ADCTL.exe
Summary
AD Control utility - Active Directory management or control process.
ADCTL.exe is the 543rd most commonly executed Windows program in EchoTrail's dataset, observed 9,814 times across enterprise environments. It typically runs from C:\Program Files\Realtek\Audio and it is most often launched by Lenovo.Modern.ImController.PluginHost.SettingsApp.exe.
Behavior
Top Paths
- C:\Program Files\Realtek\Audio100%
Top Hashes (SHA256)
- 026f985a787ac237a6e94250ec824c8c9d46c6d32e2b2124d5f88f962ba639f652.15%
- 92747f98e180c3335bd72047e7928f8ac9a1f9cc09a5790cb9a62893dfbce59822.59%
- f2f0de598b9e3235fc35dd0f8b012881e4058bb897637550c35a72626af73be820.42%
- 35a8bcf6609dd1e37f956c3ff3aa1eaea255f4efb32378e5ce912c5d37ed983c2.39%
- adf95dc4fa91fa560957408db5b96f1485b0f477013073532b7a00776c920b8b1.6%
- f0081335e9f6039c75438f4cf4b8783fa932e9fd8b06bfce7ac0c782fba8833b0.82%
- 9d107dd668b6deb62d68d6ec6ff65c0d29226ea21b75463d5f2da1037bc303a00.03%
Process Ancestry
Top Grandparents
- services.exe8.87%
- explorer.exe5.47%
Top Parents
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about ADCTL.exe
Rocky answers questions about ADCTL.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.