> For the complete documentation index, see [llms.txt](https://security-notes.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security-notes.gitbook.io/security-notes/active-directory/enumeration.md).
# Enumeration
## Domain Information
{% tabs %}
{% tab title="PowerShell" %}
```powershell
$ADCLass = [System.DirectoryServices.ActiveDirectory.Domain];$ADClass::GetCurrentDomain();
Get-WmiObject -Namespace root\directory\ldap -Class ds_domain | select ds_dc, ds_distinguishedname, pscomputername
#get DC
Get-WmiObject -Namespace root\directory\ldap -Class ds_computer | where {$_.ds_useraccountcontrol -match 532480} | select ds_cn, ds_dnshostname, ds_operatingsystem
#get servers
Get-WmiObject -Namespace root\directory\ldap -Class ds_computer | where {$_.ds_useraccountcontrol -match 4096} | select ds_cn, ds_dnshostname, ds_operatingsystem
```
{% endtab %}
{% tab title="PowerView" %}
Get-NetDomain
Get-NetDomain -Domain <domain>
Get-DomainSID
Get-DomainPolicy
(Get-DomainPolicy)."system access"
(Get-DomainPolicy)."kerberos policy"
Get-NetDomainController
#Trust policies
Get-NetDomainTrust
Get-NetDomainTrust -Domain <domain>
#Forest
Get-NetForest
Get-NetForest -Forest <forest domain>
Get-NetForestDomain
Get-NetForestDomain -Forest <forest domain>
Get-NetForestCatalog
Get-NetForestCatalog -Forest <forest domain>
Get-NetForestTrust
Get-NetForestTrust -Forest <forest domain>
{% endtab %}
{% tab title="LDAP Module" %}
#Get-ADDomain
Get-ADDomain -Identity <domain>
(Get-ADDomain).DomainSid
Get-ADDomainController
#Trust policies
Get-ADTrust
Get-ADTrust -Identity <domain>
#Forest
Get-ADForest
Get-ADForest -Identity <forest domain>
(Get-ADForest).Domains
Get-ADForest | select -ExpandProperty GlobalCatalogs
Get-ADTrust -Filter 'msDS-TrustForestTrustInfo -ne "$null"'
{% endtab %}
{% endtabs %}
## Machines
{% tabs %}
{% tab title="PowerShell" %}
```powershell
Get-WmiObject -Namespace root\directory\ldap -Class ds_computer
```
{% endtab %}
{% tab title="PowerView" %}
```powershell
Get-NetComputer
Get-NetComputer -OperatingSystem "**"
Get-NetComputer -Ping
Get-NetComputer -FullData
```
Find shares and files
```powershell
Invoke-ShareFinder -Verbose
Invoke-FileFinder -Verbose //show files from readable shares
Get-NetFileServer
```
{% endtab %}
{% tab title="LDAP Module" %}
```powershell
Get-ADComputer -Filter * -Properties name | select name
Get-ADComputer -Filter 'OperatingSystem like "**"' -Properties * | select name.OperatingSystem
Get-ADComputer -Filter * -Properties DNSHostName | %{Test-Connection -Count 1 -ComputerName $_.DNSHostName}
Get-ADComputer -Filter * -Properties *
```
{% endtab %}
{% endtabs %}
## User Information
{% tabs %}
{% tab title="CMD" %}
```batch
net user /domain #list all
net user /domain #get info on the user
net accounts /domain #get info on the account policies
```
{% endtab %}
{% tab title="PowerShell" %}
```powershell
Get-WmiObject -Class win32_useraccount
Get-WmiObject -Class win32_useraccount | select name, domain, accounttype
```
List of machines where the current user is administrator
```powershell
$pcs = Get-WmiObject -Namespace root\directory\ldap -Class ds_computer | select -ExpandProperty ds_cn
foreach ($pc in $pcs) {
(Get-WmiObject -Class win32_computersystem -ComputerName $pc -ErrorAction silentlycontinue).name
}
```
{% endtab %}
{% tab title="PowerView" %}
```powershell
Get-NetUser
Get-NetUser -Username
Get-UserProperty #List of properties
Get-UserProperty -Properties #value of property values for all users
Get-UserProperty -Properties description #might contain credentials
```
Search a string in user properties
```powershell
Find-userField -SearchField -SearchTerm ""
```
Get logged users
```powershell
Get-NetLoggedOn -ComputerName #requires local admin
Get-LoggedOnLocal -ComputerName
Get-LastLoggedOn -ComputerName #requires local admin
Get-NetSession -ComputerName #summary of users and concurrent sessions
```
User Hunting
```powershell
Find-LocalAdminAccess -Verbose //find all machines where current user is admin
Invoke-CheckLocalAdminAccess //check if user has admin privilege on given machine
Invoke-UserHunter //find machines where current user has sessions
Invoke-UserHunter -GroupName "RDPUsers" //find machines where user can RDP to
Invoke-UserHunter -CheckAccess //check for admin access
```
{% endtab %}
{% tab title="LDAP Module" %}
```powershell
Get-ADUser -Filter * #default properties
Get-ADUser -Filter * -Properties * #all properties
Get-ADUser -Filter * -Properties description #description might contain credentials
Get-ADUser -Identity -Properties *
#List of properties
Get-ADUser -Filter * -Properties * | select -First 1 | Get-Member -MemberType *Property | select name
#If the machine we are running the query from is not part of a domain we need to specify the DC to query
Get-ADUser -Identity -Server -Properties *
Get-ADUser -Filter 'Name -like ""' -Server -Properties *
```
Search a string in user properties
```powershell
Get-ADUser -Filter ' like '** -Properties * | select name,
```
{% endtab %}
{% endtabs %}
## Groups
{% tabs %}
{% tab title="CMD" %}
```batch
net group /domain //list all
net group /domain //get info on group
```
{% endtab %}
{% tab title="PowerShell" %}
```powershell
Get-WmiObject -Class win32_groupindomain | foreach {[wmi]$_.partcomponent}
```
Users in group
```powershell
Get-WmiObject -Class win32_groupuser | where {$_.groupcomponent -match ''} | foreach {[wmi]$_.partcomponent}
```
Groups of user
```powershell
Get-WmiObject -Class win32_groupuser | where {$_.partcomponent -match ''} | foreach {[wmi]$_.groupcomponent}
```
{% endtab %}
{% tab title="PowerView" %}
```powershell
Get-NetGroup
Get-NetGroup -Domain
Get-NetGroup -FullData
Get-NetGroup **
```
Users in group
```powershell
Get-NetGroupMember -GroupName -Recurse
```
Groups of user
```powershell
Get-NetGroup -Username
```
List all groups on a machine. Requires administrative privileges or the machine has to be a domain controller
```powershell
Get-NetLocalGroup -ComputerName -ListGroups
Get-NetLocalGroup -ComputerName -Recurse
```
{% endtab %}
{% tab title="LDAP Module" %}
```powershell
Get-ADGroup -Filter * | select Name
Get-ADGroup -Filter * -Properties *
Get-ADGroup -Filter 'Name -eq ""' -Properties *
Get-ADGroup -Filter 'Name -like "**"' -Properties *
```
Users in group
```powershell
Get-ADGroupMember -Identity -Recursive
```
Groups of user
```powershell
Get-ADPrincipalGroupMembership -identity
```
{% endtab %}
{% endtabs %}
## Group Policies (GPO)
{% tabs %}
{% tab title="PowerShell" %}
```powershell
gpresult /RV #get set of policies applied on current machine
```
{% endtab %}
{% tab title="PowerView" %}
```powershell
Get-NetGPO
Get-NetGPO | select displayname
Get-NetGPO -ComputerName
Get-NetGPOGroup #GPOs for restricted groups or users
```
Users under the machine's group policy
```powershell
Find-GPOComputerAdmin -ComputerName //find users under the machine's GPO
Find-GPOLocation -UserName -Verbose //find machines that apply GPs to user
```
Organization Units
```powershell
Get-NetOU -FullData
Get-NetOU -FullData | select displayname,gplink //get GPO name from gplink attr
Get-NetGPO -GPOName "{}" //GPOs applied to OU
```
{% endtab %}
{% tab title="LDAP Module" %}
list GPO
Get-GPO -All
Get-GPResultantsetOfPolicy -ReportType Html -Path <output path>
get details of GPO
```powershell
Get-ADOrganizationalUnit -Filter * -Properties *
Get-GPO -Guid
```
{% endtab %}
{% endtabs %}