SharpHound CE

Obtain the compatible collector from BloodHound CE's Download Collectors or check the deployed instance's compatibility against SharpHound releases. Run in the context of a domain user with approved collection scope. On a domain-joined Windows system:

.\SharpHound.exe
.\SharpHound.exe -c DCOnly -d example.test --outputdirectory C:\Collected

The first command uses the default collection, which queries the domain and attempts local group and session collection from domain-joined computers. DCOnly collects domain-controller data and omits direct member-computer collection. Consult SharpHound.exe --help and the official flags for the installed version. Output defaults to a ZIP containing JSON; import it in BloodHound CE and verify ingestion.

Load references/bloodhound-collection-strategy.md when choosing coverage or interpreting missing data. Preserve collection time, methods, scope and errors with the results.