.Shared;
+            var token = shared.Rent((int)_trailerSize);
+            var padding = shared.Rent((int)_blockSize);
+
+            try {
+                fixed (byte* tokenPtr = token, dataPtr = data, paddingPtr = padding) {
+                    Span<Helpers.SecBuffer> buffers = stackalloc Helpers.SecBuffer[3];
+                    buffers[0].BufferType = (uint)SecBufferType.SECBUFFER_TOKEN;
+                    buffers[0].cbBuffer = _trailerSize;
+                    buffers[0].pvBuffer = (IntPtr)tokenPtr;
+
+                    buffers[1].BufferType = (uint)SecBufferType.SECBUFFER_DATA;
+                    buffers[1].cbBuffer = (uint)data.Length;
+                    buffers[1].pvBuffer = (IntPtr)dataPtr;
+
+                    buffers[2].BufferType = (uint)SecBufferType.SECBUFFER_PADDING;
+                    buffers[2].cbBuffer = _blockSize;
+                    buffers[2].pvBuffer = (IntPtr)paddingPtr;
+
+                    var qop = encrypt ? 0 : 0x80000001; // SECQOP_WRAP_NO_ENCRYPT
+                    SSPI.EncryptMessage(_context, qop, buffers, NextSeqNo());
+
+                    var wrapped = new byte[buffers[0].cbBuffer + buffers[1].cbBuffer + buffers[2].cbBuffer];
+                    var offset = 0;
+                    if (buffers[0].cbBuffer > 0) {
+                        Buffer.BlockCopy(token, 0, wrapped, offset, (int)buffers[0].cbBuffer);
+                        offset += (int)buffers[0].cbBuffer;
+                    }
+
+                    Marshal.Copy((IntPtr)dataPtr, wrapped, offset, (int)buffers[1].cbBuffer);
+                    offset += (int)buffers[1].cbBuffer;
+
+                    if (buffers[2].cbBuffer > 0) {
+                        Buffer.BlockCopy(padding, 0, wrapped, offset, (int)buffers[2].cbBuffer);
+                        offset += (int)buffers[2].cbBuffer;
+                    }
+
+                    return wrapped;
+                }
+            } finally {
+                shared.Return(token);
+                shared.Return(padding);
+            }
+        }
+    }
+
+    public override byte[] Unwrap(ReadOnlySpan<byte> data) {
+        if (_context == null || !Complete)
+            throw new InvalidOperationException("Cannot wrap without a completed context");
+
+        unsafe {
+            fixed (byte* dataPtr = data) {
+                Span<Helpers.SecBuffer> buffers = stackalloc Helpers.SecBuffer[2];
+                buffers[0].BufferType = (uint)SecBufferType.SECBUFFER_STREAM;
+                buffers[0].cbBuffer = (uint)data.Length;
+                buffers[0].pvBuffer = (IntPtr)dataPtr;
+
+                buffers[1].BufferType = (uint)SecBufferType.SECBUFFER_DATA;
+                buffers[1].cbBuffer = 0;
+                buffers[1].pvBuffer = IntPtr.Zero;
+
+                SSPI.DecryptMessage(_context, buffers, NextSeqNo());
+
+                var unwrapped = new byte[buffers[1].cbBuffer];
+                Marshal.Copy(buffers[1].pvBuffer, unwrapped, 0, unwrapped.Length);
+
+                return unwrapped;
+            }
+        }
+    }
+
+    public override uint MaxWrapSize(uint outputSize, bool confReq) {
+        throw new NotImplementedException(); // Not used in SSPI.
+    }
+
+    private byte[]? CreateChannelBindings(ChannelBindings? bindings) {
+        if (bindings == null)
+            return null;
+
+        var structOffset = Marshal.SizeOf<Helpers.SEC_CHANNEL_BINDINGS>();
+        var binaryLength = bindings.InitiatorAddr?.Length ?? 0 + bindings.AcceptorAddr?.Length ?? 0 +
+            bindings.ApplicationData?.Length ?? 0;
+        var bindingData = new byte[structOffset + binaryLength];
+        unsafe {
+            fixed (byte* bindingPtr = bindingData) {
+                var bindingStruct = (Helpers.SEC_CHANNEL_BINDINGS*)bindingPtr;
+
+                bindingStruct->dwInitiatorAddrType = (uint)bindings.InitiatorAddrType;
+                if (bindings.InitiatorAddr != null) {
+                    bindingStruct->cbInitiatorLength = (uint)bindings.InitiatorAddr.Length;
+                    bindingStruct->dwInitiatorOffset = (uint)structOffset;
+                    Buffer.BlockCopy(bindings.InitiatorAddr, 0, bindingData, structOffset,
+                        bindings.InitiatorAddr.Length);
+
+                    structOffset += bindings.InitiatorAddr.Length;
+                }
+
+                bindingStruct->dwAcceptorAddrType = (uint)bindings.AcceptorAddrType;
+                if (bindings.AcceptorAddr != null) {
+                    bindingStruct->cbAcceptorLength = (uint)bindings.AcceptorAddr.Length;
+                    bindingStruct->dwAcceptorOffset = (uint)structOffset;
+                    Buffer.BlockCopy(bindings.AcceptorAddr, 0, bindingData, structOffset,
+                        bindings.AcceptorAddr.Length);
+
+                    structOffset += bindings.AcceptorAddr.Length;
+                }
+
+                if (bindings.ApplicationData != null) {
+                    bindingStruct->cbApplicationDataLength = (uint)bindings.ApplicationData.Length;
+                    bindingStruct->dwApplicationDataOffset = (uint)structOffset;
+                    Buffer.BlockCopy(bindings.ApplicationData, 0, bindingData, structOffset,
+                        bindings.ApplicationData.Length);
+                }
+            }
+        }
+
+        return bindingData;
+    }
+
+    private uint NextSeqNo() {
+        var seqNo = _seqNo;
+        _seqNo++;
+
+        return seqNo;
+    }
+
+    public override void Dispose() {
+        _credential.Dispose();
+        _context?.Dispose();
+    }
+}
+#nullable disable
\ No newline at end of file
diff --git a/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs b/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs
new file mode 100644
index 00000000..d7cce233
--- /dev/null
+++ b/src/CommonLib/ThirdParty/PSOpenAD/SSPI.cs
@@ -0,0 +1,620 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.Authentication;
+
+namespace SharpHoundCommonLib.ThirdParty.PSOpenAD;
+
+internal static class Helpers {
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SEC_CHANNEL_BINDINGS {
+        public UInt32 dwInitiatorAddrType;
+        public UInt32 cbInitiatorLength;
+        public UInt32 dwInitiatorOffset;
+        public UInt32 dwAcceptorAddrType;
+        public UInt32 cbAcceptorLength;
+        public UInt32 dwAcceptorOffset;
+        public UInt32 cbApplicationDataLength;
+        public UInt32 dwApplicationDataOffset;
+    }
+
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    public struct SEC_WINNT_AUTH_IDENTITY_W {
+        public unsafe char* User;
+        public UInt32 UserLength;
+        public unsafe char* Domain;
+        public UInt32 DomainLength;
+        public unsafe char* Password;
+        public UInt32 PasswordLength;
+        public WinNTAuthIdentityFlags Flags;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SECURITY_INTEGER {
+        public UInt32 LowPart;
+        public Int32 HighPart;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecBufferDesc {
+        public UInt32 ulVersion;
+        public UInt32 cBuffers;
+        public IntPtr pBuffers;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecBuffer {
+        public UInt32 cbBuffer;
+        public UInt32 BufferType;
+        public IntPtr pvBuffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecHandle {
+        public UIntPtr dwLower;
+        public UIntPtr dwUpper;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SecPkgContext_Sizes {
+        public UInt32 cbMaxToken;
+        public UInt32 cbMaxSignature;
+        public UInt32 cbBlockSize;
+        public UInt32 cbSecurityTrailer;
+    }
+}
+
+/// <summary>Result of <c>AcquireCredentialsHandle</c>.</summary>
+internal class SspiCredential {
+    /// <summary>The handle to the SSPI credential.</summary>
+    public SafeSspiCredentialHandle Creds { get; }
+
+    /// <summary>The number of ticks (100s of nanoseconds) since 1601-01-01 until the credential expires.</summary>
+    public ulong Expiry { get; }
+
+    public SspiCredential(SafeSspiCredentialHandle creds, ulong expiry) {
+        Creds = creds;
+        Expiry = expiry;
+    }
+}
+
+/// <summary>Result of <c>InitializeSecurityContext</c>.</summary>
+internal class SspiSecContext {
+    /// <summary>The handle to the SSPI security context.</summary>
+    public SafeSspiContextHandle Context { get; }
+
+    /// <summary>The return buffer values from the SSPI call.</summary>
+    public byte[][] OutputBuffers { get; }
+
+    /// <summary>The number of ticks (100s of nanoseconds) since 1601-01-01 until the context expires.</summary>
+    public ulong Expiry { get; }
+
+    /// <summary>The attributes used to describe the functionality available on the context.</summary>
+    public InitiatorContextReturnFlags Flags { get; }
+
+    /// <summary>Whether more data is needed from the acceptor to complete the context.</summary>
+    public bool MoreNeeded { get; }
+
+    public SspiSecContext(SafeSspiContextHandle context, byte[][] outputBuffers, ulong expiry,
+        InitiatorContextReturnFlags flags, bool moreNeeded) {
+        Context = context;
+        OutputBuffers = outputBuffers;
+        Expiry = expiry;
+        Flags = flags;
+        MoreNeeded = moreNeeded;
+    }
+}
+
+internal static class SSPI {
+    private const int SEC_I_CONTINUE_NEEDED = 0x00090312;
+
+    [DllImport("Secur32.dll", CharSet = CharSet.Unicode)]
+    private static unsafe extern int AcquireCredentialsHandleW(
+        [MarshalAs(UnmanagedType.LPWStr)] string? pszPrincipal,
+        [MarshalAs(UnmanagedType.LPWStr)] string pPackage,
+        CredentialUse fCredentialUse,
+        IntPtr pvLogonId,
+        Helpers.SEC_WINNT_AUTH_IDENTITY_W* pAuthData,
+        IntPtr pGetKeyFn,
+        IntPtr pvGetKeyArgument,
+        SafeSspiCredentialHandle phCredential,
+        out Helpers.SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("Secur32.dll", EntryPoint = "DecryptMessage")]
+    private static extern int DecryptMessageNative(
+        SafeSspiContextHandle phContext,
+        ref Helpers.SecBufferDesc pMessage,
+        uint MessageSeqNo,
+        out uint pfQOP);
+
+    [DllImport("Secur32.dll")]
+    public static extern int DeleteSecurityContext(
+        IntPtr phContext);
+
+    [DllImport("Secur32.dll", EntryPoint = "EncryptMessage")]
+    private static extern int EncryptMessageNative(
+        SafeSspiContextHandle phContext,
+        uint fQOP,
+        ref Helpers.SecBufferDesc pMessage,
+        uint MessageSeqNo);
+
+    [DllImport("Secur32.dll")]
+    public static extern int FreeContextBuffer(
+        IntPtr pvContextBuffer);
+
+    [DllImport("Secur32.dll")]
+    public static extern int FreeCredentialsHandle(
+        IntPtr phCredential);
+
+    [DllImport("Secur32.dll", CharSet = CharSet.Unicode)]
+    private static unsafe extern int InitializeSecurityContextW(
+        Helpers.SecHandle* phCredential,
+        Helpers.SecHandle* phContext,
+        [MarshalAs(UnmanagedType.LPWStr)] string pszTargetName,
+        InitiatorContextRequestFlags fContextReq,
+        uint Reserved1,
+        TargetDataRep TargetDataRep,
+        Helpers.SecBufferDesc* pInput,
+        uint Reserved2,
+        Helpers.SecHandle* phNewContext,
+        Helpers.SecBufferDesc* pOutput,
+        out InitiatorContextReturnFlags pfContextAttr,
+        out Helpers.SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("Secur32.dll", EntryPoint = "QueryContextAttributes")]
+    private static extern int QueryContextAttributesNative(
+        SafeSspiContextHandle phContext,
+        SecPkgAttribute ulAttribute,
+        IntPtr pBuffer);
+
+    /// <summary>Acquire SSPI credential.</summary>
+    /// <param name="principal">The name of the principal whose credentials the handle will reference.</param>
+    /// <param name="package">The name of the SSPI security provide the credentials will be used for.</param>
+    /// <param name="usage">How the credentials will be used.</param>
+    /// <param name="identity">
+    /// The credential logon information or <c>null</c> to use the current user's credentials.
+    /// </param>
+    /// <returns>Credential information including the handle to the credential itself.</returns>
+    /// <exception href="SspiException">Error when retrieving the credential.</exception>
+    /// <see cref="https://docs.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--general">AcquireCredentialsHandle</see>
+    public static SspiCredential AcquireCredentialsHandle(string? principal, string package, CredentialUse usage,
+        WinNTAuthIdentity? identity) {
+        var user = identity?.Username;
+        var domain = identity?.Domain;
+        var pass = identity?.Password;
+
+        unsafe {
+            Helpers.SEC_WINNT_AUTH_IDENTITY_W authData = new();
+            Helpers.SEC_WINNT_AUTH_IDENTITY_W* authDataPtr = null;
+            fixed (char* userPtr = user, domainPtr = domain, passPtr = pass) {
+                if (identity != null) {
+                    authDataPtr = &authData;
+                    authData.User = userPtr;
+                    authData.UserLength = (ushort)(identity.Username?.Length ?? 0);
+                    authData.Domain = domainPtr;
+                    authData.DomainLength = (ushort)(identity.Domain?.Length ?? 0);
+                    authData.Password = passPtr;
+                    authData.PasswordLength = (ushort)(identity.Password?.Length ?? 0);
+                    authData.Flags = WinNTAuthIdentityFlags.SEC_WINNT_AUTH_IDENTITY_UNICODE;
+                }
+
+                SafeSspiCredentialHandle cred = new();
+                var res = AcquireCredentialsHandleW(principal, package, usage, IntPtr.Zero, authDataPtr, IntPtr.Zero,
+                    IntPtr.Zero, cred, out var expiryStruct);
+
+                if (res != 0)
+                    throw new SspiException(res, "AcquireCredentialsHandle");
+
+                cred.SSPIFree = true;
+                var expiry = (ulong)expiryStruct.HighPart << 32 | (ulong)expiryStruct.LowPart;
+                return new SspiCredential(cred, expiry);
+            }
+        }
+    }
+
+    /// <summary>Decrypts the input message.</summary>
+    /// <remarks>
+    /// The message is decrypted in place, use the input message buffers to retrieve the decrypted value.
+    /// </remarks>
+    /// <param name="context">The SSPI security context to decrypt the message.</param>
+    /// <param name="message">The security buffers to decrypt.</param>
+    /// <param name="seqNo">The expected sequence number of the encrypted message.</param>
+    /// <returns>The quality of protection that had applied to the encrypted message.</returns>
+    /// <exception cref="SspiException">Failure trying to decrypt the message.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/decryptmessage--general">DecryptMessage</see>
+    public static uint DecryptMessage(SafeSspiContextHandle context, Span<Helpers.SecBuffer> message, uint seqNo) {
+        unsafe {
+            fixed (Helpers.SecBuffer* messagePtr = message) {
+                Helpers.SecBufferDesc bufferDesc = new() {
+                    ulVersion = 0,
+                    cBuffers = (uint)message.Length,
+                    pBuffers = (IntPtr)messagePtr,
+                };
+
+                var res = DecryptMessageNative(context, ref bufferDesc, seqNo, out var qop);
+                if (res != 0)
+                    throw new SspiException(res, "DecryptMessage");
+
+                return qop;
+            }
+        }
+    }
+
+    /// <summary>Encrypts the input message.</summary>
+    /// <remarks>
+    /// The message is encrypted in place, use the input message buffers to retrieve the encrypted value.
+    /// </remarks>
+    /// <param name="context">The SSPI security context to encrypt the message.</param>
+    /// <param name="qop">The quality of protection to apply to the message.</param>
+    /// <param name="message">The security buffers to encrypt.</param>
+    /// <param name="seqNo">The sequence number to apply to the encrypted message.</param>
+    /// <exception cref="SspiException">Failure trying to entry the message.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/encryptmessage--general">EncryptMessage</see>
+    public static void EncryptMessage(SafeSspiContextHandle context, uint qop, Span<Helpers.SecBuffer> message,
+        uint seqNo) {
+        unsafe {
+            fixed (Helpers.SecBuffer* messagePtr = message) {
+                Helpers.SecBufferDesc bufferDesc = new() {
+                    ulVersion = 0,
+                    cBuffers = (uint)message.Length,
+                    pBuffers = (IntPtr)messagePtr,
+                };
+
+                var res = EncryptMessageNative(context, qop, ref bufferDesc, seqNo);
+                if (res != 0)
+                    throw new SspiException(res, "EncryptMessage");
+            }
+        }
+    }
+
+    /// <summary>Initiates a security context or processes a new token on an existing context.</summary>
+    /// <param name="cred">The credential to use for the security context.</param>
+    /// <param name="context">
+    /// The context handle for the operation. The first call should be set to <c>null</c> while subsequent calls
+    /// use the context returned from the first call.
+    /// </param>
+    /// <param name="targetName">The target name of the acceptor, for Kerberos this is the SPN.</param>
+    /// <param name="contextReq">Request flags to set.</param>
+    /// <param name="dataRep">The data representation on the target.</param>
+    /// <param name="input">Optional token received from the acceptor or null for the first call.</param>
+    /// <param name="outputBufferTypes">List of types expected in the output buffer that is returned.</param>
+    /// <returns>Context information including the handle to the context itself.</returns>
+    /// <exception cref="SspiException">Failure initiating/continuing the security context.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/initializesecuritycontext--general">InitializeSecurityContext</see>
+    public static SspiSecContext InitializeSecurityContext(SafeSspiCredentialHandle cred,
+        SafeSspiContextHandle? context, string targetName, InitiatorContextRequestFlags contextReq,
+        TargetDataRep dataRep, ReadOnlySpan<Helpers.SecBuffer> input, IList<SecBufferType> outputBufferTypes) {
+        contextReq |= InitiatorContextRequestFlags.ISC_REQ_ALLOCATE_MEMORY;
+
+        Span<Helpers.SecBuffer> output = stackalloc Helpers.SecBuffer[outputBufferTypes.Count];
+        for (var i = 0; i < output.Length; i++)
+            output[i].BufferType = (uint)outputBufferTypes[i];
+
+        unsafe {
+            fixed (Helpers.SecBuffer* inputBuffers = input, outputBuffers = output) {
+                Helpers.SecHandle* credPtr = null;
+                if (cred != null) {
+                    credPtr = (Helpers.SecHandle*)cred.DangerousGetHandle();
+                }
+
+                Helpers.SecHandle* inputContextPtr = null;
+                Helpers.SecHandle* outputContextPtr = null;
+                SafeSspiContextHandle newContext;
+                if (context == null || context.DangerousGetHandle() == IntPtr.Zero) {
+                    newContext = new SafeSspiContextHandle();
+                    outputContextPtr = (Helpers.SecHandle*)newContext.DangerousGetHandle();
+                } else {
+                    newContext = context;
+                    inputContextPtr = (Helpers.SecHandle*)context.DangerousGetHandle();
+                    outputContextPtr = inputContextPtr;
+                }
+
+                Helpers.SecBufferDesc inputBuffer = new();
+                Helpers.SecBufferDesc* inputPtr = null;
+                if (input.Length > 0) {
+                    inputBuffer.ulVersion = 0;
+                    inputBuffer.cBuffers = (uint)input.Length;
+                    inputBuffer.pBuffers = (IntPtr)inputBuffers;
+                    inputPtr = &inputBuffer;
+                }
+
+                Helpers.SecBufferDesc outputBuffer = new();
+                Helpers.SecBufferDesc* outputPtr = null;
+                if (output.Length > 0) {
+                    outputBuffer.ulVersion = 0;
+                    outputBuffer.cBuffers = (uint)output.Length;
+                    outputBuffer.pBuffers = (IntPtr)outputBuffers;
+                    outputPtr = &outputBuffer;
+                }
+
+                var res = InitializeSecurityContextW(credPtr, inputContextPtr, targetName, contextReq, 0, dataRep,
+                    inputPtr, 0, outputContextPtr, outputPtr, out var contextattr, out var expiryStruct);
+
+                if (res != 0 && res != SEC_I_CONTINUE_NEEDED)
+                    throw new SspiException(res, "InitializeSecurityContext");
+
+                newContext.SSPIFree = true;
+
+                try {
+                    var moreNeeded = res == SEC_I_CONTINUE_NEEDED;
+                    var expiry = (ulong)expiryStruct.HighPart << 32 | (ulong)expiryStruct.LowPart;
+                    List<byte[]> outputTokens = new();
+                    foreach (var buffer in output) {
+                        if (buffer.cbBuffer == 0)
+                            continue;
+
+                        var data = new byte[buffer.cbBuffer];
+                        Marshal.Copy(buffer.pvBuffer, data, 0, data.Length);
+                        outputTokens.Add(data);
+                    }
+
+                    return new SspiSecContext(newContext, outputTokens.ToArray(), expiry, contextattr,
+                        moreNeeded);
+                } finally {
+                    foreach (var buffer in output) {
+                        if (buffer.pvBuffer != IntPtr.Zero)
+                            FreeContextBuffer(buffer.pvBuffer);
+                    }
+                }
+            }
+        }
+    }
+
+    /// <summary>Query the security context for a specific value.</summary>
+    /// <remarks>The buffer supplied must be large enough to fill the requested attribute value.</remarks>
+    /// <param name="context">The security context to query.</param>
+    /// <param name="attribute">The type of value to query.</param>
+    /// <param name="buffer">The buffer that will store the queried value.</param>
+    /// <exception cref="SspiException">Failure trying to query the requested value.</exception>
+    /// <see href="https://docs.microsoft.com/en-us/windows/win32/secauthn/querycontextattributes--general">QueryContextAttributes</see>
+    public static void QueryContextAttributes(SafeSspiContextHandle context, SecPkgAttribute attribute, IntPtr buffer) {
+        var res = QueryContextAttributesNative(context, attribute, buffer);
+        if (res != 0)
+            throw new SspiException(res, "QueryContextAttributesNative");
+    }
+}
+
+public class SspiException : AuthenticationException {
+    public int ErrorCode { get; } = -1;
+
+    public SspiException() {
+    }
+
+    public SspiException(string message) : base(message) {
+    }
+
+    public SspiException(string message, Exception innerException) :
+        base(message, innerException) {
+    }
+
+    public SspiException(int errorCode, string method)
+        : base(GetExceptionMessage(errorCode, method)) {
+        ErrorCode = errorCode;
+    }
+
+    private static string GetExceptionMessage(int errorCode, string? method) {
+        method = string.IsNullOrWhiteSpace(method) ? "SSPI Call" : method;
+        var errMsg = new Win32Exception(errorCode).Message;
+
+        return string.Format("{0} failed ({1}, Win32ErrorCode {2} - 0x{2:X8})", method, errMsg, errorCode);
+    }
+}
+
+/// <summary>User identity information used to acquire a credential handle.</summary>
+internal class WinNTAuthIdentity {
+    /// <summary>The username of the identity.</summary>
+    public string? Username { get; }
+
+    /// <summary>The domain of the identity.</summary>
+    public string? Domain { get; }
+
+    /// <summary>The password of the identity.</summary>
+    public string? Password { get; }
+
+    public WinNTAuthIdentity(string? username, string? domain, string? password) {
+        Username = username;
+        Domain = domain;
+        Password = password;
+    }
+}
+
+internal enum CredentialUse : uint {
+    SECPKG_CRED_INBOUND = 0x00000001,
+    SECPKG_CRED_OUTBOUND = 0x00000002,
+    SECPKG_CRED_BOTH = 0x00000003,
+    SECPKG_CRED_DEFAULT = 0x00000004,
+    SECPKG_CRED_AUTOLOGON_RESTRICTED = 0x00000010,
+    SECPKG_CRED_PROCESS_POLICY_ONLY = 0x00000020,
+}
+
+[Flags]
+internal enum InitiatorContextRequestFlags : uint {
+    ISC_REQ_DELEGATE = 0x00000001,
+    ISC_REQ_MUTUAL_AUTH = 0x00000002,
+    ISC_REQ_REPLAY_DETECT = 0x00000004,
+    ISC_REQ_SEQUENCE_DETECT = 0x00000008,
+    ISC_REQ_CONFIDENTIALITY = 0x00000010,
+    ISC_REQ_USE_SESSION_KEY = 0x00000020,
+    ISC_REQ_PROMPT_FOR_CREDS = 0x00000040,
+    ISC_REQ_USE_SUPPLIED_CREDS = 0x00000080,
+    ISC_REQ_ALLOCATE_MEMORY = 0x00000100,
+    ISC_REQ_USE_DCE_STYLE = 0x00000200,
+    ISC_REQ_DATAGRAM = 0x00000400,
+    ISC_REQ_CONNECTION = 0x00000800,
+    ISC_REQ_CALL_LEVEL = 0x00001000,
+    ISC_REQ_FRAGMENT_SUPPLIED = 0x00002000,
+    ISC_REQ_EXTENDED_ERROR = 0x00004000,
+    ISC_REQ_STREAM = 0x00008000,
+    ISC_REQ_INTEGRITY = 0x00010000,
+    ISC_REQ_IDENTIFY = 0x00020000,
+    ISC_REQ_NULL_SESSION = 0x00040000,
+    ISC_REQ_MANUAL_CRED_VALIDATION = 0x00080000,
+    ISC_REQ_RESERVED1 = 0x00100000,
+    ISC_REQ_FRAGMENT_TO_FIT = 0x00200000,
+    ISC_REQ_FORWARD_CREDENTIALS = 0x00400000,
+    ISC_REQ_NO_INTEGRITY = 0x00800000,
+    ISC_REQ_USE_HTTP_STYLE = 0x01000000,
+    ISC_REQ_UNVERIFIED_TARGET_NAME = 0x20000000,
+    ISC_REQ_CONFIDENTIALITY_ONLY = 0x40000000,
+}
+
+[Flags]
+internal enum InitiatorContextReturnFlags : uint {
+    ISC_RET_DELEGATE = 0x00000001,
+    ISC_RET_MUTUAL_AUTH = 0x00000002,
+    ISC_RET_REPLAY_DETECT = 0x00000004,
+    ISC_RET_SEQUENCE_DETECT = 0x00000008,
+    ISC_RET_CONFIDENTIALITY = 0x00000010,
+    ISC_RET_USE_SESSION_KEY = 0x00000020,
+    ISC_RET_USED_COLLECTED_CREDS = 0x00000040,
+    ISC_RET_USED_SUPPLIED_CREDS = 0x00000080,
+    ISC_RET_ALLOCATED_MEMORY = 0x00000100,
+    ISC_RET_USED_DCE_STYLE = 0x00000200,
+    ISC_RET_DATAGRAM = 0x00000400,
+    ISC_RET_CONNECTION = 0x00000800,
+    ISC_RET_INTERMEDIATE_RETURN = 0x00001000,
+    ISC_RET_CALL_LEVEL = 0x00002000,
+    ISC_RET_EXTENDED_ERROR = 0x00004000,
+    ISC_RET_STREAM = 0x00008000,
+    ISC_RET_INTEGRITY = 0x00010000,
+    ISC_RET_IDENTIFY = 0x00020000,
+    ISC_RET_NULL_SESSION = 0x00040000,
+    ISC_RET_MANUAL_CRED_VALIDATION = 0x00080000,
+    ISC_RET_RESERVED1 = 0x00100000,
+    ISC_RET_FRAGMENT_ONLY = 0x00200000,
+    ISC_RET_FORWARD_CREDENTIALS = 0x00400000,
+    ISC_RET_USED_HTTP_STYLE = 0x01000000,
+    ISC_RET_NO_ADDITIONAL_TOKEN = 0x02000000,
+    ISC_RET_REAUTHENTICATION = 0x08000000,
+    ISC_RET_CONFIDENTIALITY_ONLY = 0x40000000,
+}
+
+internal enum SecBufferFlags : uint {
+    SECBUFFER_READONLY_WITH_CHECKSUM = 0x10000000,
+    SECBUFFER_RESERVED = 0x60000000,
+    SECBUFFER_READONLY = 0x80000000,
+}
+
+internal enum SecBufferType : uint {
+    SECBUFFER_EMPTY = 0,
+    SECBUFFER_DATA = 1,
+    SECBUFFER_TOKEN = 2,
+    SECBUFFER_PKG_PARAMS = 3,
+    SECBUFFER_MISSING = 4,
+    SECBUFFER_EXTRA = 5,
+    SECBUFFER_STREAM_TRAILER = 6,
+    SECBUFFER_STREAM_HEADER = 7,
+    SECBUFFER_NEGOTIATION_INFO = 8,
+    SECBUFFER_PADDING = 9,
+    SECBUFFER_STREAM = 10,
+    SECBUFFER_MECHLIST = 11,
+    SECBUFFER_MECHLIST_SIGNATURE = 12,
+    SECBUFFER_TARGET = 13,
+    SECBUFFER_CHANNEL_BINDINGS = 14,
+    SECBUFFER_CHANGE_PASS_RESPONSE = 15,
+    SECBUFFER_TARGET_HOST = 16,
+    SECBUFFER_ALERT = 17,
+    SECBUFFER_APPLICATION_PROTOCOLS = 18,
+    SECBUFFER_SRTP_PROTECTION_PROFILES = 19,
+    SECBUFFER_SRTP_MASTER_KEY_IDENTIFIER = 20,
+    SECBUFFER_TOKEN_BINDING = 21,
+    SECBUFFER_PRESHARED_KEY = 22,
+    SECBUFFER_PRESHARED_KEY_IDENTITY = 23,
+}
+
+internal enum SecPkgAttribute : uint {
+    SECPKG_ATTR_SIZES = 0,
+    SECPKG_ATTR_NAMES = 1,
+    SECPKG_ATTR_LIFESPAN = 2,
+    SECPKG_ATTR_DCE_INFO = 3,
+    SECPKG_ATTR_STREAM_SIZES = 4,
+    SECPKG_ATTR_KEY_INFO = 5,
+    SECPKG_ATTR_AUTHORITY = 6,
+    SECPKG_ATTR_PROTO_INFO = 7,
+    SECPKG_ATTR_PASSWORD_EXPIRY = 8,
+    SECPKG_ATTR_SESSION_KEY = 9,
+    SECPKG_ATTR_PACKAGE_INFO = 10,
+    SECPKG_ATTR_USER_FLAGS = 11,
+    SECPKG_ATTR_NEGOTIATION_INFO = 12,
+    SECPKG_ATTR_NATIVE_NAMES = 13,
+    SECPKG_ATTR_FLAGS = 14,
+    SECPKG_ATTR_USE_VALIDATED = 15,
+    SECPKG_ATTR_CREDENTIAL_NAME = 16,
+    SECPKG_ATTR_TARGET_INFORMATION = 17,
+    SECPKG_ATTR_ACCESS_TOKEN = 18,
+    SECPKG_ATTR_TARGET = 19,
+    SECPKG_ATTR_AUTHENTICATION_ID = 20,
+    SECPKG_ATTR_LOGOFF_TIME = 21,
+    SECPKG_ATTR_NEGO_KEYS = 22,
+    SECPKG_ATTR_PROMPTING_NEEDED = 24,
+    SECPKG_ATTR_UNIQUE_BINDINGS = 25,
+    SECPKG_ATTR_ENDPOINT_BINDINGS = 26,
+    SECPKG_ATTR_CLIENT_SPECIFIED_TARGET = 27,
+    SECPKG_ATTR_LAST_CLIENT_TOKEN_STATUS = 30,
+    SECPKG_ATTR_NEGO_PKG_INFO = 31,
+    SECPKG_ATTR_NEGO_STATUS = 32,
+    SECPKG_ATTR_CONTEXT_DELETED = 33,
+    SECPKG_ATTR_DTLS_MTU = 34,
+    SECPKG_ATTR_DATAGRAM_SIZES = SECPKG_ATTR_STREAM_SIZES,
+    SECPKG_ATTR_SUBJECT_SECURITY_ATTRIBUTES = 128,
+    SECPKG_ATTR_APPLICATION_PROTOCOL = 35,
+    SECPKG_ATTR_NEGOTIATED_TLS_EXTENSIONS = 36,
+    SECPKG_ATTR_IS_LOOPBACK = 37,
+}
+
+internal enum TargetDataRep : uint {
+    SECURITY_NETWORK_DREP = 0x00000000,
+    SECURITY_NATIVE_DREP = 0x00000010,
+}
+
+internal enum WinNTAuthIdentityFlags : uint {
+    SEC_WINNT_AUTH_IDENTITY_ANSI = 1,
+    SEC_WINNT_AUTH_IDENTITY_UNICODE = 2,
+}
+
+internal class SafeSspiCredentialHandle : SafeHandle {
+    internal bool SSPIFree = false;
+
+    internal SafeSspiCredentialHandle()
+        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true) {
+    }
+
+    public override bool IsInvalid => handle == IntPtr.Zero;
+
+    protected override bool ReleaseHandle() {
+        if (SSPIFree) {
+            SSPI.FreeCredentialsHandle(handle);
+        }
+
+        Marshal.FreeHGlobal(handle);
+
+        return true;
+    }
+}
+
+internal class SafeSspiContextHandle : SafeHandle {
+    internal bool SSPIFree = false;
+
+    internal SafeSspiContextHandle()
+        : base(Marshal.AllocHGlobal(Marshal.SizeOf<Helpers.SecHandle>()), true) {
+    }
+
+    internal SafeSspiContextHandle(IntPtr handle, bool ownsHandle)
+        : base(handle, ownsHandle) {
+    }
+
+    public override bool IsInvalid => handle == IntPtr.Zero;
+
+    protected override bool ReleaseHandle() {
+        if (SSPIFree) {
+            SSPI.DeleteSecurityContext(handle);
+        }
+
+        Marshal.FreeHGlobal(handle);
+
+        return true;
+    }
+}
+#nullable disable
\ No newline at end of file
diff --git a/src/SharpHoundRPC/SharpHoundRPC.csproj b/src/SharpHoundRPC/SharpHoundRPC.csproj
index 97607291..dab587b7 100644
--- a/src/SharpHoundRPC/SharpHoundRPC.csproj
+++ b/src/SharpHoundRPC/SharpHoundRPC.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
-        <TargetFramework>net462</TargetFramework>
+        <TargetFramework>net472</TargetFramework>
         <OutputType>library</OutputType>
         <PackageId>SharpHoundRPC</PackageId>
         <LangVersion>9</LangVersion>