# AD Bulk Tool

Cross-platform Avalonia UI app for bulk Active Directory operations from a CSV file.

## Features

- Load a CSV with any column structure
- Auto-discover the AD domain and domain controller via DNS (click **Discover** or runs on startup)
- Built-in port/connectivity health check (DNS, TCP 389, TCP 636, LDAP bind, LDAPS bind)
- Dry-run mode to validate before making changes
- Actions: enable, disable, add/remove from group, set/force password change
- LDAP 389 for normal edits; LDAPS 636 required for password resets

## Download

Pre-built binaries for each platform (no .NET SDK required):

| Platform | File |
|----------|------|
| Windows x64 | `ADBulkTool-win-x64.exe` |
| Linux x64 | `ADBulkTool-linux-x64` |
| macOS x64 | `ADBulkTool-macos-x64` |
| macOS ARM | `ADBulkTool-macos-arm64` |

Grab the latest from [Releases](https://gitea.mikisoq.cc/mikisoq/ADBulk/releases/latest).

## Build from source

### Prerequisites

- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)

| Platform | Install |
|----------|---------|
| Windows | `winget install Microsoft.DotNet.SDK.8` |
| Arch-based | `sudo pacman -S dotnet-sdk-8.0` |
| Ubuntu / Debian | Register Microsoft repo then `sudo apt install dotnet-sdk-8.0` |
| Fedora / RHEL | `sudo dnf install dotnet-sdk-8.0` |
| macOS | `brew install dotnet-sdk-8.0` |

### Run directly

```bash
git clone https://gitea.mikisoq.cc/mikisoq/ADBulk.git
cd ADBulk
dotnet restore
dotnet build
dotnet run
```

### Build standalone executables

```bash
# All platforms at once (Linux/macOS)
./scripts/publish-all.sh

# All platforms at once (Windows PowerShell)
.\scripts\publish-all.ps1

# Single platform
dotnet publish -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true
```

Output goes to `publish/` — a single .exe/binary per platform, no runtime needed.

## Quick start

1. Launch the app
2. Click **Discover** (or let it auto-detect on startup)
3. Enter your AD bind username and password
4. Click **Test ports + LDAP/LDAPS** to verify connectivity
5. Load a CSV
6. Select the username column and an action
7. Run **Preview** then **Dry run** before executing

## Safety

- Test with a dedicated test OU and test accounts first
- Keep **Dry run** enabled until you are sure the mapping is correct
- Password reset actions require LDAPS and are blocked on plain LDAP
- Do not use **Ignore cert errors** in production

## LDAPS certificate trust

### Linux

```bash
# Arch-based:
sudo cp your-root-ca.crt /etc/ca-certificates/trust-source/anchors/
sudo trust extract-compat

# Ubuntu / Debian:
sudo cp your-root-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# Fedora / RHEL:
sudo cp your-root-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust
```

### Windows

If the domain controller certificate is already trusted by the domain, nothing extra is needed. Otherwise, import the root CA into the **Trusted Root Certification Authorities** store.