From c92544ebfea1b845aa0a250597124b174ce8c26c Mon Sep 17 00:00:00 2001
From: mikisoq <mikisoq@mikisoq.cc>
Date: Wed, 29 Jul 2026 02:01:52 -0100
Subject: [PATCH] Add cross-platform install docs to README

---
 README.md | 124 ++++++++++++++++++++++++++++--------------------------
 1 file changed, 65 insertions(+), 59 deletions(-)

diff --git a/README.md b/README.md
index 8508575..8152958 100644
--- a/README.md
+++ b/README.md
@@ -1,84 +1,90 @@
-# AD Bulk Tool prototype
+# AD Bulk Tool
 
-A small Avalonia + C# prototype for bulk Active Directory edits from a CSV.
+Cross-platform Avalonia UI app for bulk Active Directory operations from a CSV file.
 
-## What it currently does
+## Prerequisites
 
-- Load a CSV file.
-- Show all CSV headers in a human-readable dropdown, including duplicate column names as `1: Name`, `2: Name`, etc.
-- Select one of these actions:
-  - Disable user
-  - Enable user
-  - Add to group
-  - Remove from group
-  - Set random password
-  - Set password change at next login
-  - Set random password + change at next login
-- Preview changes locally.
-- Run a real AD dry run that binds to LDAP/LDAPS and validates users.
-- Execute changes against AD.
-- Test DNS, TCP 389, TCP 636, LDAP bind on 389, and LDAPS bind on 636 before running a job.
-- Use two presets:
-  - `Use LDAP 389 (normal edits)`
-  - `Use LDAPS 636 (password edits)`
+- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
 
-## Important safety notes
+### Windows
 
-- Test with a dedicated test OU and test accounts first.
-- Leave `Dry run` enabled until you are sure the mapping is correct.
-- Normal edits such as enable, disable, add to group, and remove from group can use LDAP 389.
-- Password reset actions require LDAPS 636 and are blocked if LDAP 389 is selected.
-- `Set password change at next login` sets `pwdLastSet=0`; it does not generate a new password.
-- Do not use `Ignore cert errors` in production. Install your internal root CA on the Linux machine instead.
-- The prototype shows generated passwords in the result list. Treat the screen as sensitive.
+```powershell
+winget install Microsoft.DotNet.SDK.8
+```
 
-## Run
+### Linux (Arch / CachyOS)
 
 ```bash
+sudo pacman -S dotnet-sdk-8.0
+```
+
+### Linux (Ubuntu / Debian)
+
+```bash
+# Register Microsoft repository, then:
+sudo apt install dotnet-sdk-8.0
+```
+
+### macOS
+
+```bash
+brew install dotnet-sdk-8.0
+```
+
+## Build & Run
+
+```bash
+git clone https://gitea.mikisoq.cc/mikisoq/ADBulk.git
+cd ADBulk
 dotnet restore
+dotnet build
 dotnet run
 ```
 
-## Typical values
+On Windows, you can also open the folder in Visual Studio and run from there.
 
-For normal edits:
+## Features
 
-```text
-LDAP host:      [DomainController hostname]
-Port:           389
-Use LDAPS:      unchecked
-Search base DN: DC=Your,DC=domain
-Bind username:  Your\your-admin-user or your-admin-user@YourDomain
-```
+- Load a CSV with any column structure
+- Auto-discover the AD domain and domain controller via DNS (click **Discover** or runs on startup)
+- Supports LDAP 389 (normal edits) and LDAPS 636 (password resets)
+- Built-in port/connectivity health check
+- Dry-run mode to validate before making changes
+- Actions: enable, disable, add/remove from group, set/force password change
 
-For password reset actions:
+## Quick start
 
-```text
-LDAP host:      [DomainController hostname]
-Port:           636
-Use LDAPS:      checked
-Search base DN: DC=Your,DC=domain
-Bind username:  Your\your-admin-user or your-admin-user@YourDomain
-```
+1. Launch the app
+2. Click **Discover** (or let it auto-detect on startup)
+3. Enter your AD bind username and password
+4. Click **Test ports + LDAP/LDAPS** to verify connectivity
+5. Load a CSV
+6. Select the username column and an action
+7. Run **Preview** then **Dry run** before executing
 
-## Recommended test order
+## Safety
 
-1. Enter host, search base, bind username, and bind password.
-2. Click `Test ports + LDAP/LDAPS`.
-3. Confirm whether LDAP 389 works.
-4. Confirm whether LDAPS 636 works.
-5. Load a tiny CSV with test users.
-6. Run `Preview`.
-7. Run with `Dry run` checked.
-8. Only then run without `Dry run`.
+- Test with a dedicated test OU and test accounts first
+- Keep **Dry run** enabled until you are sure the mapping is correct
+- Password reset actions require LDAPS and are blocked on plain LDAP
+- Do not use **Ignore cert errors** in production
 
-## Linux LDAPS trust
+## LDAPS certificate trust
 
-For proper LDAPS, your Linux machine must trust the CA that issued the domain controller LDAP certificate.
-On Arch/CachyOS, this is commonly done by placing your root CA certificate under `/etc/ca-certificates/trust-source/anchors/` and running:
+### Linux
+
+Place your root CA certificate and run:
 
 ```bash
+# Arch / CachyOS
+sudo cp your-root-ca.crt /etc/ca-certificates/trust-source/anchors/
 sudo trust extract-compat
+
+# Ubuntu / Debian
+sudo cp your-root-ca.crt /usr/local/share/ca-certificates/
+sudo update-ca-certificates
 ```
 
-Exact CA trust commands depend on your Linux distribution.
+### Windows
+
+If the domain controller certificate is already trusted by the domain, nothing extra is needed. Otherwise, import the root CA into the **Trusted Root Certification Authorities** store.