Change in v1.32.0

AD Permissions Editor  *** New ***     
Updated AD Permissions dialog to provide the ability to edit the permissions of an object. The edit option can be used in conjunction with the Effective Rights tab to model permission changes. See Permissions Dialog or How to edit an AD object's permissions.

Reports  *** New ***     
This option is used to display the direct and indirect reports under the nominated User. See Reports

General
Added UAC detection at startup and warn if a restricted token is detected when running on a DC, as sthe DC may not return some data due to the restricted token. 
Replaced all instances of strcpy with strncpy to help prevent memory overflows.  Better support has been added for Unicode characters not included in the current code page. For DNs that contain a Unicode character, the DN will be encoded as # hexstring, i.e. CN=#04044761C48D,DC=w2k12,DC=local.

AD Effective Permissions
A new capability has been added to the AD Permissions Browser and the Permissions dialog to show the Effective Permissions. In AD Permissions Browser, the Effective Permissions are shown while browsing the AD. See AD Effective Permissions for more details.

AD Permissions Browser
The trustee option was updated to automatically add Pre-Windows 2000 Compatible Access group based on the group membership.
Added option to export permissions.
Permissions are now colour-coded to reflect the permissions that have been granted.
Updated the Trustee option to include a pre-Windows 2000-compatible access group to the access token.
Updated Trustee select to display the object search dialog if the User is not found.
Updated the ACE flags to provide more details of the ACE.
Fixed bug where list contents are not cleared when switching between permissions tabs.
Fixed intermittent error when switching between DACL and Default Security permissions for Schema objects.
Additional caching has been added to improve performance when switching between permission types on the same object.

AD Permissions Reporter
Added option to include Authentication group.
Fixed new rule defaulting the scope selection.

Permissions Dialog
Updated trustee selection to include the option to use the current User's access token.
Added the Effective Rights tab to display the Effective Permissions of the selected trustee. See Permissions dialog
Updated to include SACL permissions

AD Properties Dialog
Updated LAPS tab to support both LAPS v1 and v2.
Update the function of Absolute checkbox to refresh the TokenGroup list when changed.
The account option is updated to show the status of the User who cannot change their password based on the object permissions.
Added a Permissions button to the dialog.
Updated the TokenGroup tab so it doesn't refresh each time it's selected.
TokenGroups now uses the Profile cache to improve name resolution performance over slow links.
Updated to handle attributes that can't be resolved or displayed correctly, due to Unicode characters.
Updated to support Unicode DN in DN-DN attributes - member, memberof, manager, direct reports
Added extra field on Objects tab to display UTF-8 encoded DN, is displayed for DNs that contain Unicode characters

Connection Profiles
Added option to specify the LDAP Protocol Version to be used for the profile. The default is Version 3.

DC Resolution
Updated LDAP and DS binds to use the connection profiles.

DirSync
Updated the cookie functionality so show changes if the cookie is subsequentially used.

DsGetDcName
Added additional options for Windows 2022 and an Advanced View to show the associated API constants for the options. Also updated the output to display the details of the flags passed to the API.

Error Messages
Updated LDAP Error messages to also return the Windows equivalent error message.

Export Permissions
added the option to export the permissions of objects from AD Permissions Browser and Permissions dialog

GPO Explorer
Updated the context menu so the Edit GPO option is available in the tree view and GPO list views.
Updating testing to show the results of the data capture phase if a single server is selected.
Updated the GPO list view to include who has been assigned the Apply GPO right.
Additional tabs were added on the Group Policy Object view to display the Policies and Default GPO permissions.
GPO Test, Updated logic so if sysvol is inaccessible then all sysvol tests reflect the failure.
Fixed an intermittent exception error on the Domain based GPO tests.
Update the tests to include additional testing of the permissions on both AD and Sysvol, and checks that the sysvol permissions are the same across all DCs
Added additional Sysvol test on individual GPO details to test and report on file permissions.
Added option to open and view the settings in registry.pol files.

Group Compare
Added a new membership compare option of Member Recursive, which will compare the membership of a group and all nested groups.

LDAP Browser
Fixed bug where user-selected decode types are not honoured.

LDAP Search
Updated the Manage Control dialog to allow the selection of Sequence encapsulated of the value, to provide better support for other control types. 
Fixed bug that could cause an exception when multiple Date meta data decodes are used
Added metav attribute decode for value based replication details contained in the msds-msDS-ReplValueMetaData attribute.
Added decode for UTCTime and change dynamic decode to select UTCTime for OID 2.5.5.11 and OMSyntax = 23.

Meta Data Dialog
Updated to support F5 refresh option

Object Count
Updated to support GC connections so the count can be completed across the entire forest.

Object Replication
Added context menu option called Move to Top as the first DC in the list is used as the source DC to compare the other DC against.

Organization Dialog
updated to include Organisation Structure in the context menu

Ping
Updated context menus to disable change option when tests are running.

Schema Versions
Updated to support LAPS v2, Exchange 2019 CU13.

Search
The Use With context menu updated to include an option to select Effective Permissions

	Time Converter
		Updated to support hex-based 64 bit time entries, i.e 0x1d99bfe7fb26dbd

Changes in v1.31.0

AD Permissions Reporter  *** New ***     
A reporting option to report and search for permissions that have been assigned in the AD, supports both basic and advanced filters. See AD Permissions Reporter.

Certificate Checker  *** New ***      
A new feature to verify the certificate that are assigned to website, including the revocation status, More details available here.

Compare AD Permissions    *** New ***    
Context menu option to compare the permissions of different objects.  See How to compare AD permissions.

Object Replication    *** New ***    
A new feature to test if AD objects and their attributes are replicated across the domain controllers in the domain. See Object Replication for more information.

SDDL Viewer    *** New ***    
A new feature to display SDDL strings in the Permissions dialog.  More details available here.

Find Trustee Assignments
Depreciated

AD Permissions Browser
ACL Browser renamed to AD Permissions Browser
Updated context menu to support option to export a permission as a dsacls command.
Updated inheritance text to include no propagation rights details and displayed separately in the rights view.
Changed the icons used in trustee mode to the same as used in AD Permissions Reporter, to make it easier to see which permissions are applies to the trustee.
Fixed index error when assigning the NT Authority\Self to a trustee.

AD Properties
Fixed context menu on delegation tab to allow linked SPN tests.
Fixed memberof bug, some groups are not displayed if the displayname is not set.
Added option to display the time and date when changes to the group membership happened.
Updated to display the Fine Grain Password details for both users and groups.
Updated Logon tab to include Password Expires based on the msDS-UserPasswordExpiryTimeComputed attribute.

AD Sites
Updated to include a dsBind test to test RPC connection, also updated to support profiles.

AD Subnet
Updated to support IP Addresses with CIDR.
Subnet that are not linked to a site are shown as <not assigned>.

Attributes Dialog
Hex dump - now able to provide hex dump of security descriptor for non-admin users.

Attribute Replication
Updated to display all the attributes of the selected object across the selected domain controllers.

Base64
Updated to support encoding a SID string to binary in Base64 and back to SID String.

DC Resolution
Removed port 3389 from default list of ports, added for testing and shouldn't be there.

Error Messages
Updated to also return error details for WinInet error codes.

GPO Explorer
Added GPO testing functionality similar to that of GPOTool.exe. See How To Test GPOs as GPOTool is no longer available.
Update security tab to include the rights view of the permissions assignment.
Fixed display updates when switching from OU to WMI and back again.

GUID Search
Updated to now search for the entered GUID against common object GUID, and option to search against all GUID attributes found as part of the dynamic attribute discovery.

LDAP Browser
Added button to allow a DN to be opened in a separate window.
Updated to include a Restore Objects for deleted objects, see How To Restore deleted AD objects.

LDAP Search
Added option to limit the number of records returned.  Update Favorite Import to support import of multiple favorite in one go.
Updated the DNSProperty decode to support all data types.
Updated favorites variables to include ##root to specific the root DN of the forest.
Updated to support different Ordering OIDs on the sort field, see Sort for more details.
Certificate verification date format now based on regional settings.  When connecting using SSL it will now displays the SSL connection information.
Fixed intermittent exception error that could happen when using meta data attribute types.
Fixed bug in the getdn subst variable that could cause an exception.
LDAP Search Enum dialog - Updated context menu to allow selection of bit operator.
Define the enum DecodesType for GPOptions, ServerState, ForceLogoff.
Set DecodeType for AuditPolicy to DecodeType BIN.
Added DecodeType GMSAPWD.PWD_B and GMSAPWD.PPWD_B to display GMSA password in byte based binary output.

Object Count
Updated to save the count details, with subsequent counts shows the delta between the counts.

Object MetaData
Updated to also display the value of the value of the attribute and changed time to display local time.

Organization Structure
Fixed exception that can occur when multiple Left SD menu item selected.
Added additional logic to detect circular references.
Added an extra context menu item to display a separate window with the org structure.

Ping
Added option to specify the ICMP packet size used for the ping.

Permissions dialog
Added additional caching at the profile level to improve performance and reduce data requests. Also improves the performance of AD Permissions Browser,  and GPO explorer.
Added Inheritance details to the status bar.

Resolver
Updated test options so any entry is added to the resolver history.
Fixed columns update so blank attributes are shown correctly.

Schema Version
Updated to support Exchange 2019 CU11, CU12 & 2016 CU22, CU23.

SDProp
Updated to include support Service Managed Accounts and improved performance.

SID Converter
Updated to include icons for resolved names and now if a SID is not found, it will now check if the domain SID exists to confirm if the SID has been deleted or the domain is invalid.

Site Browser
Updated to displays bridgehead servers in the site settings view.
Added addition error reporting for Validate function and added DsBind test.
Subnets that are not linked to a site are shown as <not assigned>.

Token Size
Updated the connection to use the GC to correctly resolve cross forest groups and fixed bug were multiple entries in SIDHistory caused the token size to be calculated incorrect.

User Search
Fixed bug where from a child domain, the Use GC option didn't use the root of the forest for the search.

User Search dialog
Updated so if only one user account found and it matches the search, it automatically returns the single entry.

Predefined Queues
The follow queues have been updated:

AD: Invalid Pwd Change (All users)
AD: Invalid Pwd Change (Nominated user)
AD: List gMSA Accounts
AD: List MSA Accounts
AD: Restore Deleted User
AD: RootDSE Modify - Dump Database
Users: Invalid characters for O365
Users: Mail and UserPrincipalName different

DecodeTypes list:

    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BASE64 - encode the returned value as Base64    
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary output
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GMSAPWD - return the full details of the gMSA password
    GMSAPWD.PWD - return only the current password
    GMSAPWD.PWD_B - return only the current password in Bytes
    GMSAPWD.PPWD - return only the previous password
    GMSAPWD.PPWD_B - return only the previous password in Bytes
    GMSAPWD.QRY - return the query interval
    GMSAPWD.UCG - return the change interval
    GMSAPWDID - return the full gMSA PasswordID details
    GMSAPWDID.RK - return the gMSA PasswordID Root Key
    GMSAPWDID.SVR - return the gMSA PasswordID server
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    META - Decoder for msDS-ReplAttributeMetaData
    METAP - Decoder for replPropertyMetaData attribute
    METAV - Decoder for msDS-ReplValueMetaData
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NANOTIME - Display interval based on nano seconds
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTCN - Returns the parent container of the CanonicalName
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_DACL_COUNT - Returns the number of ACE in the DACL
    SD_DACL_EXPCOUNT - Returns the number explicitly assigned ACE in the DACL
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_GROUP - Return the primary group assigned in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SACL_COUNT - Returns the number of ACE in the SACL
    SD_SACL_EXPCOUNT - Returns the number explicitly assigned ACE in the DACL
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_GROUP – Returns the primary group assigned in the SD 
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    UNICODE - Return a string in Unicode format, with BOM decode support
    WMITime - Returns the wmi time 
    WMITime_UTC - Returns the utc wmi time
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Changes in v1.30.0

ASN.1 Viewer *** New ***    
An option to display ASN.1 data structures, support for DER, PEM, PKCS#7, and PKCS#12 file formats, and manual input in hex and base64 formats.  Includes support for common x.509 field types. 

DirSync  *** New ***  
An option to run an LDAP query with the DirSync server side control to display what changes have been made in the select context. 

Domain Changes  *** New ***     
An option to display which objects have been changed/created or replicated to the domain controller, based on the objects with updated USNChanged attribute. 

Object Counts  *** New ***      
An option to count the number of different types of objects that exist under the selected OU structure.  Selectable object types for Users, Groups, Computers, Active Users, OU and all objects. 

User's Membership  *** New ***          
An option to display a user's group membership, including nested groups and which group contributed to the user's groups. 

General
Updated the icons and context menu icons.
Added additional command line options to allow a LDAP Search Favorite to specified and run from the command line, /f:<favorite name>, i.e. NetTools "/f:AD: RootDSE"  The /Q option is also available which will cause NetTools to quit after the query has finished running.
Added a new Find feature to enable searching for items in the result.
Added Open Container context menu to open the parent container in LDAP Browser.
Added LDIF Export option to context menus to allow the objects to exported to file in ldif file format.
Time and Dates now displayed based on locale and regional settings, LDAP Search Substitution input entries also use locale date format for entry.
Options that require a username (SamAccountName) entry, now display a user search dialog if the entered name is not found.

ACL Browser
Added Group Members and Group Manager options to the context menus.
Fixed intermittent exception error when copying multiple items.
Fixed display issue associated to member attribute and add\remove self to group extended right.

AD Attributes
Updated to remove the dependency on the AllowedAttributes to allow the objects from non AD based directories to be displayed.

AD Properties
Updated the TokenGroups tab to include the SID of the names that are resolved against each entry.    Also includes an option to use Absolute SID Resolution, this is to help identify any entries that are associated to SID History.
Updated Members tab to also display which members have been removed from the group and when.
Updated the object selector used to manage group membership to support a paste option, so multiple entries can be added to the selection list.  Supports DN, samaccountname, upn, email, and name, with any combination of these.
Added option on Logon tab to perform a Last Logon scan.
Added option to display organisation structure from Organisation Tab.
Updated the Members and MemberOf lists to include the samaccountnames of included objects

Base64
Updated to use dynamic buffers rather than static to allow for larger decodes.
Added option to decode output to file.
Added option to be able to display hex or base64 outputs in the ASN.1 viewer.
Improved the handling of the extra space in the data input.
Updated to support Hex stream data input format.

Compare Groups
Updated so it can compare both member and memberof attributes, so it can be used to compare the membership of groups as well as users.

Copy To Windows
Improved the performance when displaying large list of items and better indication to the user when the program is busy.

DsGetDcName
Updated the selectable options to include DS8, DS9, DS10, and Key Lists.
Updated the flags decode to display the full flags names, and added support for DS9, DS10, Key Lists.

DC Resolution
Updated the ports option to allow lists of ports to be defined and selected, simplifying the testing of different services.

GPO Explorer
Added AD Sites view with indication if policies are applied to a site.
Double click to WMI filter viewer to display policy details.
Added GPO Results to context menu to the Content tab of the GPO Allocation view to display which policies have been applied to a selected machines.
Updated to display the wireless and wired GPO settings.
Updated to display which client side extensions are assigned to the GPO.
Updated the Settings view for the registry items to display all the registry entries in the registry.pol as a single list, the option is available by clicking on the Settings item at the top of the registry tree.
Updated a number of context menus to include some of the standard options, which were missing.
Updated GPO List view to include the split screen option to display the selected GPO properties below the list.
Added context menu item to display all OUs that have block Inheritance enabled.
Added additional error handle to GPO that don't have the display name set or gplink attributes with invalid format

Last Logon Time
Added accumulative logon Count across all domain controllers and DN
Added context menu option to input a new entry

LDAP Search
Conditional Attributes - updated logic so an attribute with no value set is also tested against the condition statement. i.e. location!=london will be true if no value is set.
Conditional Attributes - updated so the position of the wildcard character is position sensitive, if the wildcard character is placed at the begin of the search criteria i.e. *disable, then 'disable' will match any where in the attribute. If the wildcard is placed at the end of the search citeria i.e. disable*, the a match only occurs if disable is at the start of the attribute.
Conditional Attributes - the entered case of static entries is now persevered.
Custom Controls updated to allow data encoding type to be defined, data can now be defined as String or Integer encoded using BER encoding, or Non-BER encoded Integer.
Option to display server controls that are sent and returned as a hex dump and ASN.1 structure dump in the text output view, option is selected in the Manage Controls dialog.
Updated Search Statistics option to automatically change which sets of search stats are returned based on the domain controller functional level.
Updated Attributes field to also support the getdn substitution, so they can be used in the update queries.
Updated the MSTRUST DecodeType for the msds-TrustForestTrustInfo attribute to provide details of excluded routing suffixes.
Updated Filter processing to remove the case sensitivity of boolean expressions.
When the Display Results option is not selected with Update Queues, it will prevent the attribute pre-read before updates which significantly improves the performance when updating attributes with more than a few thousand values.
Updated REPS_INFO DecodeType, used by repsto and repsfrom attributes, to support V2 data structure format.
Updated file output logic, so when file output is selected and Display Results is not selected, the results are written to the file.  Fixed bug with single line option so all entries are now written to the file. Fixed bug with tab separated character.
Updated Use column with context menu to include add to Resolver.
Added a shift key function to disable html parser when pasting items in Input Mode.
Added new METAP DecodeType, used for the replPropertyMetaData attribute.

LDAP Search - Predefined Queries
The following predefined queries have been added:
AD: Schema Attributes ANR Indexed
AD: Schema Attributes Confidential
AD: Schema Attributes Constructed
AD: Schema Attributes in GC
AD: Schema Attributes Indexed
AD: Schema Attributes Not Replicated
AD: Schema Attributes Tuple Indexed

The following predefined queries have been updated:
GPOs: All
GPOs: All deleted
GPOs: Computer Targeted Policies
GPOs: Created in Last 30 Days
GPOs: Created in Last 60 Days
GPOs: Created in Last 7 Days
GPOs: Created in Last 90 Days
GPOs: Created Today
GPOs: Created Yesterday
GPOs: Deleted in the last 24 hours
GPOs: Deleted in the last 48 hours
GPOs: Modified in Last 30 Days
GPOs: Modified in Last 60 Days
GPOs: Modified in Last 7 Days
GPOs: Modified in Last 90 Days
GPOs: Modified Today
GPOs: Modified Yesterday
GPOs: Non Active
GPOs: Policies with a WMI Filter
GPOs: User & Computer Targeted Policies
GPOs: User Targeted Policies
GPOs: WMI Filters
Groups: All
SCCM: Management Points
SCCM: Site Boundaries
SCCM: Sites
Users: Active Users Who Haven't Logged On In Last x Days - user defined period
Users: Without Home Directory

Meta Data Dialog
Updated Value replication table to include local and originating USN details.

NetGroupEnum
Renamed the option to Local Groups.

Organisation Structure
Change the default view to display reporting lines, including peers and direct reports as separate items.  Still has the option to display the old tree view as this is more useful in some scenario.

Replication Queues
Updated authentication to use DSBindWithCred instead to DsBind to allow the credentials from the Connection Profiles to be used.

Resolver
Included a key shortcut to allow new entries to be manually entered using the Insert key.
Context menu updated to be object sensitive and will enable and disable options based on the object selected.
Display GPO Results added to the Use with context menu.
Fixed bug where the item count may be incorrect.
Updated to allow tracking of objects that have been opened or used with context menus
Added Object History option, so all object opened or linked via context menus are automatically added to the the Resolver list
Updated so each new entry added also records the server name.

SID Converter
Updated output view to use a table view to simplify the output and easier to copy details between options.
Added the option to display SID details from a Base64 format input.
Fixed bug where comma separated SIDs were not resolved correctly.

Schema Versions
Updated to include support for Exchange 2019 CU8, CU9 &CU10, 2016 CU19, 20 & CU21

Schema History
Updated with details of SCCM, Mapi Lab, EMC schema extensions
Updated to display Unknown if the schema extension is not in the internal database.

Time Converter
Updated to display the time outputs in a table view.
The time and date input are now based on the locale time\date format.  The locale time\date format is displayed as the supported formats section.

Token Size
Updated the size column to reflect the Token Size based on the MS algorithm to calculate Token Size.

User Search
Updated Use With context menu to include Local Groups option, to allow the local groups of member machines to be viewed.
Updated Use With context menu to include GPO Results on computer objects that are returned.
Updated icons so there is a separate icon for expired users
Updated to include an advanced option to allow searching of specific attributes on nominated object.

DecodeTypes list:

    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BASE64 - encode the returned value as Base64    
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary output
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GMSAPWD - return the full details of the gMSA password
    GMSAPWD.PWD - return only the current password
    GMSAPWD.PPWD - return only the previous password
    GMSAPWD.QRY - return the query interval
    GMSAPWD.UCG - return the change interval
    GMSAPWDID - return the full gMSA PasswordID details
    GMSAPWDID.RK - return the gMSA PasswordID Root Key
    GMSAPWDID.SVR - return the gMSA PasswordID server
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    META - Decoder for msDS-ReplAttributeMetaData
    METAP - Decoder for replPropertyMetaData attribute
    METAV - Decoder for msDS-ReplValueMetaData
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NANOTIME - Display interval based on nano seconds
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTCN - Returns the parent container of the CanonicalName
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_DACL_COUNT - Returns the number of ACE in the DACL
    SD_DACL_EXPCOUNT - Returns the number explicitly assigned ACE in the DACL
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_GROUP - Return the primary group assigned in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SACL_COUNT - Returns the number of ACE in the SACL
    SD_SACL_EXPCOUNT - Returns the number explicitly assigned ACE in the DACL
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_GROUP – Returns the primary group assigned in the SD 
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    UNICODE - Return a string in Unicode format, with BOM decode support
    WMITime - Returns the wmi time 
    WMITime_UTC - Returns the utc wmi time
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Changes in v1.29.0

Sessions *** New ***
A new option to display the existing logon sessions on the machines, and the ability to display what processes are associated to a logon session.

General
NetTools now includes over 280 predefined LDAP queries
Finally removed the default icon and added a new one
Added the option to add selected item to Resolver on the context menu

ACL Browser
Updated to include the Modify owner rights in the ACE pane
Updated flags view to display additional tag for each of the the various SD flags and flag values
Added context menu to copy the SD to clipboard in SDDL format

AD Properties Dialog
Updated to include the msExchRemoteRecipentType on the Exchange tab
Added capability to manage group membership of the member and memberof attributes
Updated TokenGroup tab to display the source SID rather than 'Error' if the SID can't be resolved
Added sMGS tab to display details associated to Group Managed Service Accounts, with the option to display and copy the current and previous passwords
Updated icons for Managed Service Accounts and Group Managed Service Accounts
Added BitLocker tab to display BitLocker recovery keys

Attribute Dialog
Added context menu to display the Attribute Value dialog with and without attribute Decode
Added context menu to allow the value to displayed in Hex Dump
Added context menu to display the schema definition of an attribute

DSGetDcName
Added a manual flag option, so you can specify the actual flags sent to server

Clipboard
Updated the Clipboard option to display the different data type available in the clipboard and the ability to display the data associated to each clipboard data type
Included the option to display a hex dump of the clipboard data

Connection Profiles
Updated AD Properties and Attributes dialog and Top Quotes to work correctly with Connection Profiles
Updated the Server tab to enable the global catalog to be specified, used specifically for the User Search, AD Properties dialog and the LDAP Search Use GC option
Fixed bug with Anonymous authentication type
Fixed intermittent issues causing the credentials dialog not being drawn correctly
Fixed bug where profile details were not displayed for the selected profile, if prompted to save unsaved changes

GPO Explorer
Updated to include WMI Filters and AD Sites
WMI Filter name now displayed on GPO allocation screens
Updated the XML parse for GPO Preferences to improve the displaying of settings
Added additional validation for preference so only items that have an XML file are shown as having settings

LDAP Browser
Added context menu to allow the DN of objects to be copied to the clipboard

LDAP Ping
Added a manual flag option, so you can specify the actual flags sent to server

LDAP Search
Fixed bug in Input Mode, where an exception could be caused if a row of input data is missing a column item
Added the option to add additional user specified server side controls
Updated to include Use GC option to use the GC server settings in the Connection Profile
Updated date substitutes to include StartofDay, EndofDay, StartofUTCDay, and EndofUTCDay constants, StartofDay and EndofDay returns times based on local time, while StartofUTCDay and endofUTCDay return time based on the UTC e.g. (&(whencreated>={zdate:startofday})(whencreated<={zdate:endofday})) or  (&(whencreated>={zdate:StartofUTCDay})(whencreated<={zdate:EndofUTCDay}))
Added new substitutes getdn, which will return the DN for the samaccountname provided as the parameter e.g. {getdn:domain admins}, {getdn:guests}, {getdn:user1}
Substitutions now available on the BaseDN field
Added addition DecodeTypes SD_DACL_COUNT and SD_SACL_COUNT returns the total number of ACE in the DACL or SACL. SD_DACL_EXPCOUNT and SD_SACL_EXPCOUNT returns the number of explicitly or no-inherited ACE in the ACL
Added additional DecodeTypes for Group Managed Service Accounts GMSAPWD, GMSAPWD.PWD, GMSAPWD.PPWD, GMSAPWD.QRY, GMSAPWD.UCG
Added additional DecodeTypes for RootKey - KDSPARAM
Added addtional DecodeType to WMI Time and date WMITIME and WMITIME_UTC
Updated LDAP Filter wizard to supported nested subst command and fixed formatting issues if brackets are included in the subst
Fixed bug in attribute update using escaped binary format
Change the priority order of the user defined DecodeType, so user defined settings take precedence
Added support for the use of environment variables in the filter and attribute fields i.e. (samaccountname=%username%)
Updated the auto complete feature to work with meta attributes and environment variables
Added the following static Decodes: 

msDS-ManagedPasswordId - GMSAPWDID
msKds-KDFParam  - BINARY
msKds-SecretAgreementParam - BIN
msKds-SecretAgreementParam - BIN
msKds-RootKeyData - BIN
crossCertificatePair - CERT
msds-ManagedPassword - GMSAPWD
msKds-CreateTime - 64TIME
msKds-UseStartTime - 64TIME
msDS-RequiredForestBehaviorVersion - ATTRIBENUM
msDS-RequireddomainBehaviorVersion - ATTRIBENUM
msWMICreationDate - WMITIME
msWMIChangeDate - WMITIME

Logon
Added a new tab to display the statistics associated to the access token

Object Compare
Fixed intermittent exception error, caused if the left object is deleted or moved between scans

Resolver
The Resolver option has been updated to support user defined columns to allow additional attributes to be displayed
Updated to include a search of the proxyaddresses attribute for email address entries 
The context menus have been updated to allow items in output pane to be added to the Resolver and has a shortcut key of Crtl+R
Added status bar which displays total and selected items counts

Schema Class Browser
Added an extra columns that displays the security Property Set and DecodeType for each attribute
Fixed an intermittent exception error
Updated context menu on Where Used form so nested Where Used option can be performed

Schema Versions
Updated to include Exchange 2016 CU18 & 2019 CU7 schema updates

Search
Updated so if an email address is specified then an additional search of the proxyaddresses attribute is included in the search request to the server
Updated to use the GC server details in the Connection Profile
Updated icons for Managed Service Accounts and Group Managed Service Accounts
Added status bar to show number of items returned and selected

User Rights
Added a new tab to display the statistics associated to the access token

WhoIs
Updated the redirection code to support additional record types

DecodeTypes list:

    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BASE64 - encode the returned value as Base64    
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary output
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GMSAPWD - return the full details of the gMSA password
    GMSAPWD.PWD - return only the current password
    GMSAPWD.PPWD - return only the previous password
    GMSAPWD.QRY - return the query interval
    GMSAPWD.UCG - return the change interval
    GMSAPWDID - return the full gMSA PasswordID details
    GMSAPWDID.RK - return the gMSA PasswordID Root Key
    GMSAPWDID.SVR - return the gMSA PasswordID server
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    META - Decoder for msDS-ReplAttributeMetaData
    METAV - Decoder for msDS-ReplValueMetaData
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NANOTIME - Display interval based on nano seconds
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTCN - Returns the parent container of the CanonicalName
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_DACL_COUNT - Returns the number of ACE in the DACL
    SD_DACL_EXPCOUNT - Returns the number explicitly assigned ACE in the DACL
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_GROUP - Return the primary group assigned in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SACL_COUNT - Returns the number of ACE in the SACL
    SD_SACL_EXPCOUNT - Returns the number explicitly assigned ACE in the DACL
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_GROUP – Returns the primary group assigned in the SD 
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    UNICODE - Return a string in Unicode format, with BOM decode support
    WMITime - Returns the wmi time 
    WMITime_UTC - Returns the utc wmi time
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Changes in v1.28.1

General
NetTools no longer uses the ADSI APIs, all queries against the AD now only use the LDAP API, this provides a small performance increase but more importantly it provides consistency across all features.
The toolbar is now allows displayed at the top of NetTools, and includes buttons for navigation, Connection Profiles, Resolver and Help and quick search by default, Pin items are displayed to the right of these buttons.

Connection Profiles  *** New ***
With previous versions of NetTools, it would use the current user's credentials and domain join information of the workstation running NetTools to authenticate and select the directory that would be interrogated and there were only a few features that supported the use of different credentials via the Use LDAP Search Credentials option.  This version introduces a new feature called Connection Profiles, which adds the extra capability to define the server connection and credentials that will be used by the tests and features and provides a common method to define and access the AD across all tests.  See Connection Profiles.

Circular References  *** New ***
A new feature to test if there are any infinite loops in your group memberships. See Circular References

Resolver *** New ***
A quick way to search for a single or multiple items, just copy and paste a a single or list of items that you want to find, and it will search the AD for the items and display if they exist in the directory or not.  The copy and pasted list can be displayname, samaccountname, DN, SID, UPN, or email address.  See Resolver

AD Properties Dialog
Added an extra tab to display the TokenGroups for user and computer objects

AD Site ISTG
A complete rewrite of the function from ADSI to LDAP API

Compare Objects
Updated to include the NTSecurityDescriptor attribute 

LDAP Browser
Added an additional feature to display the attribute values as a hex dump
Fixed issue with the filter limiting the number of items displayed

LDAP Search
Table view context menu updated to include a Use Column with option to allow data in the column for common dialogs
Removed the Credential option, you now use Connection Profiles to specific different credentials and authentication methods
Updated Tab views so selected items count on the status bar is updated when a tab is selected

SCP 
A complete rewrite of the function from ADSI to LDAP API

Changes in v1.27.7

General
A new Pin context menu option is available in the left hand option selector, which is used to create shortcut buttons for your commonly used options.
Default Copy to clipboard shortcut key has been changed to Ctrl-C, to align with standard copy and paste keys. Now in any of the table views if one or more rows are selected and Ctrl-C is pressed, contents of the column directly under the cursor is copied to the clipboard.

AD Properties
Updated to display Kerberos DES-CDC-CRC, DES-CDC-MD5, RC4 encryption options.
Updated to use the LDAP enum decode function so attribute decodes are consistent across all dialogs. 

Compare Objects
Added a Compare Values context menu option which displays a visual side by side comparison of the values with the difference highlighted.

LDAP Browser
Fixed bug in LDAP browser, where intermittently it would display the attribute values twice.

LDAP Search
Updated the LDAP Session options to fix a bug with the GetDsName flags.
Updated enums to support LargeInteger (int64) values.
Updated the MsExchRecipientTypeDetails, msExchRemoteRecipientType, msExchModerationFlags, and MsExchRecipientDisplayType enums to support O365 values.
Updated the OmSyntax enums values. 
Added new Base64 DecodeType, to allow attribute values to be outputted in base64 format.

RID Pool
Added an extra column to display the number of RID that are left in the pool for each domain controller.

DecodeTypes list:
    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BASE64 - encode the returned value as Base64
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary list
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTCN - Returns the parent container of the CanonicalName
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_GROUP – Return the primary group assigned in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_GROUP – Returns the primary group assigned in the SD 
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    UNICODE - Return a string in Unicode format, with BOM decode support
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Change in v1.27.0

Compare Objects  *** New ***
A new option that provides the ability to compare two object, or the changes that have been made on a single object based on previous snapshot 

LDAP Browser  *** New ***
I've copied the LDAP Browser feature from the LDAP Search option and now added it as it own item in the left hand pane.

AD Properties Dialog
Updated to display AES128 and AES256 encryption options

Attribute Replication
Added option to check attribute replication for objects in the the global catalog context

Find Trustee
Fixed intermittent exception error when checking for ownership permissions

LDAP Search
Added a tab output option, so results from each query is displayed on a new tab
Added enum decodes for msDs-SupportedEncryptionTypes
Updated the conditional attributes function so that meta data information is supported for both variable and results.
    e.g.   Validate;{if: meta.time.unicodepwd == pwdlastset : "Valid" : "Error"}

Changes in 1.26.0
Group Changes  *** New ***
An audit function to show the group membership changes for the specified user.  See Group Changes

ACL Browser
Added the List objects permissions into the properties list view
Changed the default behavior when changing between ACL’s so any column sorts are removed, and ACE are displayed in the order in the ACL.
Changed the first column to include the ACL Index number

Attribute Replication
Fix a scope issue so the attributes in the root object can be checked 

Copy to new Window
Added an context menu option to open a new window with the list unique column details
Now supports the Dynamic and Sort column sorts

Extended Rights
Fixed bug where GUID was not displayed

General
Added help button on each page which links back to the NetTools website for more information

Group Manger
Added support for email\upn in user input
Added Select All\Deselect All context menu options

LDAP Browser
Fixed Indexing error when browsing a directory via the global catalog

LDAP Search
The current filter is now displayed in the text pane for each iteration of the query when in Input Mode

Last Logon Time
Added extra column for PwdLastSet 

Meta Data
Removed the 1000 item display limit on replication details.

Overlapping Subnets
Updated the display adding green and yellow indicator to show if the IP address range is assigned to different sites

Rights
Added context menu option to request a privilege

Schema Browser
Added the Index column to show if an attribute is Indexed or not

Changes in 1.25.11

ACL Browser
Update ACL\ACE Flags option view to display the raw mask data and mask after processing, which will show if there are any unprocessed masks
Trustee Mode updated so only the ACE that apply to the trustee are displayed.
Trustee Information dialog updated to displays the SIDs and associated name for the trustee.  Now also includes the ability to add or remove SIDs to a trustee's SID list, to provide the ability to evaluate the impact of changing a trustee's permissions.

SDProp
Updated SDProp to display the results in a list view
Added an option to trigger SDProp Process
Added context menu to reset ACL and AdminCount on selected users 

LDAP Search 
Update LDAP Filter Wizard to move change function on a separate button rather than linked to the type selection.
Added new Substitution option {-1:} which will be replaced with 9223372036854775807, which is 0xFFFFFFFFFFFFFFFF and is used on a number of attributes to indicate that the function\operation of the attribute is not set, as in the case for AccountExpires. e.g. (&(accountexpires=*)(!accountexpires=0)(!accountexpires={-1:}))  

Copy to new Window
The functionality of the Copy to new Window has been updated to include the ability filter the displayed results based on text and content filters.  Right clicking on the column headers will display the filter options.

Changes in 1.25.4

ACL Browser
Updated the flags so the inherited flag is reported correctly for schema based permissions

General - Column Sort
Updated 64Date sort function to correctly handle '-' entries

Locked Accounts
Added extra fields to the view - Bad Password Time, Account Expires, Lockout Time, Password Last Set
Added a bulk unlock function for selected accounts
Added status bar with the total and selected items

Search
Updated search logic so the useraccountcontrol, accountexpires, lockoutimt attributes are displayed correctly in the output.
Fixed issue where the current column list is not displayed
Changed the options to be non-volatile

Changes in 1.25.0

GPO Explorer  *** New ***
A new option to browser GPOs and GPO allocation. Supports similar functionality as the Group Policy Manager, allowing viewing of GPO configuration, permissions, OU structure browsing, with policy inheritance, display the raw settings in the policies, covering registry, scripts, GptTmpl, GPP settings. Includes the option to view and edit policies using gpedit or GPMC editor, if it's installed.
Object Metadata  *** New ***
This option will display the metadata of an attribute on a specific object across all domain controllers, to allow checking of replication consistency
Top Quotas  *** New ***
Option to display the quota usage of the top users.  Includes an option to display the quota allocation to an individual user.  With the ability to select the quota per partition.
ACL Browser
Added Meta data and Attributes to the content menu of the left hand pane
Updated to display deleted and recovery items, corresponding permissions required
Added Trustee mode, allows you to select a trustee and the ACE icon will display a green tick on all the ACE that the trustee has been assigned
Updated ACE pane so the ADS_RIGHT_DS_CONTROL_ACCESS right is displayed as Control access against the property.  This provides simpler visibility of Confidential Attribute configuration 
AD Properties Dialog
Added icon for locked accounts
AD Subnets
Updated to support column sorting
Control Access Rights
Updated screen redraw to increase display speeds
DC Resolution
Updated ports dialog to allow multiple ports to be removed
Fixed bug where a server could be displayed multiple test due to case sensitive
Extended Rights
Added column for Rights GUID
Last Logon Time
Fixed intermittent Index error when sorting
LDAP Browser
Changed ObjectClass order so Options attributes are decoded correctly
LDAP Search
Update SupportedControl to include LDAP_SERVER_SET_OWNER_OID, LDAP_SERVER_BYPASS_QUOTA_OID, LDAP_SERVER_LINK_TTL_OID, 
LDAP_SERVER_SET_CORRELATION_ID_OID, 
LDAP_SERVER_THREAD_TRACE_OVERRIDE_OID
Add inline filter substitution for Match rule OID LDAP_MATCHING_RULE_DN_WITH_DATA introduced in Windows 2012R2.  The substitution characters for this rule is $= e.g. (msDS-HasInstantiatedNCs $= B:8:0000000D:DC=corp), which expands to (msDS-9HasInstantiatedNCs:1.2.840.113556.1.4.2253:=B:8:0000000D:DC=corp)
Fixed bug in the range option on attributes
Added DecodeType for Unicode strings, it also supports Byte Order Mark (BOM) to define the Unicode format
Updates to the screen draw in table view, provides about 25% increase in displaying results
Added 'Display on Complete' option to increase the display speed, screen updates are suppressed until all results are displayed
Locked Accounts
Added context menu for AD Properties and Attributes
NetGroupEnum
Updated to include icons to represent users and groups
Updated context menu to include AD properties for the select trustee
Ping
Updated to support column sorting
Schema Class Browser
Update to display the hierarchy of the selected schema class
Schema History
Added extra column to display OID
Added Windows 2019 
Added Exchange 2016 CU7
Schema Version
Updated Windows 2019
Changed Unknown to Not Set for items that don't exist
Added option to display the raw values rather than the decoded values 
SD Prop
Complete rewrite to support new functionality
Added context menu to display AD properties
Added option to clear the AdminCount attribute and reset ACL inheritance on user accounts that have AdminCount attribute set
Site Browser
Added option to display the list of IP subnets
Added option to display the list of AD Site Links
Time Convertor
Updated to support yyyy/mm/dd hh:mm:ss time\date format
Updated to support yyyy-mm-ddThh:mm:ss.mmm Azure time\date format 
Token Size
Fixed double click on Token Size List so sub group list is opened 
User's Groups
Context menu updated to include option to open AD properties
User Search
Fixed bug where stored LDAP Search credentials are used when displaying Attributes Dialog
Add context menu for Find Trustee, GPO Allocation, Quota Usage
Added icon for locked user accounts, GC search must be disabled for locked accounts to be displayed
WINS Lookup
Improved error reporting and added Set Debug option
 
DecodeTypes list:
    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary list
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTCN - Returns the parent container of the CanonicalName
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_GROUP – Return the primary group assigned in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_GROUP – Returns the primary group assigned in the SD 
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    UNICODE - Return a string in Unicode format, with BOM decode support
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Changes in 1.24.4

ACL Browser
Fixed issue were attribute GUID are not loaded into the cache intermittently
LDAP Search
Added option to displayed extended error reporting
Updated string substitutions to include {sdate:now} and {sdatetime:now} to display the current date or date and time. Date format is fixed as DD/MM/YYYY.
Updated the copy favorites to clipboard option to copy the settings currently being displayed
Updated favorites to support ##inputn in the BaseDN field
UNC Check
Updated UNC dropdown to display the MRU UNC path from the Run dialog

Version 1.24.0

A few new functions introduced with this version as I have been doing more work around websites and internet based services.  A interesting note that I found while writing the Trace Route function, the standard method to complete the TTL ICMP echo is using the standard winsocket RAW method, however, I found that the default settings of the Windows firewall would block this traffic and would require the user to allow this traffic for the function to work correctly.  This was unexpected specially as this is not required for the MS command line tracert utility and there are no default rules to allow this traffic.  After a bit of playing around, I used the IcmpSendEcho API, and these packets bypass the firewall completely and there is no way to block them. I wonder how many other MS APIs bypass the firewall completely and means you can’t block this traffic!

Changes in 1.24.0

Trace Route ** New **
A multi-threaded Trace Route option that provides the fastest possible result by testing all hops at the same time, displaying the complete route in under 3 seconds
WhoIS  ** New **
An option to query WhoIs databases for both IP and domain details
IP Geo Location ** New **
An option to display the Geo location information of an IP address
HTTP Headers ** New **
An option to display the HTTP headers of a website
UNC Check ** New **
New option to check a UNC path, this will check that server’s IP address is resolvable, share exists and permissions to access the file systems and display which part of the path is valid or not
URL Check ** New **
An option that combines all of the above web based tests against a domain name
General
Added additional error handling around ini file reads and writes to prevent exception caused by disconnected shares
ACL Browser
Updated so the GUID and SID caches are not cleared between searches for the same domain to improve performance, manual clear Cache option added
Updated ACL Flags option to display allow and deny flags in the ACL
Added context menu option to display AD properties dialog
Fixed bug that could cause an exception error
AD Properties Dialog
Added the object name to the title of the dialog
Update ProxyAddresses to allow multiple line selection 
Updated members and memberOf to use the domain context of the displayed object rather than the server’s default context, so the PrimaryGroupID is resolved correctly
AD Sites
Change the site option to a dropdown list of available AD sites
Base64
Fixed issues with Hex decode not showing the last line of the text dump
DCs in Sites
Change the site option to a dropdown list of available AD sites
Find Trustee Assignments
Updated so the search can include the Owner in the results
LDAP Search
Defined parentGUID, msExchOnPremiseObjectGuid, msDC-ConsistencyGuid as GUID decode type
Added option in LDAP Filter wizard select if Not queries comply with RFC4515. MS LDAP supports the format as in RFC4515 and an abbreviated version that doesn’t require extra parenthesis around the filter for Not statements, i.e. RFC4515 format:  (!(objectclass=user)), MS format (!objectclass=user)
Updated LDAP Location Selector to use BaseDN rather than the DC’s default domain context
Conditional attributes updated to include the Len option, which returns the string length of the variable
LDAP Browser
Updated shift start functionality on the LDAP Search option to start in a new instance so multiple browsers can be opened
Updated to support LDAP directories that don’t use the AllowedAttributes on the list available attributes on objects
Meta Data Dialog
Updated with an option to display times in UTC or local time
NetGroupEnum
Updated to include the machine\domain reference of the trustees
Org Structure
Added option to only display direct reports that have active accounts
Added option to specify Naming Context to support non-contiguous name spaces
Fixed exception error when the manager attribute is not set
Overlapping Subnets
Updated the results text from errors to overlaps to reflect changes in MS recommendations on catch all entries
Fixed bug that could cause an exception if output to file selected but no filename specified
Ping 
Updated to the success and failed results are displayed correctly and clears the previous results before tests start
Schema Browser
Updated screen redraw to improve display speed
Schema History
Added Exchange 2016 CU7
Schema Version
Updated to include Exchange CU5-7
Added the Exchange Forest Version
SID Convertor
Updated the output to display the SID in a number of different formats, including LDAP filter, ADSI, Hex and Base64
Site Browser
Added extra column to display the replication type on the list site view
Added stop button on the site coverage to stop the current lookups
Updated to display Site Settings for each site 
Updated to display Policy Query settings for the setting and domain controllers, if a new policy has not been defined, the default policy is displayed
Time convertor
Updated to display the time entered as UTC, local to UTC, and UTC to local
User Rights & Logon
Changed the output to be tab and table based to allow easier viewing and copying
User Search
Updated search to support downlevel name format <domain>\<identity>
Updated Use With option for Org Structure to pass the server context if it’s changed from the default
Changed GC Option to clear the current list to prevent GC\No-GC lookups issues
Fixed bug where the scope list would not be updated correctly if an error occurs while getting domain list

DecodeTypes list:
    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary list
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTCN - Returns the parent container of the CanonicalName
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_GROUP – Return the primary group assigned in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_GROUP – Returns the primary group assigned in the SD 
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Changes in 1.23.0

Ping ** New **
A new feature that allows multiple devices to be pinged at the same time, paste a list of end points to be pinged, supports short names, FQDN and IP addresses, just paste a list of IP addresses, names, or FQDN to scan
Extended Rights  ** New **
Provides the ability to display what extended rights have been assigned to each schema class
Org Structure ** New **
New feature that allows you to browser the organization structure as defined in the AD by the Manager and Delegates attributes
Clipboard Format Viewer ** New **
New feature that allows you display the format of the data that is currently in the clipboard buffer
AD Properties
Updated to use the GC for Membership lookup to increase the performance of group resolution
Added the Hide from GAL option on the Exchange tab
Added LAPS tab to display the details associated to the Local Administrator Password Service on computer object
Added AD and GC server details used to retrieve the details
ACL Browser
Updated to include SACL tab, this requires the SeSecurity right to display the SACL permissions
LDAP Search
Added Display results to update query to increase the performance of updates when updating the attributes on multi-value attributes i.e. Member
Added LDAP filter wizard which provides a graphical query designer
Added an additional filter substitution for an multiple string ANR search. {anr:<string>} 
Defined ms-Mcs-AdmPwdExpirationTime as 64Time
Fixed Hex display issue
Fixed bug where results not being displayed when conditional attributes is used
Fixed potential protocol error when SACL option selected
Set the table view as the default option
LDAP Performance
Updated to provide better precision on the timing results
NetGroupEnum
Updated to display both local and global groups and displays the members of a selected group
RID Pool
Updated to use DNS Hostname rather than short name to help name resolution issues
Schema History
Updated to support Exchange CU2 & 3, Windows 10 LAPS
Version Checking
Updated version checking to taking into account changes to Dropbox public folders

A new version of NetTools is available at http://db.tt/flQa1L3V 

Version 1.22

This update has a number of new features around AD security, like the ACLViewer utility, NetTools now provides the same simple explorer view to display the object’s and mailbox’s security descriptor.  The ACL Browser is able to browser any partitions, if the schema partition is selected the Default Security Descriptor for schema class is also displayed. 

Assigned Trustees is a new feature to provide the ability to search for any ACLs that contains the specified trustee, this can be a user, group or any other security principal.

LDAP Search has a number of new features including more Update query options, Auto Complete, and Conditional Attributes.  The Update Queries now support move and delete options, as the object will be moved or deleted, no other attributes updates can be included in the same query. The Auto Complete option is available on the filter and attribute fields, once the Populate list button has been pressed the schema details are cached and are available for Auto Complete on these fields.  The Auto Complete feature also includes a syntax checking on the Attributes field.  This feature will highlight any attributes or decode type in red that are not valid. The Conditional Attributes feature provides the ability to do attributes based comparisons that are not available in standard LDAP queries.  It provides a conditional check against each retuned object from the LDAP search results and will return a true or false result, the results can be static text or an attribute of the returned object.  Conditional Attributes are specified in the Attribute field as an extension to an attribute name and defines the conditional statement with the true and false results.  

Conditional Attributes have the following syntax: <attribute name>;{if:<variable1>[;type]<op><variable2>[;type]:<true result>:<false result>}

attribute name: is the name of the attribute that the result will be returned against
variable1: the first variable for the comparison, this can be an attribute of the object or static text
op: the logic operator used to compare variable1 and variable2, the options are:
==        Equal
!=         Not Equal
>          Greater Than
<          Less than
>=        Greater or equal
<=        Less or equal
variable2: the second variable for the comparison, this can be an attribute of the object or static text.  If the first character of the static entry is ‘*’ then the Equal and Not Equal op will search for the text within in variable1, if not then the variable2 must match variable1, comparisons are case in-sensitive.
type: is an optional format option to define the data type of the variable and is used for the comparison, the options are int or date
true result: the value to be returned against the attribute name if the condition is true
false result: the value to be returned against the attribute name if the condition is false

With all fields, static text is encapsulated in quote marks, and any value not encapsulated is assumed to be a attribute of the object.  Static entries can also include any of the substitutions options, i.e. oid, ip, ipn, idate, zdate, hex, guid, unicode, and userinput
            Examples:
                        
                       Updated:{if:usnchanged;int==usncreated:”Unchanged”:”Changed”}
                       One:{if:extensionattribute2==”1”:”true”:extensionattribute2}
PwdChanged:{if:pwdlastset;date>=”10/11/16”:”Updated”:”Needs updating”}
Password_Changed:{if:pwdlastset;date>=”{idate:now-14}”:”Updated”:”Needs updating”}
Not_Admin;{if:member!=”*admin account”:member:” ”}

Changes in 1.22.0

Access Control Rights  ** New **
A complete rewrite of the Extended Rights and Property Sets options, they are now combined under the one option now including Validated Rights details 
ACL Browser  ** New **
A new option to browser the ACL defined in the AD or AD LDS directory
Assigned  Trustees ** New **
This option will scan all accessible objects in the default naming context and displays the list of unique users and groups that have been assigned rights in the AD.  This option is useful to see if a specific security principal has been assigned rights in the directory.
Find Trustee Assignments  ** New **
This option provides the ability to search if the specified trustee has been assigned any rights to any objects in the directory.  Includes an option to include or exclude inherited permissions
Password Checker  ** New **
This option provides the ability to check a single password against a list of accounts, and confirm if the accounts are using the password. The status report will show if the account is currently locked, password reset required, expired, or is disabled. To use this option just paste a list of samaccountnames into the pane, enter the details and click go
Extended Rights  ** Removed  **
AD Subnet
Updated to remove spaces from user input
Updated to display Not Found if the IP address(es) are not defined in the AD
Attribute Replication
Updated to display all the values of attributes with multiple values.
Base64
Updated to support text selection and decodes across multiple lines
LDAP Browser
Significant rewrite of most functions to use the LDAPClass and added attribute cache feature to improve performance over slow links
LDAP Search
Bug fix: resolved issue where the attribute order was not preserved in table view
Now includes support auto complete and validation on filter and attributes fields, this option is available once the populate list button has been pressed.  The auto complete option is enabled by default but can be disabled by deselecting the Auto Complete option.  The Populate list button is shown below:

Added Clear Table option to allow the contents of the table view to not be cleared between searches
Added additional dialog option to allow the selection of attributes for the Attributes field
Added option for Conditional Attributes
Added Enum button to display the internally defined enum used by NetTools to decode attributes
Added PARENTCN DecodeType to display the parent CanonicalName of the object
Added DecodeType for ValidAccesses attribute
Added decode for msDS-UserPasswordExpiryTimeComputed
Added decode for msRTCSIP-UserRoutingGroupId
Added DecodeType SD_NAME_GROUP and SD_SID_GROUP for the primary group in the SD
Fixed sorting issues for Int data types
Updated the LDAP Browser button so if the shift key is held down when clicking on the LDAP Browser button its opened in a non-modal mode, so it can stay open
Updated Display Filter field to support parameter encapsulated in quote marks
Updated the Display Filter logic to provide better support for attributes with multiple values
Updated Value field in update queries to include substitutions commands to work with Input mode data  i.e. AccountExpires=={idate:##input2}
Updated to support quote marks encapsulation for Values in Update queries
Updated the Attribute List dialog to include a manual DecodeType type allocation
Updated so after an update query has completed the preview option is selected to prevent any accidental updates
Updated update queries to support move and delete operator, The delete option is only available once the Delete and Delete Tree options are selected:
To update an attribute an Update Operator must be specified after the attribute name, follow with the value you wish to set.  This is the Syntax for the update operation:
<Attribute><Op><Value>
Attribute:  The name of the attribute that you wish to update
Op: The operation that is to be performed
=+        Add Value to attribute
=-         Remove the Value from the Attribute, if no Value is specified the attribute is cleared
==        Set\Replace the current value of the attribute with Value
=|         Perform a bitwise operation of the current value of the attribute, this Op has a specific format for the Value
Value = <Mask>:<Data>
Mask - the bitwise mask  Note: Input Mode substitution can’t be used on this field, only the data field 
Data - is the bits to be set based on the bit mask
=#        Delete object, the Attribute can be any attribute that has a value assigned, no value is required  ** New **
=>        Move the object the new location specified by the Value, the Value should be encapsulated in quote marks ** New **
            The Attribute can be any attribute that has a value assigned
Value: the data to be written to the attribute

Examples:
AccountExpires=={idate:##input2}                          - Set AccountExpires to the int64 value of ##input2
dn=>”cn=users,dc=domain,dc=com”                   - Move the selected object to the specified location
dn=#                                                                - Delete the object from Active Directory
General
Added a DN Select Location option to all fields that require a DN entry, which allow the DN to be selected by browsing the specified directory.  The Select Location button has three dots ...
Updated to include better support for displaying Unicode and UTF-8 LDAP strings
Group Compare
Bug fix – auto sort is disabled when SID resolution is selected
Group Manager
Updated to allow cross forest lookup of security principals
Last Logon Time
Fixed intermittent Indexing error
AD Properties dialog
Bug fix – fixed issues where primary group is not resolved in some domain configurations
Updated to display the user’s thumbnail photo
Improved the user feedback and stability when the members and memberof tabs are displayed for object with large number of memberships
Updated icons in member and memberof to show disabled objects
Schema Version
Updated to include the Forest, Domain and Domain Controller Functional Levels 
Updated to cover Windows 2016 technical preview 4
Schema History
Updated to include Exchange 2016 CU1
Search
Use with option on context menu updated with ACL Browser option
Updated to display an icon for each object returned, disabled objects are shown with a disabled icon
User Rights
Updated to display current assigned and enabled user rights

DecodeType list:
    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary list
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTCN - Returns the parent container of the CanonicalName
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_GROUP – Return the primary group assigned in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_GROUP – Returns the primary group assigned in the SD 
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Version 1.21

While this is only a minor version number change, this version is a significant change in the functionality of NetTools.  With previous versions the LDAP Search option would only allow you to query the AD or LDAP directory.  With this version you can now perform update operations on objects in the directory.  Combined with the new Batch and Multi-Column Input Modes the update option offers tremendous flexibility and power to update objects in the directory. Like any tool that allow direct writes to the directory, it also has the potential to cause damage, so use with care!!

To use the Update option you have to input the required details in the Attribute field, see the syntax below, you then need to select the Enable Updates option.  This will enable the preview mode by default as an extra safety net.  Preview mode allow you to run the query and show the values that would be written to the attributes when the preview mode is turned off.  When Preview mode is deselected the Go button turns red to show that the update mode is enabled and attributes could be changed when the query is run.  Please note, there is no undo option for updates.  When you run an update query the values returned against each of the attributes are the new value for the attributes after the update has been completed.  If an error occurs during the update the LDAP error code is returned, in most case these are self explanatory and are usually due to a schema restriction.  See the Single Update option below for more information on how to determine which update caused the error.

The Add operator ‘=+’ can fail due of the schema definition of an attribute that is being updated.  If you use Add operator to update an attribute that has a schema definition of single value, if there is no value assigned to the attribute the update will succeed.  However, if there is a value already assigned the update will fail.  In the case of single value attributes its better to use the Set ‘==’ operator to assign the new value, as this will set or replace the existing value.

The value provided to update attributes can use the same substitution options that are available in the filter field i.e sid, oid, ip, ipn, idate, zdate, hex, guid, unicode, and userinput.  There is additional substitutions options for the attributes field, these are attrib and code characters.  The attrib substitution option can be used to retrieve the value of an attributes, this is useful for updating multiple line single value attributes like the Info field.  To retrieve the value of an specific attribute, this doesn’t have to be the same attribute as the one that is being updated, you only need to specify the attribute name in the subst command i.e. {attrib:info}.  The support for the retrieval of a value is limited to attributes that only have a single value set.  If multiple values are assigned to the attribute the retrieval will fail and report an error that multiple values exist.  The substitution also supports the use of the standard C\C++ Escape characters to include control character or binary values, these are listed below.        

The batch mode feature provides the ability to run a number of saved queries in a specified order.  It can be used to complete management tasks, one example is the automation of disabling inactive accounts.  This is achieved by creating a query that returns all accounts that are inactive based on your audit requirement, then the next query in the batch list is an update query that is configured as input query taking the results from the first query as an input, these accounts are then disabled by the second query.  

Change in 1.21
Group Compare  ** New **
Provides the ability to compare the group membership of two users accounts.  There are two comparison options, compare by Name or Object SID.  The list of groups that are returned can be derived from either the group membership attribute of the user or the user’s Token Group details which will contain all the SIDs of all the groups, including nested groups, and domain security principals that are granted at logon.  The SIDs can also be resolved in a number of different ways:
None – the SID is displayed.
Relative – the name associated to the SID based on the SID assigned to the ObjectSID or SIDHistory attributes in the domain.
Absolute – the SID is referenced back to the source domain and real name is displayed.  Network performance and old SID History entries to a non-existent domain can impact the performance of this resolution type.
Last Logon Time  ** New **
This new feature allows you to display the last logon time for a list of users.  NetTools will scan all the domain controllers in the domain for the individual Logon Time and display which Domain controller has the latest time.  You just need to paste a list of samaccountnames into the output pane and click Go.
AD Properties Dialog
Added ability to open the properties dialog for managers and direct reports.
Updated hints on fields to display the name of the attributes that contains the value.
AD Replication Queue
Added option to change how long the queue entries are display before they are removed from the list.
DC Resolution
Bug Fix: fixed issues in the default context detection
Last Logon
Updated Last Logon output to include the meta for the PwdLastSet attribute.
Updated the Event log scan criteria to also look for the user’s UPN as well as SamAccountName.
AD Attributes Dialog
Added the Single column to display if the attribute is single value.
LDAP Browser
Bug Fix: resolved issue where the browser could be slow to open.
Added additional context menu option on the Attribute menu to allow the Raw attribute data to be viewed.
LDAP Search
Bug Fix: Intermittent Invalid handle exception.
Bug Fix: in security descriptor decoder.
Added a Zoom feature for the Filter and Attribute fields.
Added CSV output option, when used in conjunction with the fie output option
Updated with support for Windows 2016TP3
Improved the performance of the column redraw.
Removed the limitation that requires the DN to be in the first column for DN context menu items
Updated PWDSEC DecodeType to handle 64 bit -1 correctly
Added decode for the pwdProperties attribute
Two new subst options available on the filter and attribute fields. These are called userinput and unicode.  The userinput will prompt the user for an input. This requires a label which is shown on the dialog box.  The user inputs are cached against the label, if a label is used a second time the cached response is used and the user is not prompted. The userinput subst can be nested in other subst options e.g. (pwdpastset>={idate:{userinput:Date}}) the user would be prompt to enter the date, then the idate subst will cover this into a 64 bit date code.  The Unicode subst will convert the text to a escaped hex unicode value i.e. {unicode:uni-text} results in \75\00\6E\00\69\00\2D\00\74\00\65\00\78\00\74\00
The Input Mode paste and file load function have been updated to allow up to ten column inputs to be added.  The separation is the tab character, which is the default used by Excel when copying multiple columns.  Each column is given its own designator i.e. ##input, ##input2, ##input3 etc.  These designator can then be used in the DN, Filter, and Attribute fields and will be substituted for the value in the column when the query is run.  
Batch Mode ** New **
Allows you to specify a list of favorite queries to be executed in a specified order.  The output of one query can be used as the input for the next query.  Use the Batch List button to select the queries and order.  The batch list can be saved and recalled at a later date.
Update Mode  ** New **
The LDAP Search now has has the ability to update attributes based on the values specified in the attribute field or data specified in the Input Mode columns.  To update an attribute an Update Operator must be specified after the attribute name, follow with the value you wish to set.  This is the Syntax for the update operation:
<Attribute><Op><Value>
Attribute:  The name of the attribute that you wish to update
Op: The operation that is to be performed
=+        Add Value to attribute
=-         Remove the Value from the Attribute, if no Value is specified the attribute is cleared
==        Set\Replace the current value of the attribute with Value
=|         Perform a bitwise operation of the current value of the attribute, this Op has a specific format for the Value
Value = <Mask>:<Data>
Mask - the bitwise mask  Note: Input Mode substitution can’t be used on this field, only the data field 
Data - is the bits to be set based on the bit mask
Value: the data to be written to the attribute

Examples:
ExtensionAttribute1==Office1                              - Sets the ExtensionAttribute1 to Office1
ProxyAddresses=+smtp:www.world.com - Adds the value to the ProxyAddresses, the existing values are preserved
ProxyAddresses=-smtp:www.world.com              - Removes the specific value from the attribute
ProxyAddresses=-                                              - Clear the attribute, i.e. set to not set
UserAccountControl=|2:2                                    - Sets the 2 bit of the attribute to 1
UserAccountControl=|2:0                                    - Clears the 2 bit of the attribute to 0
UserAccountControl=|6:4                                    - Clears the 2 bit and sets the 4 bit of the attribute
UserAccountControl=|2:##input2                        - sets bit 2 to the value of ##input2
Info=={attrib:info}\n user updated as part of change 31012
Info=={attrib:info}{attrib:mail} user updated as part of change 31012
Objectversion=={attrib:objectversion}1
Binary=+\23\34\01\5a\4f\00

The Update mode can be combined with the multi-column Input Mode to update the attributes on objects with different values.  For example if you wanted to update the department and telephone numbers in AD for a number of users.  If you paste three columns of data containing a list of samaccountname, department name, and new telephone number and then by setting the Filter field to (samaccountname=##input) and the attribute field to Department==##input2, telephone==##input3 you can update all the users details in one operation.  Another example you have a list of users that need to be disabled and another list of users that need to be enabled.  If you combine the list of samaccountname and in the second column specify 0 for an account you want to enable and 2 for an account you want to disable.  Pasting these columns into Input Mode and set the Filter field the same as with the previous example but setting the Attribute field to UserAccountControl=|2:##input2, this will update all the accounts in one operation.

Single Update – is the default when the Update mode is selected, this causes all the required updates to be performed as a single update when the query is run.  The disadvantage to using single update is if you update multiple attributes at once and one of the updates fails i.e. due to a schema restriction, the resulting error message which is reported is against the first attribute that is displayed and not the attribute that caused the update to fail.  By deselected Single Update option, each update is performed separately and if that update fails the error message is display against the attribute that failed to update.
Search
Added option to context menu to select which attributes are displayed
Schema Browser
Added an extra column to show if the Attribute is available in the GC
Schema History
Updated to include Exchange 2016 RTM, Windows 2016TP3
Schema Version
Updated to include Exchange 2013 CU1/2/3/4/5/6/7 & SP1, 2016, and Windows 2016TP3
User Groups
Update output to include security principal SID

C\C++ Escape Characters:

\a         07        Alarm (Beep, Bell)
\b         08        Backspace
\f          0C        Formfeed
\n         0A        Newline (Line Feed); see notes below
\r          0D       Carriage Return
\t          09        Horizontal Tab
\v         0B        Vertical Tab
\\          5C       Backslash
\'          27        Single quotation mark
\"          22        Double quotation mark
\?         3F         Question mark
\hh       any       The character whose numerical value is given by hh interpreted as a hexadecimal number

Changes in 1.20
Attribute Replication  ** New **
The ability to check the value of attributes of an object across all domain controllers in the specified name context.  Also ideal for checking the value of non-replicated attributes.
Replication Queue  ** New **
Displays the replication queue on the specified domain controller.
Domain Tree ** New **
Displays the domains in a forest and the domain controllers in each domain.  Supports forests with non-contiguous namespaces.
LDAP Search
Filter field now performs validation of the entered filter, if the entered filter is incorrect the field background will turn red.  The filter validation is only available after the populate list button at the end of the server name field has been pressed. 

Updated Dynamic attributes to include additional attributes to support column sorting across a wide range of attributes in Table view.  Note: the download of the additional attributes can impact the time taken to complete queues, this option can be turned off by unselecting the Sort Attributes options.
Added option to select if the Attribute tag is displayed or not in the output pane
Added SID_ABS decodetype provides absolute resolution of SID to the source domain.
Fixed bug in the LDAP Connection options where int options are not set correctly.
Fixed bug in Dynamic Attribute hash table.
Updated DS behavior type to include Windows 2012R2.
Added decode for msDS-Behavior-Version.
Changed DNSProperty decode type to Binary due to unknown data formats in the attribute.
           LDAP Browser
Updated so the double click Attribute dialog works when secure control are selected (Delete or Recycle Bin).
Added check button to limit the left hand pane to limit the display to container objects.
Schema History
Updated to support the following schema changes:
Exchange 2013 RTM, CU1, CU2, CU3, SP1, CU5, CU6, CU7
Site Browser
Updated upstream and downstream replication partners view to include AD site of the DC.
Updated to include validate function on the servers view to test servers are available.
Last Logon
Updated to support Windows 7/8/2008/2012 logon events.
Updated to support unlock and new credential logon types.
Updated to display more event details.
The list of DCs is limited to the DCs in the same domain context as the user.
Locked Accounts
Updated view to include samaccountname and DN.
Updated context allow Last Logon for selected item.
User Details or Search
Renamed option to Search to better reflect its function.
Updated with column sort.
Updated logic around the GC selection in case of DNS issues.
Updated GC find logic to support both domain and server resolution.
Updated context Use With menu to include Attribute Replication.
DC Resolution
Added option to limit the DC returned to the DC in the same domain context as the specified server.
Updated so if the dnsHostName entry is not found for the name, the name is used.  This is to allow port scanning of devices that are not DCs and not IP addresses.
Updated to allow user specified ICMP time out.
Updated to allow user specified IP TTL on port scans.
WINS Lookup
Improved text entry logic so previous commands can be entered again by pressing enter on the previous command.
General
Updated error reporting on the AD Properties dialog.
Updated a number of internal functions to use LDAP APIs instead of the slower ADSI APIs.

DecodeType list:
    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary list
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_ABS - Display the absolute name of the SID
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Changes in 1.19.8
Meta Data Dialog
Added column sort
DsGetDcName
Added option for DS Version 8 
LDAP Search
Defined LastSetTime, PriorSetTime, msDS-UserPasswordExpiryTimeComputed as 64TIME
Bug fix - Updated favorites list so schemaupdates is not displayed
Bug fix - DecodeType debug string now works for all DecodeTypes
            LDAP Browser
Added Meta Data option to the context menu
Fixed bug where user defined decodes were not honoured
Schema Version
                        Updated to support Windows 2012R2 forest and domain versions
            Schema History
                        Updated to support the following schema changes:
Cisco Unity 4
Cisco Unity Contact Center
Cisco Call Manager
Solgenia Facsys Fax/Routing Suite
Server For Unix
Server For Unix v3.0
Exchange Unified Messaging
Exchange 2010SP1
Quest ActiveRoles
DC Resolution 
Removed the dependency on a domain lookup to allow Port scans on IP addresses for machines that are not a DC
            User Details
Added option to use GC for foreign object that are not in the default NC of the selected domain controller, this is to help performance when accessing objects in domains that might not be in the same site. The GC will be used for all dialogs. The AD Properties dialog will be display a warning when a GC is being used as group members is not consistent when using a GC
Updated to include scope option when the GC is used, this allows the scope to be limited to a particular NC or to overcome search issues when the forest has a non-contiguous name space
Added option to manage groups from context menu.
            Token Size
Updated to include a base DN option to allow a specific DN to be searched, if blank it will search the default DN of the selected domain controller

DecodeTypes
    DEFAULT - ASCII
    64DATE - Win32 64bit Date Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    ATTRIBENUM - predefined enumerate
    ATTRIBENUM_NONUM - predefined enumerate only symbolics are displayed
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    BIN - Binary list
    CERT - Certificates
    COUNT - Returns the number of entries in the attribute
    CRL - Certificate Revocation List
    DNSPROPERTY - DNS Properties entries
    DNSRECORD - DNS entries
    DNSRECORD.DATA - return only the data field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DSA_SIG - DSA Signature
    FILETIME - Win32 File Date & Time Format
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    GUID - Windows COM GUID format
    GUID_LDAP - GUID in LDAP filter format
    GUID_RAW - Hex GUID format
    HEX - Display a number if Hex format
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    PARENTDN - Returns the parent container of the distinguishedName
    PERIOD - Certificate renewal period
    PSMTP - Display primary smtp entry
    PWDSEC - Password secounds
    PX400 - Display primary  x400 entry
    PX500 - Display primary x500 entry
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    RIDPOOL - RID Pool Allocations
    SD - Security Descriptor in SDDL format
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SID - Display Security Identifier in text form
    SID_REL - Display the relative name of the SID
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    SIZE - The size of the data returned
    SMTP - Display only smtp entries
    TRANSPORT_OPT - Returns the options for the Options of transport container
    X400 - Display only x400 entries
    X500 - Display only x500 entries

Changes in 1.19
LDAP Performance
Added support for SSL LDAP connections
LDAP Search
Attribute DecodeType Manager – the ability to manage the DecodeType assigned to attributes.  There is a new button at the end of the Attribute field to open the DecodeType manager  ** New **
Added HEX DecodeType **New **
Added GUID_RAW DecodeType ** New **
Added GUID_LDAP DecodeType ** New **
Added ParentDN DecodeType  which returns the parent DN from the DistinguishedName attribute, only CN and OU parents are currently supported ** New **
Updated certificate verification options:
Verify Certs       Display Results              Behavior
Not selected      N\A                               No verification is performed, a certificate with errors will be accepted and the search performed
Selected            Not Selected                  The Microsoft standard certificate verification is performed, this normally doesn’t include 
a revocation test.  The search will only be performed if the certificate is valid.
Selected            Selected                        Extended verification process is used, this will verify the certificate and revocation for the full 
certificate chain and results will be displayed.  The search will only be completed if the whole 
certificate chain is valid.
Improved the column redraw speed in Table Input mode
DNS Record DecodeType updated to display the tombstone time and date for a deleted record
Added Regular expression filter to the display filter
<Attribute[;Type]> <Operator> <[Value][List Name]> [Logical Operator] [condition2] [Logical Operator] [condition3] [...]
     Operator           The comparison operator, supported operators are:
                   ==        Equal
                   !=         Not Equal
                   >=        Greater than or equal
                   <=        less than or equal
                   >          Greater than
                   <          Less than
                   ##        In list (exact match)
                   !#         Not in list (exact match)
                   %%      Contains item from list
                   !%        Does not contain item from list
                   Regx    Provide Regular Expression matching on the attribute

Example: name regx ^[sS][a-z]*

LDAP Browser
To increase the performance of browsing LDAP over an SSL connection and bypass certificate errors, updated not to perform any certificate verification testing on connecting
A new context menu to define the DecodeType for attributes ** New **
DCs in Sites
Updated so that resolution of the DC’s IP address is optional
User’s Groups
Updated to also display the group scope for each group

DecodeType list:
    DEFAULT - ASCII
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    FILETIME - Win32 File Date & Time Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    64DATE - Win32 64bit Date Format
    HEX - Display a number if Hex format
    PARENTDN - Returns the parent container of the distinguishedName
    GUID – Windows COM GUID format
    GUID_RAW – hex GUID format
    GUID_LDAP – returns the LDAP search filter format
    SID - Display Security Identifier in text form
    SID_REL - Display the relative name of the SID
    RIDPOOL - RID Pool Allocations
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    ATTRIBENUM - predefined enumerate
    DSA_SIG - DSA Signature
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    TRANSPORT_OPT - Returns the options for the Options of transport container
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    SD - Security Descriptor in SDDL format
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    BIN - Binary list
    SIZE - The size of the data returned
    COUNT - Returns the number of entries in the attribute
    DNSRECORD - DNS entries
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.DATA - return only the data field
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    DNSPROPERTY - DNS Properties entries
    CERT - Certificates
    CRL - Certificate Revocation List
    PWDSEC - Password secounds
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    PERIOD - Certificate renewal period
    SMTP - Display only smtp entries
    X400 - Display only x400 entries 
    X500 - Display only x500 entries 
    PSMTP - Display primary smtp entry
    PX400 - Display primary  x400 entry
    PX500 - Display primary x500 entry

Changes in 1.18.3

Mail Conflicts  **New**
A new test that is useful for diagnosing Quest DirSync 0xaa0000a7 errors.  The test will check if the mail addresses assigned to the source object already exists on objects in the target domain.  These conflicts stop Quest from merging\migrating mail enabled objects 
Mail Unique  **New**
A test to confirm that the mail details of an object are unique in the same forest.  Just paste a list of samaccountnames of objects and check Go.  Any duplicates will be displayed
DC Updates
Now has the option to limit which DC are display and monitored based on the domain context
Added current time from each DC to show if DCs are in time sync
LDAP Search
Added option to specify the number of items returned per page query
Added new UTC options for 64time, gtftime decodes
Added 64Date back as it disappeared for some reason
Filter help updated with the substitution options
Added Reset button to set the options to the default settings
Added decodes for msFVE-KeyPackage, msFVE-RecoveryGuid, and msFVE-VolumeGuid
Added decodes for proxyaddresses, these are more display filters than decodes types, only the specified entries are displayed. SMTP, X400, X500, By using the P options only the primary entry (upper case) is displayed PSMTP, PX500, PX400
LDAP Browser
Fixed bug in the user defined columns not being displayed correctly
Updated the context menu to support LDAP Search updates
LDAP Performance
Disabled referrals on one level search so sub domains don’t impact the test results
Added stop button 
Added option to purge Kerberos tickets between test to test the authentication process on each pass
AD Properties
Computer objects now includes the account logon details tab
User Details
Changed the context menu to include Use with, so search results can be piped to other tests in NetTools
General
Fixed bug in ini file read\write functions, so the ini file is only updated in the startup directory
Manage List ** New ** context menu option to manage dropdown lists

DecodeType list:
    DEFAULT - ASCII
    GTFTIME - Generalized Time Format, local time
    GTFTIME_UTC - Generalized Time Format, UTC
    FILETIME - Win32 File Date & Time Format
    64TIME - Win32 64bit Date & Time Format, local time
    64TIME_UTC - Win32 64bit Date & Time Format, UTC
    64DATE - Win32 64bit Date Format
    GUID - Windows GUID
    SID - Display Security Identifier in text form
    SID_REL - Display the relative name of the SID
    RIDPOOL - RID Pool Allocations
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    ATTRIBENUM - predefined enumerate
    DSA_SIG - DSA Signature
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    TRANSPORT_OPT - Returns the options for the Options of transport container
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    SD - Security Descriptor in SDDL format
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    BIN - Binary list
    SIZE - The size of the data returned
    COUNT - Returns the number of entries in the attribute
    DNSRECORD - DNS entries
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.DATA - return only the data field
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    DNSPROPERTY - DNS Properties entries
    CERT - Certificates
    CRL - Certificate Revocation List
    PWDSEC - Password secounds
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    PERIOD - Certificate renewal period
    SMTP - Display only smtp entries
    X400 - Display only x400 entries 
    X500 - Display only x500 entries 
    PSMTP - Display primary smtp entry
    PX400 - Display primary  x400 entry
    PX500 - Display primary x500 entry

Change in 1.17.4
            Schema History
Updated to support IBM Tivoli Storage Manager, Forefront TMG, HP Openview Configuration Manager
            Schema Browser
Updated to include AttributeID OID
Now uses paged queries to support larger schemas
            LDAP Browser
Updated to show the approximate number of objects in a container, if it is filtered 
            LDAP Search
                        Added decode for NTMixedDomain attribute
            Site DC List
Updated to use a separate thread to improve screen updates on slow WAN networks
            Replication Cursors
Updated to display the USN of the destination DC, with a delta to show how many updates are still waiting to be replicated

Changes in 1.17

RID Pool **New**
Displays the allocated RID for each domain controller in the selected domain
LDAP Search
Updated with new cleaner UI to allow larger viewable area 
Updates to increase attribute decode performance
Updated the filter substitution options on the LDAP filter field to support a hex option i.e. (&(objectclass=group)(grouptype|={hex:0x8000002}))
New DecodeType for RIDAllocationPool, RIDPreviousAllocationPool, RIDAvailablePool, 
New 64Date GTDATE decodes to return the date only
Fixed bug with 64TIME decoder
Updated Sort option to support multiple sort attributes.  While NetTools now supports multiple sort attributes, AD\LDS only supports a single sort attribute, if more than one attribute is specified a not supported control error is returned
Added timer to display how long the query has taken to execute
Certificate revocation updated to support Windows 2012 option and support for KB2661254, weak keys
Added support for connection to LDAP server using UDP (CLDAP) protocol. CLDAP only supports anonymous authentication type and must be set manually
Updated attribute help with the SID_REL decode which was missing
Updated to decode an object’s metadata details as an attributes:
     Meta.<Type>.<Attribute>
Type:    ver        Version number
            lusn      Local USN
            ousn     Originating USN
            time      Originating Time
            dc         Originating DC
Attribute: the name of the attribute
    e.g. meta.ver.objectclass, meta.ousn.cn
AD Browser
Updated to have three pane view, displays the tree structure, child objects of the selected object, and the attributes of the select object
Fixed intermittent issue that caused the browser to close the open LDAP server connection
Schema Versions
Schema History
Updated to support Windows 2012, Windows 2008R2 TPM, Exchange 2010 SP3, Exchange 2013, Lync 2013 and FIM 2010R2 PCNS
Attributes dialog 
Updated to support double click to display individual entries
AD Properties Dialog
Updated the included Password not required option
Fixed bug where Members tab was shown for all object types
SDProd
Updated to protect against circular group references, now has a hard coded limit of 100 nested groups

DecodeType List:
    DEFAULT - ASCII
    GTFTIME - Generalized Date & Time Format
    GTDATE - Generalized Date Format
    FILETIME - Win32 FileTime Format
    64TIME - Win32 64bit Date & Time Format
    64DATE - Win32 64bit Date Format 
    GUID - Windows GUID
    RIDPOOL – RID pool allocations
    SID - Security Identifier
    SID_REL - Displays the relative name for a Security Identifier
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    ATTRIBENUM - predefined enumerate
    DSA_SIG - DSA Signature
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    TRANSPORT_OPT - Returns the options for the Options of transport container
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    SD - Security Descriptor in SDDL format
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    BIN - Binary list
    SIZE - The size of the data returned
    COUNT - Returns the number of entries in the attribute
    DNSRECORD - DNS entries
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.DATA - return only the data field
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    DNSPROPERTY - DNS Properties entries
    CERT - Certificates
    CRL - Certificate Revocation List
    PWDSEC - Password secounds
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    PERIOD - Certificate renewal period

Changes in 1.16
AD Properties dialog
Updated to support copy option in all list fields
Double clicking on foreign security principals in member and memberof now opens the properties of that object
Added Mail nickname attribute to Exchange tab
Added account tab to computer objects
AD Subnets
Added paste option so multiple IP addresses can be resolved
DC Resolution
Fixed bug where the stop button was not displayed if an IP address is used for a manually entered server name.
Fixed bug in the port scan that prevented multiple copies of NetTools from doing scans
Group Members
Added status bar to display which group is currently being enumerated
Updated to resolve foreign security principals
Column sort
Now uses individual queries to resolve group membership a bit slow than ASQ but nested groups from trusted domains are displayed
LDAP Browser
Right pane will now display objects requiring additional server side LDAP controls, i.e. deleted objects
LDAP Search
Decodes updated with Windows Server 2012 details
Bit operator substitution updated to support multiple entries
Dropdown list fields now have auto save when up or down keys are pressed, just for those typo moments
Added decodes for Options attribute for the SiteLink, nTDSConnection, nTDSDSA, interSiteTransport, nTDSSiteSettings.  Due the same attribute name being used for all objects, the Options attribute will not be decoded by default.  However, if the attribute list contains the objectclass attribute before Options, the correct decode will be selected automatically.
DNSRECORD decode now has sub options to allow DNS record field decodes to be displayed
Bug fix – Input mode, Insert option now adds columns if no columns displayed
Bug fix – now displays correct output when single line and hex options are selected
Replication Latency
Fixed bug where the test wouldn’t finish if one or more servers fail
Site Browser
Updated to include Downstream replication partners
Updated to show automatically generated connectors
Updated to include Connection Options
User’s Groups
Added copy options
User Details
Added view Meta Data option to the context menu
General
Update left pane list so items are in alphabetic order for each section

DecodeType List:
    DEFAULT - ASCII
    GTFTIME - Generalized Time Format
    FILETIME - Win32 FileTime Format
    64TIME - Win32 64bit Time Format
    GUID - Windows GUID
    SID - Security Identifier
    IP - DWORD IP address in windows order
    IPN - DWORD IP address in network order
    ATTRIBENUM - predefined enumerate
    DSA_SIG - DSA Signature
    NTDS_DSA_OPT - Returns the options for the Options of NTDSDSA
    NTDS_CONN_OPT - Returns the options for the Options of NTDSConnection
    SITE_LINK_OPT - Returns the options for the Options of SiteLink
    TRANSPORT_OPT - Returns the options for the Options of transport container
    NTDSSSITE_OPT - Returns the options for the Options of NTDS Sites Settings
    REPL_UTDV - NC Up ToDateness Vectors
    REPS_INFO - Replication neighbours RepsTo and RepsFrom
    SD - Security Descriptor in SDDL format
    SD_SID - Returns the SID of all entries in the SD
    SD_SID_DACL - Returns the SID of the DACL entries in the SD
    SD_SID_SACL - Returns the SID of the SACL entries in the SD
    SD_SID_OWNER - Returns the SID of the Owner in the SD
    SD_NAME - Returns the resolved names of all the entries in the SD
    SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
    SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
    SD_NAME_OWNER - Returns the resolved name of the owner in the SD
    BIN - Binary list
    SIZE - The size of the data returned
    COUNT - Returns the number of entries in the attribute
    DNSRECORD - DNS entries
    DNSRECORD.TYPE - return only the type type field
    DNSRECORD.VERSION - return only the version field
    DNSRECORD.RANK - return only the rank field
    DNSRECORD.SERIAL - return only the serial field
    DNSRECORD.TTL - return only the ttl field
    DNSRECORD.TIMEOUT - return only the timeout field
    DNSRECORD.TIMESTAMP - return only the timestamp field
    DNSRECORD.DATA - return only the data field
    BEROID - Basic Encoding Rules (BER) Organization Identifier
    DNSPROPERTY - DNS Properties entries
    CERT - Certificates
    CRL - Certificate Revocation List
    PWDSEC - Password secounds
    MSTRUST - Decoder for msds-TrustForestTrustInfo
    PERIOD - Certificate renewal period

Changes in 1.15.5
            Group Manager
Disabled referrals on paste lookups to increase performance in multi-domain environments
Added report option to display if the pasted list is currently a member of the selected group
LDAP Search
Added REP_INFO DecodeType for RepTo and RepFrom attributes to show Replication Neighbors and replication status
Added REPL_UTDV DecodeType for the replUpToDateVector attribute, for Replication Up Todateness Vectors
Added support for UTF-8 encoding on the filter field escaping Unicode characters
Fixed memory leak
DC Resolution
Fixed debug in the Add Ports option where the first ports in the existing list was removed
General
Major code review tiding up variables and memory allocation reducing the overall memory footprint

            DecodeType list:
                        DEFAULT – ASCII
                        GTFTIME – Generalized Time Format
                        FILETIME – Win32 FileTime Format
                        64TIME – Win32 64bit Time Format
                        DSA_SIG – DSA Signature
                        GUID – Windows GUID
                        REP_INFO - RepTo and RepFrom replication neighbors
                        REPL_UTDV - Replication up to dateness vectors
                        SID – Security Identifier
                        IP – DWORD IP address in windows order
                        IPN – DWORD IP address in network order
                        ATTRIBENUM – predefined enumerate
                        SD – Security Descriptor in SDDL format
                        SD_SID - Returns the SID of all entries in the SD
                        SD_SID_DACL - Returns the SID of the DACL entries in the SD
                        SD_SID_SACL - Returns the SID of the SACL entries in the SD
                        SD_SID_OWNER - Returns the SID of the Owner in the SD
SD_NAME - Returns the resolved names of all the entries in the SD
SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
SD_NAME_OWNER - Returns the resolved name of the owner in the SD
                        BIN – Binary list
                        SIZE – The size of the data returned
                        COUNT – Returns the number of entries in the attribute
                        DNSRECORD – DNS entries
                        BEROID - Basic Encoding Rules (BER) Organization Identifier
                        DNSPROPERTY – DNS Properties entries
                        CERT - Certificates
                        CRL – Certificate Revocation List
                        PWDSEC – Password seconds
                        MSTRUST – Decoder for msds-TrustForestTrustInfo
                        PERIOD – Certificate renewal period

Changes in 1.15.0

            Site Browser **New**
Brings DNS site coverage, Site Links, Site Link Costs, IP Subnet allocation, and Naming Context coverage into a single view
Group Manager **New**
Bulk group membership management. Select the group, paste in the list of objects to add or remove to\from the group, select the objects and click Add or Remove.  The pasted list can be Distinguished Names, SIDs, or samaccountnames or any combination of them.  SID entries must be relative to the server\domain selected, to add objects from a foreign domain use DNs.
DSA GUID
Updated to support column sorts
LDAP Browser
Now has column sort
Filter button icon now changes when a user defined filter has been specified
            AD Properties
Updated to use the ObjectSID attribute rather than the name attribute to resolves names for foreign security principals 
            Last Logon
Updated to disable buttons while a search is run to stop multiple press of the go button which causes exception errors
Added LogonCount to output
            User Details
Updated to use DcGetDCName instead of using the ldap connection options to find a GC, as the ldap options are a little inconsistent and some time select a non-GC server
            SPN Search
Updated to use DcGetDCName instead of using the ldap connection options to find a GC, as the ldap options are a little inconsistent and some time select a non-GC server
            LDAP Search
Added help button for Decode Type options
Added help button for the Display Filter options
New DecodeType for the DSASignature attribute
New DecodeType GUID_RAW displays the GUID in hex in byte order.  GUID_LDAP displays the GUID in escaped hex format as used for LDAP binary search
Fixed bug in display filter logic, where if the last condition in a multiple And equation was a Not statement it returned the wrong value.
Updated Display filter to support a new comparison operator, if contains options to return attributes that contain an item in a list.

The full list of Comparison Operators
Operator           The comparison operator, supported operators are:
==        Equal
!=         Not Equal
>=        Greater than or equal
<=        less than or equal
>          Greater than
<          Less than
##        In list  (exact match)
!#         Not in list  (exact match)
%%      Contain an item in the list  **New**
!%        does not contain an item in the list **New**
            
Manage Lists
Fix bug where items were not removed correctly from the list (Thanks to Joe for reporting the issue)
            Schema Browser
Fixed intermittent issue where Schema definition dialog would be shown on the right hand pane
            Sites DC List
Updated GC logic so GC allocation is displayed correctly for single domain forests
User’s Groups
Updated to a list view to allow sorting
            General
I have been working on a number of other LDAP projects, which have resulted in performance and functional improvements in my base LDAP class.  These improves have been incorporated into NetTools.

DecodeType list:
DEFAULT – ASCII
GTFTIME – Generalized Time Format
FILETIME – Win32 FileTime Format
64TIME – Win32 64bit Time Format
DSA_SIG – DSA Signature
GUID – Windows GUID
SID – Security Identifier
IP – DWORD IP address in windows order
IPN – DWORD IP address in network order
ATTRIBENUM – predefined enumerate
SD – Security Descriptor in SDDL format
SD_SID - Returns the SID of all entries in the SD
SD_SID_DACL - Returns the SID of the DACL entries in the SD
SD_SID_SACL - Returns the SID of the SACL entries in the SD
SD_SID_OWNER - Returns the SID of the Owner in the SD
SD_NAME - Returns the resolved names of all the entries in the SD
SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
SD_NAME_OWNER - Returns the resolved name of the owner in the SD
BIN – Binary list
SIZE – The size of the data returned
COUNT – Returns the number of entries in the attribute
DNSRECORD – DNS entries
BEROID - Basic Encoding Rules (BER) Organization Identifier
DNSPROPERTY – DNS Properties entries
CERT - Certificates
CRL – Certificate Revocation List
PWDSEC – Password seconds
MSTRUST – Decoder for msds-TrustForestTrustInfo
PERIOD – Certificate renewal period

Changes in 1.14.4
            Site DC List
Updated to display FSMO roles and GC assignment
Context menu to configure LDAP Search
            DC Resolution
                        Updated to support FQDN server names
            AD Sites
Updated so the GC indictor displays the correct results
            LDAP Browser
Context menu bug fixed, so context menu displays attributes for the selected item
Treeview icon updated to indicate if the list is filtered by the maximum entries count

Changes in V1.14.1

            General
Updated Server and Domain fields with context menu and save options

Changes in V1.14

            Site DC List **New**
Displays the servers in each AD site and the domain name context each server hosts
Schema History **New**
Displays the updates that have been added to the schema with the date information and with attributes and classes added. NetTools includes a set of predefined schema updates covering common updates.  The list of schema updates can be extended in the NetTools.ini file.
[SchemaUpdates]
<ldapdisplayname> = <Schema update>
            WINS Lookup **New**
A WINS lookup client to query WINS servers
SID History bulk
Now works, finally managed to sort out the compatibility issues. Once you have completed the validation checks, you will need a semi-colon separated file of source and target samaccountnames
LDAP Search
New Decoder for Certificate Revocation List, displays the CRL entry count and valid date and next update date.
New Decoder for DWORD IP addresses, supports Windows (most significant order) and network order (least significant order) encoding, decodes for mSSMSRangedIPHigh and mSSMSRangedIPLow
Update DNSRecord decoder to include version, ranking, timestamp, and scavenging 
Inline filter substitution for IP addresses for Windows and Network order format,  Windows order: (ipaddress={ip:10.12.45.254})  Network order: (ipaddress={ipn:10.12.45.254})
Table view updated to honor the attribute order specified.
Input View updated to include Record Count option to return only the number of records returned by the query for that line
Logic updated so Input Mode is not selected when table view is disable but input mode is still selected.
First column name to updated when the Input mode is selected.
SecurityDescriptor decoder updated to fix intermittent decode issue  
SecuirtyDescriptor updated to include decode option to return individual entries of the security descriptor
            SD_SID                         Returns the SID of all entries in the SD
            SD_SID_DACL                Returns the SID of the DACL entries in the SD
            SD_SID_SACL                Returns the SID of the SACL entries in the SD
            SD_SID_OWNER             Returns the SID of the Owner in the SD
            SD_NAME                      Returns the resolved names of all the entries in the SD
            SD_NAME_DACL             Returns the resolved names of the DACL entries in the SD
            SD_NAME_SACL             Returns the resolved names of the SACL entries in the SD
            SD_NAME_OWNER         Returns the resolved name of the owner in the SD
Previous query history option added, records the last 10 queries performed
Count decoder added to return the number of entries per attribute
SID Decoder updated to support absolute and relative name resolution.
            SID_REL                        Returns the object name associated to the SID as return by the default API, if the SID is assigned via SID history the name of assigned object is returned not the name of the object from the foreign domain
            SID_ABS                        Returns the object name of the SID by first resolving the domain reference of the SID and then querying that domain for the name. 
Display Filter – This option provides a second level of filtering on the formatted results returned by the LDA server. This means that a filter can be created based on the decoded\formatted value of attributes for which a standard LDAP query can’t be constructed  If a display filter is specified only the returned entries that match the filter are displayed. The filter syntax is based on C\C++ formatting 
The display filter has the following format:
<Attribute[;Type]> <Operator> <[Value][List Name]> [Logical Operator] [condition2] [Logical Operator] [condition3] [...]
Attribute            The name of the attribute, the attribute must be included in the results returned by the query
Type                 The type operator is used to convert the returned value to a different data type before comparison.  By default NetTools converts all data returned into text, to perform comparison with other data type you must convert the data into the correct data type. The follow data types are supported:
Int        convert to an integer
Date      Convert to a date
Operator           The comparison operator, supported operators are:
==        Equal
!=         Not Equal
>=        Greater than or equal
<=        less than or equal
>          Greater than
<          Less than
##        In list
!#         Not in list
Value                The value that is be compared against. Wildcard are allowed for string comparisons, tuple queries are supported.  
List Name          The name of the list in the Member List tab to used with the ## and !# operators
Logical Operator The logic used to evaluate multiple conditions
&&        And comparison
||         Or comparison
Examples: 
name == gary* && age;int >= 21
description == *room*
whencreated;date > 14/1/11
name ## List1
Limitation: Using the display filter with a list with a large number of members can seriously impact the speed and performance of searches.  The condition logic doesn’t support nested conditions, I’ll try add this functionality in a later version.
Manage Lists
This option is used in conjunction with the LDAP search display filter.  Up to 20 lists can be loaded and referenced in the display filter
            LDAP Browser
Now has a filter option for the right pane to limit which items are displayed
Updated to support names that contain special characters  i.e. , / \ .
Updated with context menu option to copy entries to LDAP Search fields
Attributes Dialog
Updated with context menu options to copy selected entries to LDAP Search fields
DC Resolution
Removed the restriction that manually added servers must be a domain controller, any server that can be resolved in DNS can be port scanned
AD Properties Dialog
Updated so general page is displayed first for computer objects
Members and MemberOf updated to replace ASQ with direct queries to support GC and security principals in child and foreign domains.
Primary group details now added to the members group list  
User Details
Fixed intermittent search results when using GC
Property Set Search
Fixed bug introduced in a previous version where the property set name wasn’t displayed but I only just noticed it!!

DecodeType list:
DEFAULT – ASCII
GTFTIME – Generalized Time Format
FILETIME – Win32 FileTime Format
64TIME – Win32 64bit Time Format
GUID – Windows GUID
SID – Security Identifier
IP – DWORD IP address in windows order
IPN – DWORD IP address in network order
ATTRIBENUM – predefined enumerate
SD – Security Descriptor in SDDL format
SD_SID - Returns the SID of all entries in the SD
SD_SID_DACL - Returns the SID of the DACL entries in the SD
SD_SID_SACL - Returns the SID of the SACL entries in the SD
SD_SID_OWNER - Returns the SID of the Owner in the SD
SD_NAME - Returns the resolved names of all the entries in the SD
SD_NAME_DACL - Returns the resolved names of the DACL entries in the SD
SD_NAME_SACL - Returns the resolved names of the SACL entries in the SD
SD_NAME_OWNER - Returns the resolved name of the owner in the SD
BIN – Binary list
SIZE – The size of the data returned
COUNT – Returns the number of entries in the attribute
DNSRECORD – DNS entries
BEROID - Basic Encoding Rules (BER) Organization Identifier
DNSPROPERTY – DNS Properties entries
CERT - Certificates
CRL – Certificate Revocation List
PWDSEC – Password seconds
MSTRUST – Decoder for msds-TrustForestTrustInfo
PERIOD – Certificate renewal period

Changes in V1.13.2
            
            DC Update **New**
Displays the number of Directory updates performed on a Domain Controller or AD LDS in the user specified interval
            Token Size **New**
Shows the number of SIDs that are associated to objects, in the case of user and computer objects this is the number of SIDs that will be added to the access token.  For Groups this is the number of SIDs that will be added to an objects access token when they are added to the group.  The size is for reference only, this is the size of the data returned by TokenGroups attribute for the corresponding object, while it can be used as an indication of the resulting token size it is not exact, see the MS article for the formula for calculating the token size (I may add this as an option in future versions).
Background: Windows has a maximum buffer size for an access token which varies in size between different versions of Windows, see: http://support.microsoft.com/kb/327825.  While you can increase the size of the token supported by the OS, there is no way to increase the maximum size supported by IIS.  100+ groups the user may experience intermittent access to resources, over 300 IIS\Sharepoint issues, over 1015 and the user will not be able to logon.  The use of SID History for migration or consolidations only makes the token size issue worse.  This is quite a good white paper on the issue http://www.giac.org/paper/gsec/5111/kerberos-access-token-limitations/104962 
            LDAP Search
Note: The attribute separation character has changed from a semicolon to a comma. The use of semicolon was starting to compromise the quality of the code and the ability to add new functionality as semicolon is already used by the Microsoft implementation of LDAP for attribute ranges and binary options. NetTools will automatic convert existing saved Favorites to the new format  
Added import and export options for Favorites to allow sharing of pre-defined searches
Update inline substitution function to support multiple instances of the same ## variable in the same field.
New Decodes for sdRightsEffective, msDS-User-Account-Control-Computed
New Decoder type SIZE, this will display the size of the data returned by LDAP directory. Note: that the size returned is not necessarily the size of the data store in the directory. 
Updated Search Stats to support all Windows 2008R2 search stats
Ability to specify the decoder per attribute in the Attributes textbox, <attribute>;<DecodeType> i.e. whenchanged;default  or lastlogontimestamp;binary The same DecodeType names are used in the nettools.ini attributes listed below, note BINARY has changed to BIN

DecodeType list:
            DEFAULT – ASCII
            GTFTIME – Generalized Time Format
            FILETIME – Win32 FileTime Format
            64TIME – Win32 64bit Time Format
            GUID – Windows GUID
            SID – Security Identifier
            ATTRIBENUM – predefined enumerate
            SD – Security Descriptor
            BIN – Binary list
SIZE – The size of the data returned
            DNSRECORD – DNS entries
            BEROID - Basic Encoding Rules (BER) Organization Identifier
            DNSPROPERTY – DNS Properties entries
            CERT - Certificates
            PWDSEC – Password secounds
            MSTRUST – Decoder for msds-TrustForestTrustInfo
            PERIOD – Certificate renewal period

            AD Properties dialog
Updated to support foreign security principals
            Object Meta Data
Update to include both Attribute and Value replication data
LDAP Browser
                        Fixed memory leak
            Base64
Added Context menu option to generate a new random GUID
SPN Search 
Updated to support different host searches
User Details
Updated to include GC searches
            User’s Groups
Rewrite to use LDAP API instead of ADSI to increase performance and provide better support for AD LDS instances
            General 
A number of user interface updates to improve performance on list refreshes

Changes in v1.12.7
            
            Schema Version 
Updated to include Exchange domain version

Change in V1.12.6

            Schema Version **New**
Displays the forest, domain, schema, Exchange, OCS, and User, group and computer attribute counts
            DC Resolution
Removed domain suffix option, it now uses the dnsHostName entry of the server from the AD
                        Editable list of ports scanned
            Group Members
Ability to select naming context if RootDSE doesn’t have DefaultNamingContext set i.e. ADAM\DS LDS 
            Version update checking **New**
Now includes automatic version checking and download option
            LDAP Search
Decodes for aelita-amm-extension1, aelita-amm-extension2, aelita-amm-extension3, aelita-amm-extension4, aelita-amm-extension5, aelita-amm-extension6
                        LDAP Browser option added to tableview context menu

Changes in V1.12:

                LDAP Search
New Decodes for – LCS 2003, OCS2005, Lync 2010 (including: msrtcsip-archivingenabled, msrtcsip-archivingserverversion, msrtcsip-enablefederation, msrtcsip-meetingflags, msrtcsip-optionflags, msrtcsip-poolfunctionality, msrtcsip-pooltype, msrtcsip-poolversion, msrtcsip-serverversion, msrtcsip-sourceobjecttype, msrtcsip-trustedserverversion, msrtcsip-ucflags, msrtcsip-archivedefaultflags),  
New Decodes for – trustdirection, domainFunctionality, forestFunctionality, trustattributes, trusttype, msds-TrustForestTrustInfo
New Decodes for – caCertificate, mspkidefaultkeyspec, mspki-enrollment-flag, flags, mspki-certificate-name-flag, mspki-private-key-flag, pkikeyusage, pKIExpirationPeriod, pKIOverlapPeriod
New Decoders – FILETIME, TrustForestInfo, and Certificate renewal period attributes
Certificate decoder updated to include start and end date
Inline filter substitution for Generalized Time Format (GTF) and 64bit Time i.e. (whencreated={zdate:30/12/2011}) or (lastlogontimestamp={idate:31/12/2011 })
                “Now” constant can be used with zdate\idate inline filter substitutions, with optional plus and minus days.  i.e. {zdate:now}, {zdate:now-365}, {idate:now+5}
Fixed column sort bug in table view
Fixed ‘1.1’ attribute column bug in table view
Fixed display issue when displaying  ;binary attributes
Added Object Properties dialog option to context menus
Object Properties dialog – Added meta data view option
Attribute dialog – added Schema definition option to context menu
Updated context menus to be enabled based on selection
Added extra error handling for attributes with odd values!
Fixed continuous loop bug for attributes that returns no values
LDAP Browser 
Added user definable columns
Fixed binary view
Fixed performance issue introduced on 1.11
Schema Class Browser 
Added Inherited classes option – selects if inherited classes are displayed
Double click option on attributes to follow classes
Added WhenCreated column
Added Column sorts
Added Copy and Attribute options
Icons for different class types
Server Info **New**
Displays the info from NetServerGetInfo with 100, 101 and 102 information structures
Last Logon
Added domain suffix option to allow searches in different forests\domains
Group Members **New **
Displays the members of a group and the members of all nested groups in the target group
User Details
Changed query to a paged search so return count is not limited by the MaxPagedSize
Ability to select naming context if RootDSE doesn’t have DefaultNamingContext set i.e. ADAM\DS LDS
Added save option to the server inputbox
LDAP Performance
Fixed the bug in the averaging results
Added screen refresh to support tests cycles over 50 tests
AD Attributes dialog
Added right click option to display enumerate values
Base64 **New**
Ability to convert text, GUID and hex to Base64 and via versa
Nettools+.ini 
Updated the add configuration file logic to only add options that don’t already exist in the current configuration file.  Sample configuration file included the zip covering the different configuration file options
General
Added Ctrl+A select all options and key shortcuts for copying to all tables and lists
Full list of supported dynamic override decode in the configuration file (nettools.ini):
[AttributeDecodes]
<attributename>=<DecodeType>

DecodeType list:
            DEFAULT – ASCII
            GTFTIME – Generalized Time Format
            FILETIME – Win32 FileTime Format
            64TIME – Win32 64bit Time Format
            GUID – Windows GUID
            SID – Security Identifier
            ATTRIBENUM – predefined enumerate
            SD – Security Descriptor
            BINARY – Binary list
            DNSRECORD – DNS entries
            BEROID - Basic Encoding Rules (BER) Organization Identifier
            DNSPROPERTY – DNS Properties entries
            CERT - Certificates
            PWDSEC – Password secounds
            MSTRUST – Decoder for msds-TrustForestTrustInfo
            PERIOD – Certificate renewal period
                Configuration file with sample LDAP queries
                                FSMO roles – PDC, Domain, Infrastructure, RID, Schema
                                Schema Versions – AD, Exchange, OCS
                                Users - active, inactive and disabled
                                AD details, trusts, rootdse, tombstone, sites, GC, IP subnets
Know Issues
Bulk SID history – compatibility issues with the link library means that it only works on Windows 7, trying to find a solution for XP that doesn’t require two separate versions.                      

Changes in V1.11 version:

SPN - Rewrite of the SPN search feature to use the Global Catalog, now uses LDAP API set instead of ADSI APIs for increased performance.
Kerberos Tickets – added feature to request a ticket for a registered SPN.  Can be used to test that the AD is configured correctly for a given SPN
Schema Class Browser – Option to view AD properties of the Attributes
LDAP Search 
New LDAP Session options feature to allow complete control over the LDAP session, and display return Session options from a search
New decodes for – dnsrecord, dnsproperty, omobjectclass, msDS-MaximumPasswordAge, msDS-MinimumPasswordAge, msDS-LockoutObservationWindow, msDS-LockoutDuration, userCertificate, userSMIMECertificate, attributeCertificateAttribute for certificates it displays the subject name, or SAN, or UPN whichever is set
Dynamic Attributes updated to use a new Hashing algorithm for improved performance on attribute lookups
Improved reporting for LDAP Referrals
Improved support for non MS LDAP servers
Display multiple attributes one per line
Inline filter substitution for guid, sid and oid i.e. (omobjectclass={oid:1.3.12.2.1011.28.0.702}) or (objectisd={sid: S-1-5-21-3499964120-3315823391-1593708255-164234}) or (objectguid={guid:00AD5B16-8E22-49D5-B83A-BFDEA6DFF7DE})
Object Properties
Updated to report User Account Control settings
New members of and member list with more detail, with load on demand to improve display times
SPN and delegation details
Support for computer objects
User Rights – updated to display user privileges