10.11 AD Investigation — Where to Look and What Output Means
Full AD cheatsheet — main working page | Focused AD Notes | Complete AD procedures
This compatibility sheet retains its existing command and section links. Use the full AD cheatsheet for the combined command collection, starting-point chooser and concise interpretation; follow individual investigations for annotated output.
Use one check to answer one question. The expected result below is a cue, not proof of a complete attack. Replace placeholders in the selected access context; commands remain study references during concept study.
10.11.1 What identity and domain am I actually using?
Requires: A Windows session, or domain credentials on Kali. A Windows username alone does not establish the identity used for network authentication.
Run: Windows. Access: Current token; domain/DC queries additionally need a usable domain/network context. Effect: Reads identity, discovery and time state.
whoami /all
echo %USERDNSDOMAIN%
echo %USERDOMAIN%
echo %LOGONSERVER%
nltest /dsgetdc:DOMAIN
nltest /dclist:DOMAIN
w32tm /query /status
Interpret: whoami describes the process token. Domain environment variables are clues, not proof of successful authentication. nltest discovers a DC; SRV lookups test the naming layer. A plausible time source is useful, but does not itself prove the clock agrees with the KDC.
Failure / next: Discovery or time checks fail: repair that dependency before judging an account or technique.
Stop when: The local/network identity, domain/DC and relevant naming/time/route dependencies are recorded.. Revisit only when: Identity, DC, resolver, clock or source route changes..
10.11.2 Where do I find useful users and group memberships?
Requires: A working domain query context. Native Windows commands use the current network context; off-domain clients need explicit supported authentication.
Run: Windows. Access: Current domain query context; /domain selects directory rather than local accounts. Effect: Reads user, group and policy information.
net user /domain
net user USER /domain
net group /domain
net group "Domain Admins" /domain
net group "GROUP" /domain
net accounts /domain
nltest /domain_trusts /all_trusts
net view /domain
net view \\DC_HOST
Interpret: The /domain switch selects domain objects rather than the local SAM. User detail connects an account to memberships; group detail identifies principals to investigate. RSAT adds structured queries only when its module exists.
Failure / next: Membership is partial or a query is denied: retain the gap; do not record the group as empty.
Stop when: Selected accounts, memberships and the next useful right are identified; unexplained names remain leads.. Revisit only when: A new identity or changed membership reveals different effective access..
10.11.3 Which shares and files should I inspect first?
Requires: A reachable SMB endpoint and an identified anonymous, local or domain authentication context. These contexts must be recorded separately.
Run: Windows. Access: Selected SMB server; current network identity and share/object permissions. Effect: Lists shares/directories; does not test file write or execution.
net view \\DC_HOST
dir \\DC_HOST\SYSVOL
dir \\DC_HOST\NETLOGON
Interpret: net view and --shares inventory share-level candidates. smbclient then tests the named share with an explicit identity; ls, cd and get test progressively narrower objects. A successful file read can disclose information without granting execution.
Failure / next: Listing works but file reading is untested: keep the content claim inconclusive.
Stop when: The selected share/file access boundary and any useful clue are recorded.. Revisit only when: A new credential, permission or referenced file changes the access context..
10.11.4 What does an SPN tell me to investigate?
Requires: A domain directory query context, with user/group enumeration available.
Run: Windows with setspn available. Access: Tool execution prerequisites and permitted domain directory queries; do not assume the binary is installed. Effect: Lists registrations; the shown -Q/-L forms do not add SPNs.
setspn -Q */*
setspn -L ACCOUNT
Interpret: setspn inventories registrations; PowerView joins SPNs to account attributes. This is account/service mapping. Requesting offline guessing material and deciding whether cracking is worthwhile belong to the next page.
Failure / next: The service is unreachable: account enumeration still stands; remote service access remains unproved.
Stop when: The service registration is tied to its owning account and a concrete account-value question.. Revisit only when: A new account right, service route or justified password strategy changes the value..
10.11.5 An ACL shows a powerful right — can I actually use it?
Requires: A selected directory object and a controlled identity whose direct/nested memberships are known.
Run: Windows PowerShell with reviewed PowerView. Access: Read access to the selected object security descriptor; controlled trustee membership must be checked separately. Effect: Reads candidate ACEs; does not change permissions.
Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs |
Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|ExtendedRight|WriteProperty|Self' } |
Select-Object ObjectDN,SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType,IsInherited,InheritanceType
Interpret: The filter selects interesting candidate ACEs, not a complete effective-access calculation. Resolve all applicable rules and the specific attribute/extended right before choosing a transition.
Failure / next: SID/GUID/inheritance is unresolved: do not perform a speculative modification.
Stop when: Trustee, applicable right, target type and missing effective-access checks are explicit.. Revisit only when: Membership, object ACL, scope or the controlled identity changes..
10.11.6 How do I turn a BloodHound graph into a verified path?
Requires: A supported collector, compatible BloodHound deployment and a known collection identity. Mark only the identities and capabilities actually controlled.
Run: Windows with compatible SharpHound CE. Access: Domain DNS, authenticated directory context and compatible BloodHound ingestion. Effect: Collects directory relationships; DCOnly does not collect live workstation sessions.
.\SharpHound.exe --CollectionMethods DCOnly --OutputDirectory .\bh --ZipFileName domain-dconly.zip
Interpret: The first command collects directory data. The next commands add selected-host group/session evidence. Choose the source matching the deployment; legacy and current collectors are not interchangeable.
Failure / next: Host/session data was not collected: collect narrowly or validate manually.
Stop when: One candidate path has each required edge classified and its next manual check chosen.. Revisit only when: Collection scope, identity, host rights or session freshness changes..
10.11.7 Choose a method and read its evidence
Method comparison | Terminology | Continuous worked investigation | Unanswered interpretation cases
Compare raw lines with the annotated examples before accepting a normalized observation. A denial, empty query or incomplete collection can justify repairing a dependency or recording uncertainty rather than attempting an attack.
10.11.8 Useful location does not equal a vulnerability
SYSVOL/NETLOGON -> scripts, policy and referenced files; application/deployment shares -> selected configurations; user/group objects -> effective memberships; target ACL -> exact trustee/right/GUID; SPNs -> service-account value; host/session evidence -> current reachable service rights and freshness.
Secure-boundary comparison | Credential classification | Failure diagnosis