Active Directory enumeration maps domain users, groups, trusts, ACLs, and exposed services to identify misconfigurations and privilege escalation paths. The commands below are meant for authorized assessments, lab environments, and defensive validation.
Initial Reconnaissance
Identify the domain namespace and reachable domain controllers:
1
2
3
| nslookup
nslookup domain.local
nslookup -type=SRV _ldap._tcp.dc._msdcs.domain.local
|
net view /domain
Basic Enumeration with Domain Credentials
When domain credentials are available, built-in Windows utilities show domain accounts, privileged groups, and local administrators:
net user /domain
net group "Domain Users" /domain
net group "Domain Admins" /domain
net localgroup
net localgroup administrators
PowerShell Enumeration
Query domain objects using the Active Directory PowerShell module:
1
2
| Get-ADUser -Filter * -Properties SamAccountName, Name, Enabled |
Format-Table Name, SamAccountName, Enabled
|
1
2
3
4
| Get-ADGroup -Filter * | ForEach-Object {
$_.Name
Get-ADGroupMember -Identity $_.DistinguishedName | Select-Object Name, ObjectClass
}
|
1
| Get-ADComputer -Filter * | Select-Object Name, IPv4Address
|
BloodHound and LDAP Queries
Collect Active Directory object relationships for attack-path graphing with BloodHound:
1
| Invoke-BloodHound -CollectionMethod All -ZipFileName data.zip
|
Query LDAP directly from Linux:
1
| ldapsearch -x -H ldap://dc.domain.local -D "user@domain.local" -w 'Password123' -b "dc=domain,dc=local"
|
| Tool | Purpose |
|---|
enum4linux | SMB and NetBIOS user/group enumeration |
crackmapexec smb | SMB and AD validation workflows |
rpcclient | Domain queries and RID enumeration |
impacket-GetADUsers | AD user retrieval via Impacket |
impacket-GetNPUsers | Identifying accounts without Kerberos pre-authentication |
ldapdomaindump | Exporting LDAP domain structure |
RID Cycling and SMB Shares
RID cycling via unauthenticated RPC (when misconfigured):
1
2
| rpcclient -U "" <DC-IP>
> enumdomusers
|
Enumerate SMB shares from Windows or Linux:
net view \\<target>
net share
1
| smbclient -L //<target> -U "user"
|
Group Policy and PowerView
Inspect Group Policy Objects and password policy:
1
2
3
| Get-GPO -All
Get-GPResultantSetOfPolicy -ReportType Html -Path report.html
net accounts
|
Check delegation settings, trusts, and ACLs with PowerView:
1
2
3
4
| Get-DomainUser -Identity "targetuser"
Get-DomainGroupMember -Identity "Domain Admins"
Get-DomainTrust
Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | fl
|
Defensive Controls
Regularly audit AD exposure with tiered administration, least-privilege group memberships, restricted anonymous RPC/SMB access, and SIEM alerting on bulk LDAP and BloodHound-style queries.