docs/collect-data/enterprise-collection/least-privileged-collection.mdx (2)

26-29: Use “Distinguished Name (DN)” in prose.

Improve readability by spacing “DistinguishedName.”

-* Domain NC Deleted Objects DistinguishedName (DN): `CN=Deleted Objects,<Domain DN>`
-* Configuration NC Deleted Objects DistinguishedName (DN): `CN=Deleted Objects,CN=Configuration,<Forest root domain DN>`
+* Domain NC Deleted Objects Distinguished Name (DN): `CN=Deleted Objects,<Domain DN>`
+* Configuration NC Deleted Objects Distinguished Name (DN): `CN=Deleted Objects,CN=Configuration,<forest root domain DN>`

---

89-94: Call out Remote Registry service requirement.

Readers may miss that exceptions only work if the Remote Registry service is running.

 By default, only Administrators may read the registry remotely. There are two methods to delegate remote registry access for least-privileged collection:
+
+<Note>The Remote Registry service must be running on target hosts for either method to work.</Note>

docs/collect-data/permissions.mdx (3)

17-25: Add NTLM Relay registry paths for discoverability.

Mention NTLM relay registry paths alongside DC/CA registry to align with least‑priv doc.

 * [Certificate Services](/collect-data/permissions#certificate-services)
 * [DC Registry](/collect-data/permissions#dc-registry)
 * [CA Registry](/collect-data/permissions#ca-registry)
+* [NTLM Relay Registry Paths](/collect-data/enterprise-collection/least-privileged-collection#ntlm-relay-registry-paths)

---

72-72: Tighten wording.

“prior to” → “before”.

-... edge, whereas prior to SharpHound Common v3, BloodHound made assumptions ...
+... edge, whereas before SharpHound Common v3, BloodHound made assumptions ...

---

145-145: Minor grammar.

Add article for clarity.

-... see [Least-Privileged Collection - CA Registry](/collect-data/enterprise-collection/least-privileged-collection#ca-registry) for explanation of why this is accessible.
+... see [Least‑Privileged Collection – CA Registry](/collect-data/enterprise-collection/least-privileged-collection#ca-registry) for an explanation of why this is accessible.

docs/resources/edges/execute-dcom.mdx (1)

55-55: MITRE mapping LGTM; consider adding TA0008 for consistency.

T1021.003 fits DCOM. Optionally add a tactic link to TA0008 in References to align with other edges.

docs/resources/edges/admin-to.mdx (1)

51-51: Use trailing slash for consistency.

Change to https://attack.mitre.org/tactics/TA0008/ to match other MITRE links’ style in the repo.

docs/resources/edges/has-session.mdx (1)

45-50: Standardize MITRE link formatting.

Add trailing slash to TA0006 to align with T1134 and other pages: https://attack.mitre.org/tactics/TA0006/

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: StephenHinck
PR: SpecterOps/bloodhound-docs#42
File: docs/install-data-collector/install-azurehound/system-requirements.mdx:70-73
Timestamp: 2025-08-08T15:57:55.743Z
Learning: For AzureHound docs (docs/install-data-collector/install-azurehound/system-requirements.mdx), prefer explicitly stating:
- Directory Reader must be permanently active (not PIM-eligible only).
- Microsoft Graph application permissions (Directory.Read.All, RoleManagement.Read.All) require admin consent.
- Azure Reader role phrasing: “on all Azure subscriptions, ideally assigned at the tenant root group (root management group) scope.”

docs/collect-data/enterprise-collection/privileged-collection.mdx (1)

30-30: Fix the permissions link path (404) and add the missing comma.

Everywhere else in the docs (including earlier in this file) the permissions page lives at /collect-data/permissions. Pointing this sentence at /docs/collect-data/permissions generates a 404 in production. While you’re here, add the comma after the introductory clause for readability.

-For details on what data types can be collected see [SharpHound Data Collection and Permissions](/docs/collect-data/permissions) and [Least-Privileged Collection in SharpHound](/collect-data/enterprise-collection/least-privileged-collection) for information on collecting this data via least-privilege access.
+For details on what data types can be collected, see [SharpHound Data Collection and Permissions](/collect-data/permissions) and [Least-Privileged Collection in SharpHound](/collect-data/enterprise-collection/least-privileged-collection) for information on collecting this data via least-privilege access.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: StephenHinck
PR: SpecterOps/bloodhound-docs#42
File: docs/install-data-collector/install-azurehound/system-requirements.mdx:70-73
Timestamp: 2025-08-08T15:57:55.743Z
Learning: For AzureHound docs (docs/install-data-collector/install-azurehound/system-requirements.mdx), prefer explicitly stating:
- Directory Reader must be permanently active (not PIM-eligible only).
- Microsoft Graph application permissions (Directory.Read.All, RoleManagement.Read.All) require admin consent.
- Azure Reader role phrasing: “on all Azure subscriptions, ideally assigned at the tenant root group (root management group) scope.”

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

docs/opengraph/best-practices.mdx (1)

61-61: Add the missing article before “API key”.

The sentence still reads “instead of API key.” Please update it to “instead of an API key” for correct grammar.

-        - You can use a [Bearer Token](/integrations/bloodhound-api/working-with-api#use-a-jwt-bearer-token) instead of API key as this script will typically run only once.
+        - You can use a [Bearer Token](/integrations/bloodhound-api/working-with-api#use-a-jwt-bearer-token) instead of an API key as this script will typically run only once.

docs/collect-data/permissions.mdx (1)

26-26: Prefer “visibility” and tighten wording.

Minor phrasing improvement for clarity.

-It is important to have as much visibility as possible, so collecting all data types is recommended. Local Group Memberships and Sessions are especially important as they enable understanding Attack Paths to individual systems based on non-centralized configurations, see [Why perform privileged collection in SharpHound](/collect-data/enterprise-collection/privileged-collection).
+It is important to have as much visibility as possible, so collecting all data types is recommended. Local Group Memberships and Sessions are especially important as they provide visibility into Attack Paths to individual systems based on non‑centralized configurations. See [Why perform privileged collection in SharpHound](/collect-data/enterprise-collection/privileged-collection).

docs/collect-data/enterprise-collection/privileged-collection.mdx (1)

30-30: Absolute link OK; hyphenate “least‑privileged” and add period.

Consistency and punctuation.

-For details on what data types can be collected see [SharpHound Data Collection and Permissions](/docs/collect-data/permissions). For information on collecting this data via least-privilege access see [Least-Privileged Collection in SharpHound](/collect-data/enterprise-collection/least-privileged-collection) 
+For details on what data types can be collected, see [SharpHound Data Collection and Permissions](/docs/collect-data/permissions). For information on collecting this data via least‑privileged access, see [Least‑Privileged Collection in SharpHound](/collect-data/enterprise-collection/least-privileged-collection).

docs/install-data-collector/install-sharphound/tiered-collector-strategy.mdx (1)

30-30: Pluralize “permission” and clarify either/or phrasing.

Use plural and make the options explicit.

-    * Each service account must have collection permission on all systems in the service account's tier - local `Administrators` group membership or [Least-Privileged Collection](/collect-data/enterprise-collection/least-privileged-collection) permissions.
+    * Each service account must have collection permissions on all systems in the service account's tier—either local `Administrators` group membership or the permissions described in [Least‑Privileged Collection](/collect-data/enterprise-collection/least-privileged-collection).

docs/collect-data/permissions.mdx (3)

29-29: Name the group precisely.

Use the proper group name and minor wording tweak.

-<Warning>The SharpHound collection service account does not require `Domain Admin` membership. While adding the account to local `Administrators` groups on domain computers will work, we recommend following the articles [Least-Privileged Collection](/collect-data/enterprise-collection/least-privileged-collection) and [SharpHound Enterprise Service Hardening](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening).</Warning>
+<Warning>The SharpHound collection service account does not require membership in `Domain Admins`. While adding the account to local `Administrators` groups on domain computers will work, we recommend following [Least‑Privileged Collection](/collect-data/enterprise-collection/least-privileged-collection) and [SharpHound Enterprise Service Hardening](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening).</Warning>

---

73-73: Split long sentence; add backticks; replace “prior to.”

Improves readability and consistency.

-User Rights Assignments (URAs) in Windows define what privileges and capabilities security principals have on a system, independent of group membership. Collecting User Rights Assignments allows BloodHound to accurately determine the [CanRDP](/resources/edges/can-rdp) edge, whereas prior to SharpHound Common v3, BloodHound made assumptions based solely on group membership—assuming that membership in the Remote Desktop Users group alone gives users the ability to RDP to a system. However, to successfully use Remote Desktop, a user needs **both** membership in the Remote Desktop Users group **and** the User Rights Assignment `SeRemoteInteractiveLogonRight`.
+User Rights Assignments (URAs) in Windows define what privileges and capabilities security principals have on a system, independent of group membership. Collecting User Rights Assignments allows BloodHound to accurately determine the [CanRDP](/resources/edges/can-rdp) edge. Before SharpHound Common v3, BloodHound assumed that membership in the `Remote Desktop Users` group alone gives users the ability to RDP to a system. In reality, a user needs both membership in `Remote Desktop Users` and the URA `SeRemoteInteractiveLogonRight`.

---

93-96: Punctuate bullets consistently.

End list items with periods for consistency.

-* On Windows Server operating systems, members of the local `Print Operators` group may also collect session data
-* Windows desktop operating systems do not have a local `Print Operators` group and require alternate approaches
+* On Windows Server operating systems, members of the local `Print Operators` group may also collect session data.
+* Windows desktop operating systems do not have a local `Print Operators` group and require alternate approaches.

docs/collect-data/enterprise-collection/privileged-collection.mdx (1)

7-7: Tighten list phrasing.

Use “such as” to introduce examples and remove awkward comma.

-Privileged collection allows BloodHound to analyze Attack Paths based on non-centralized configurations, the local groups, active sessions, registry, and user rights assignments configured on each domain-joined system in your environment.
+Privileged collection allows BloodHound to analyze Attack Paths based on non‑centralized configurations, such as local groups, active sessions, registry data, and user rights assignments configured on each domain‑joined system in your environment.

docs/collect-data/enterprise-collection/least-privileged-collection.mdx (4)

8-11: Fix grammar and add comma.

Tighten intro and recommendation phrasing.

-Privileged collection allows BloodHound to analyze Attack Paths based on non-centralized configurations using privileged administrative credentials, similar to performing a privileged vulnerability scan. Least-privileged collection accomplishes these goals without using default administrative privileges to perform the collection. With some additional configuration SharpHound can collect the local groups, active sessions, and registry keys without adding any SharpHound collection service accounts to Domain Admins.
+Privileged collection allows BloodHound to analyze Attack Paths based on non‑centralized configurations using privileged administrative credentials, similar to a privileged vulnerability scan. Least‑privileged collection accomplishes these goals without using default administrative privileges. With some additional configuration, SharpHound can collect local groups, active sessions, and registry keys without adding any SharpHound collection service accounts to `Domain Admins`.
-
-<Note>We also recommend to follow the article [SharpHound Enterprise Service Hardening](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening).</Note>
+<Note>We also recommend following [SharpHound Enterprise Service Hardening](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening).</Note>

---

37-38: Backtick well-known groups and clarify subject.

Use group names and backticks consistently.

-By default, on currently supported Windows operating systems, only `Administrators` on the device(s) being collected have this right on Windows clients and member servers.  For compatibility purposes, Everyone is granted this right on domain controllers by default.
+By default, on currently supported Windows operating systems, only members of the local `Administrators` group on the device(s) being collected have this right on Windows clients and member servers. For compatibility purposes, `Everyone` is granted this right on domain controllers by default.

---

89-94: Add article for “individual registry key” and minor clarity.

Grammar and consistency.

-1. **AllowedPaths / AllowedExactPaths exceptions**: Create exceptions using the GPO setting [Network access: Remotely accessible registry paths](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths) to allow `Authenticated Users` to connect to the Remote Registry named pipe at specific registry paths. Effective access is still governed by permissions on individual registry key.
+1. **AllowedPaths / AllowedExactPaths exceptions**: Create exceptions using the GPO setting [Network access: Remotely accessible registry paths](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths) to allow `Authenticated Users` to connect to the Remote Registry named pipe at specific registry paths. Effective access is still governed by permissions on the individual registry key.
 
-2. **Modify Remote Registry named pipe security descriptor**: Alternatively, modify the default security descriptor on the Remote Registry named pipe to grant explicit security principals read permissions to the entire registry. Effective access is still governed via permissions configured on individual registry key.
+2. **Modify Remote Registry named pipe security descriptor**: Alternatively, modify the default security descriptor on the Remote Registry named pipe to grant explicit security principals read permissions to the entire registry. Effective access is still governed by permissions configured on the individual registry key.

---

101-106: Tighten “as long as” clauses for DC/CA registry notes.

Shorten and clarify permission caveat.

-When the AD CS role is installed in Windows, the `HKLM\SYSTEM\CurrentControlSet\Services\CertSvc` registry path is automatically added to `HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths`. This creates a remote registry exception that allows `Authenticated Users` to query any keys and subkeys in this path, as long as they also are granted rights to read the key. Therefore, CA registry data is accessible to `Authenticated Users` by default when AD CS is installed.
+When the AD CS role is installed in Windows, the `HKLM\SYSTEM\CurrentControlSet\Services\CertSvc` registry path is automatically added to `HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths`. This creates a remote registry exception that allows `Authenticated Users` to query keys and subkeys in this path, provided they also have read permission on the registry key DACL. Therefore, CA registry data is accessible to `Authenticated Users` by default when AD CS is installed.
@@
-For domain controllers, you can create exceptions by adding the required DC registry paths to `HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPaths` using the GPO setting mentioned above. This will create an exception to the Remote Registry named pipe on the DC allowing `Authenticated Users` to read those exact key paths, as long as they also are granted permissions on the registry key DACL.
+For domain controllers, you can create exceptions by adding the required DC registry paths to `HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPaths` using the GPO setting mentioned above. This creates a Remote Registry exception allowing `Authenticated Users` to read those exact key paths, provided they also have read permission on the registry key DACL.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: StephenHinck
PR: SpecterOps/bloodhound-docs#42
File: docs/install-data-collector/install-azurehound/system-requirements.mdx:70-73
Timestamp: 2025-08-08T15:57:55.743Z
Learning: For AzureHound docs (docs/install-data-collector/install-azurehound/system-requirements.mdx), prefer explicitly stating:
- Directory Reader must be permanently active (not PIM-eligible only).
- Microsoft Graph application permissions (Directory.Read.All, RoleManagement.Read.All) require admin consent.
- Azure Reader role phrasing: “on all Azure subscriptions, ideally assigned at the tenant root group (root management group) scope.”

docs/collect-data/enterprise-collection/least-privileged-collection.mdx (1)

49-51: Fix API names and remove stray code‑fence (breaks MDX rendering).

Use correct Windows API capitalization; drop the trailing ```; normalize “user rights” casing.

-Only `Administrators` can perform the `LSAOpenPolicy` and `LSAEnumerateAccountsWithUserRights` function calls necessary to collect User Rights Assignments directly from a remote host. There is no known way around this limitation.
-
-Currently, not collecting User Rights Assignments may cause inaccurate CanRDP edges. In the future, SharpHound may collect additional User Rights to identify more attack paths```
+Only `Administrators` can perform the `LsaOpenPolicy` and `LsaEnumerateAccountsWithUserRights` function calls necessary to collect user rights assignments directly from a remote host. There is no known way around this limitation.
+
+Currently, not collecting user rights assignments may cause inaccurate CanRDP edges. In the future, SharpHound may collect additional user rights to identify more attack paths.

docs/collect-data/enterprise-collection/privileged-collection.mdx (2)

7-7: Tighten list phrasing for clarity.

Use a colon and remove the extra article.

-Privileged collection allows BloodHound to analyze Attack Paths based on non-centralized configurations, the local groups, active sessions, registry, and user rights assignments configured on each domain-joined system in your environment.
+Privileged collection allows BloodHound to analyze Attack Paths based on non‑centralized configurations: local groups, active sessions, registry, and user rights assignments configured on each domain‑joined system.

---

30-30: Use “least‑privileged” (adjectival form).

Hyphenation consistency across docs.

-... for information on collecting this data via least-privilege access.
+... for information on collecting this data via least‑privileged access.

docs/collect-data/enterprise-collection/least-privileged-collection.mdx (7)

8-8: Minor grammar polish.

-... With some additional configuration SharpHound can collect the local groups, active sessions, and registry keys ...
+... With some additional configuration, SharpHound can collect local groups, active sessions, and registry keys ...

---

10-10: Fix verb form.

-<Note>We also recommend to follow the article [SharpHound Enterprise Service Hardening](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening).</Note>
+<Note>We also recommend following the article [SharpHound Enterprise Service Hardening](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening).</Note>

---

22-23: Avoid comma splice.

Split into two sentences.

-SharpHound can read the content of the Deleted Objects container (also known as the AD Recycle Bin). Collecting deleted objects affects data retention behavior in BloodHound Enterprise, see [Active Directory Recycle Bin](/collect-data/enterprise-collection/data-retention#active-directory-recycle-bin) for details on how this impacts retention periods.
+SharpHound can read the content of the Deleted Objects container (also known as the AD Recycle Bin). Collecting deleted objects affects data retention behavior in BloodHound Enterprise. See [Active Directory Recycle Bin](/collect-data/enterprise-collection/data-retention#active-directory-recycle-bin) for details on how this impacts retention periods.

---

37-38: Consistent code formatting for well‑known groups; tighten wording.

-By default, on currently supported Windows operating systems, only `Administrators` on the device(s) being collected have this right on Windows clients and member servers.  For compatibility purposes, Everyone is granted this right on domain controllers by default.
+By default, on currently supported Windows operating systems, only `Administrators` on the device(s) being collected have this right on Windows clients and member servers. For compatibility purposes, `Everyone` is granted this right on domain controllers.

---

75-75: Code‑format group name.

-... a service account that is a member of Domain Admins is strongly discouraged.
+... a service account that is a member of `Domain Admins` is strongly discouraged.

---

105-105: Clarify DACL phrasing.

-... allowing `Authenticated Users` to read those exact key paths, as long as they also are granted permissions on the registry key DACL.
+... allowing `Authenticated Users` to read those exact key paths, provided they also have read permission on the key’s DACL.

---

109-109: Code‑format identifiers and group name.

-... add these specific paths to AllowedExactPaths. This grants Authenticated Users remote read access, ...
+... add these specific paths to `AllowedExactPaths`. This grants `Authenticated Users` remote read access, ...

docs/collect-data/permissions.mdx (4)

52-52: Avoid comma splice.

-... Enterprise, see [Active Directory Recycle Bin](/collect-data/enterprise-collection/data-retention#active-directory-recycle-bin) for details. ...
+... Enterprise. See [Active Directory Recycle Bin](/collect-data/enterprise-collection/data-retention#active-directory-recycle-bin) for details. ...

---

67-67: Be precise about required permission.

Use the group name and scope instead of “Administrator access.”

-**Default Permissions:** By default, computers beginning with Windows 10 version 1607 and Windows Server 2016 require Administrator access to perform Remote SAM operations.
+**Default Permissions:** By default, computers beginning with Windows 10 version 1607 and Windows Server 2016 require membership in the local `Administrators` group to perform Remote SAM operations.

---

73-73: Code‑format group name; optional readability split.

-... assuming that membership in the Remote Desktop Users group alone gives users the ability to RDP to a system. However, to successfully use Remote Desktop, a user needs **both** membership in the Remote Desktop Users group **and** the User Rights Assignment `SeRemoteInteractiveLogonRight`.
+... assuming that membership in the `Remote Desktop Users` group alone gives users the ability to RDP to a system. However, to successfully use Remote Desktop, a user needs **both** membership in the `Remote Desktop Users` group **and** the user rights assignment `SeRemoteInteractiveLogonRight`.

---

138-139: Small grammar tweak.

-    SharpHound checks if the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag is present, required to calculate ADCS ESC6 edges.
+    SharpHound checks if the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag is present, which is required to calculate ADCS ESC6 edges.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: StephenHinck
PR: SpecterOps/bloodhound-docs#42
File: docs/install-data-collector/install-azurehound/system-requirements.mdx:70-73
Timestamp: 2025-08-08T15:57:55.743Z
Learning: For AzureHound docs (docs/install-data-collector/install-azurehound/system-requirements.mdx), prefer explicitly stating:
- Directory Reader must be permanently active (not PIM-eligible only).
- Microsoft Graph application permissions (Directory.Read.All, RoleManagement.Read.All) require admin consent.
- Azure Reader role phrasing: “on all Azure subscriptions, ideally assigned at the tenant root group (root management group) scope.”

docs/collect-data/enterprise-collection/least-privileged-collection.mdx (1)

109-109: Add backticks around the security principal.

Elsewhere in the doc we format group names like Authenticated Users; please do the same here for consistency.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: StephenHinck
PR: SpecterOps/bloodhound-docs#42
File: docs/install-data-collector/install-azurehound/system-requirements.mdx:70-73
Timestamp: 2025-08-08T15:57:55.743Z
Learning: For AzureHound docs (docs/install-data-collector/install-azurehound/system-requirements.mdx), prefer explicitly stating:
- Directory Reader must be permanently active (not PIM-eligible only).
- Microsoft Graph application permissions (Directory.Read.All, RoleManagement.Read.All) require admin consent.
- Azure Reader role phrasing: “on all Azure subscriptions, ideally assigned at the tenant root group (root management group) scope.”

docs/collect-data/enterprise-collection/privileged-collection.mdx (2)

7-7: Tighten list phrasing and punctuation.

Use an em dash and remove the article before “local groups” for flow.

-Privileged collection allows BloodHound to analyze Attack Paths based on non-centralized configurations, the local groups, active sessions, registry, and user rights assignments configured on each domain-joined system in your environment.
+Privileged collection allows BloodHound to analyze Attack Paths based on non‑centralized configurations—the local groups, active sessions, registry, and user rights assignments configured on each domain‑joined system in your environment.

---

22-22: Fix subject/grammar and group name (“Administrators”).

Clarify the sentence and use the correct local group name.

-BloodHound Enterprise has identified that a computer at the bottom of the right Attack Path tree has `Authenticated Users` (all users and computers contained within the current domains, and all domains trusted by the current domain) added as a local `Administrator` to a system at the beginning of one Attack Path.
+BloodHound Enterprise has identified that a system at the beginning of the right‑hand Attack Path has `Authenticated Users` (all users and computers in the current domain and any trusted domains) added to the local `Administrators` group.

docs/collect-data/permissions.mdx (4)

26-27: Split the sentence; avoid comma splice.

Minor readability tweak.

-SpecterOps recommends collecting all data types because it provides maximum visibility into your environment. Local Group Memberships and Sessions are especially important, as they reveal Attack Paths to individual systems based on non-centralized configurations, see [Why perform privileged collection in SharpHound](/collect-data/enterprise-collection/privileged-collection).
+SpecterOps recommends collecting all data types because it provides maximum visibility into your environment. Local Group Memberships and Sessions are especially important, as they reveal Attack Paths to individual systems based on non‑centralized configurations. See [Why perform privileged collection in SharpHound](/collect-data/enterprise-collection/privileged-collection).

---

73-73: Consider splitting the long sentence.

Improve readability by breaking after the first em dash.

-User Rights Assignments (URAs) in Windows define what privileges and capabilities security principals have on a system, independent of group membership. Collecting User Rights Assignments allows BloodHound to accurately determine the [CanRDP](/resources/edges/can-rdp) edge. Before SharpHound Common v3, BloodHound made assumptions based solely on group membership—assuming that membership in the `Remote Desktop Users` group alone gives users the ability to RDP to a system. However, to successfully use Remote Desktop, a user needs **both** membership in the `Remote Desktop Users` group **and** the User Rights Assignment `SeRemoteInteractiveLogonRight`.
+User Rights Assignments (URAs) in Windows define what privileges and capabilities security principals have on a system, independent of group membership. Collecting URAs allows BloodHound to accurately determine the [CanRDP](/resources/edges/can-rdp) edge. Before SharpHound Common v3, BloodHound assumed that membership in the `Remote Desktop Users` group alone grants RDP access. However, to use Remote Desktop, a user needs **both** membership in `Remote Desktop Users` **and** the `SeRemoteInteractiveLogonRight` URA.

---

93-96: Punctuate list items for consistency.

End bullets with periods.

-* On Windows Server operating systems, members of the local `Print Operators` group may also collect session data
-* Windows desktop operating systems do not have a local `Print Operators` group and require alternate approaches
+* On Windows Server operating systems, members of the local `Print Operators` group may also collect session data.
+* Windows desktop operating systems do not have a local `Print Operators` group and require alternate approaches.

---

131-139: Minor clarity and style improvements.

Split long sentences and use “vice versa” for precision.

-* **Security**
-    Contains the security descriptor for the enterprise CA i.e. the permissions for Enroll, ManageCA, and ManageCertificates edges against the enterprise CA. This security descriptor is also stored in the AD object of the enterprise CA. SharpHound collects both. The CA registry security descriptor holds the effective permissions. Changes in the CA registry security descriptor are replicated to the AD copy, however, not the other way. Therefore, collecting the CA registry security descriptor may reveal permissions of the enterprise CA that are not present if only collecting the AD object.
+* **Security**
+    Contains the security descriptor for the enterprise CA—i.e., the permissions for Enroll, ManageCA, and ManageCertificates edges against the enterprise CA. This security descriptor is also stored in the AD object of the enterprise CA. SharpHound collects both. The CA registry security descriptor holds the effective permissions. Changes in the CA registry security descriptor are replicated to the AD copy; the reverse is not true. Therefore, collecting the CA registry security descriptor may reveal permissions that are not visible when only collecting the AD object.

docs/collect-data/enterprise-collection/least-privileged-collection.mdx (6)

22-30: Minor punctuation/style.

Use a semicolon before the reference for smoother flow.

-SharpHound can read the content of the Deleted Objects container (also known as the AD Recycle Bin). Collecting deleted objects affects data retention behavior in BloodHound Enterprise, see [Active Directory Recycle Bin](/collect-data/enterprise-collection/data-retention#active-directory-recycle-bin) for details on how this impacts retention periods.
+SharpHound can read the content of the Deleted Objects container (also known as the AD Recycle Bin). Collecting deleted objects affects data retention behavior in BloodHound Enterprise; see [Active Directory Recycle Bin](/collect-data/enterprise-collection/data-retention#active-directory-recycle-bin) for details on how this impacts retention periods.

---

55-58: Tighten OS terminology.

Prefer “Windows client operating systems” to “Windows desktop operating systems.”

-Unfortunately, this option does not exist on Windows desktop operating systems.
+Unfortunately, this option does not exist on Windows client operating systems.

---

59-59: Fix “builtin” spelling.

Use “built‑in”.

-...the local builtin [Print Operators]...
+...the local built‑in [Print Operators]...

---

89-94: Good structure; small wording tweak.

Make sentence parallel and modernize phrasing.

-By default, only `Administrators` may read the registry remotely. There are two methods to delegate remote registry access for least-privileged collection:
+By default, only `Administrators` may read the registry remotely. There are two ways to delegate remote registry access for least‑privileged collection:

---

101-101: Smooth phrasing.

Tighten clause.

-...as long as they also are granted rights to read the key.
+...as long as they also have read permission on the key.

---

105-106: Clarify DACL phrasing.

Simplify the trailing clause.

-...allowing `Authenticated Users` to read those exact key paths, as long as they also are granted permissions on the registry key DACL.
+...allowing `Authenticated Users` to read those exact key paths, provided the registry key’s DACL grants read permission.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: StephenHinck
PR: SpecterOps/bloodhound-docs#42
File: docs/install-data-collector/install-azurehound/system-requirements.mdx:70-73
Timestamp: 2025-08-08T15:57:55.743Z
Learning: For AzureHound docs (docs/install-data-collector/install-azurehound/system-requirements.mdx), prefer explicitly stating:
- Directory Reader must be permanently active (not PIM-eligible only).
- Microsoft Graph application permissions (Directory.Read.All, RoleManagement.Read.All) require admin consent.
- Azure Reader role phrasing: “on all Azure subscriptions, ideally assigned at the tenant root group (root management group) scope.”