Domain Admin Misuse Scan Tool 1.0

Attribution
Created and released by Int64 Software Ltd (https://int64software.com)

Introduction
The purpose this utility is to check for Scheduled Tasks or Windows Services configured to run using a Domain Admin account,
and for traces of Domain Admin accounts having logged into a computer. The tool can be run locally or on a remote computer.

Licence
Released under the CC BY-NC-ND 3.0 (Attribution-NonCommercial-NoDerivs) licence (for more information see licence.txt)

Usage
dascan.exe [/c <hostname>]

Command Line Parameters:
 /c or --computer {HOSTNAME}        - The hostname to scan (defaults to localhost)
 /ru or --remoteuser {USERNAME}     - Username to connect with
 /rp or --remotepassword {PASSWORD} - User account password
 /to or --timeout {TIMEOUT_SECS}    - Maximum amount of time to wait for the scheduled task scan (in seconds)
 
Optional Domain Admin Lookup Options:
 /dc or --domain {DC}               - Name of the domain controller to connect to
 /du or --domainuser {USER}         - Username to query the domain controller
 /dp or --domainpassword {PASSWORD} - Password for the domain query account
 
 /nosched                - Disable Schedule Task scan
 /noserv                 - Disable Windows Service scan
 /noprof                 - Disable Profile check

Additional Parameters:
 /p or --pause           - Require a keypress before closing
 /v or --verbose         - Output additional data
 /sid or --sid		 - Locate the Domain Admins group by SID instead of group name (useful for non-English language domains)
 

Return Code Information (Bitwise code with following possible bits set):
 0 - No domain admin account usage found
 1 - An error occurred
 2 - One or more scheduled tasks with domain admin accounts were found
 4 - One or more Windows services with domain admin accounts were found
 8 - One or more profiles for domain admin accounts exist
 
Usage Notes
This utility is designed as a quick scan tool to aid in quickly identifying the  potential misuse of one or more 
domain admin accounts, it may not return accurate results under some circumstances and should always be used in conjunction with 
other security best practices. Int64 Software Ltd does not make any guarantees for the accuracy of any results produced.