6.6.2 Choose an enumeration approach
§6 — Chapter 6 | 6.6 Study aids
6.6.2.1 Choose by question and access
| Approach | Choose it when | Needs | Useful output / limit |
|---|---|---|---|
| Native Windows net.exe / domain tools | You need a quick user/group/domain baseline from the current Windows context | Usable domain/network context; relevant tool installed | Names, memberships and policy; expand interesting objects and do not assume complete nesting |
| RSAT ActiveDirectory cmdlets | The module is already installed and structured properties or recursive membership help | Module availability plus permitted authenticated queries | Structured objects; absence of RSAT is an environment fact, not a missing domain |
| ADSI / DirectorySearcher | Windows has no RSAT and you can state the LDAP query explicitly | .NET directory access, correct base/filter and authentication context | Built-in controlled queries; handle paging and missing/denied attributes |
| Authenticated LDAP from Kali | You have credentials and directory connectivity but no suitable Windows session | Correct server/naming context, supported auth/TLS and client | Attribute/filter control; a successful bind is not every attribute or operation right |
| Reviewed PowerView | Convenient AD-oriented joins/ACL queries answer the current question | Compatible loaded script and correct network identity | Rich candidates; confirm emitted fields and effective rights rather than trusting a familiar command name |
| SharpHound / BloodHound | You need relationships across objects and candidate paths | Compatible collector/deployment, directory context and extra rights/routes for selected host methods | Join/rank edges; manual validation, collection scope and freshness remain necessary |
| SMB file interaction | The question concerns share/list/read/write boundaries or a referenced artifact | Reachable server, explicit account scope and object rights | Actual file access; it does not substitute for LDAP object rights or prove execution |
6.6.2.2 Selection examples
No RSAT on a domain client -> start with native reads, then ADSI or reviewed PowerView for the missing attribute. A graph shows AddMember -> query the exact group ACE and trustee membership. A share lists a configuration -> test that file read, not a graph query. Directory-only collection has no sessions -> collect only the useful selected-host evidence when its prerequisites are met.
6.6.2.3 Stop and switch
Switch when the current method cannot observe the required fact, its query is denied, or its coverage is insufficient. Record that limitation first. A different tool performing the same denied operation under the same identity may add no evidence.
§6.2.1.1 — Baseline enumeration — users and groups
§6.2.5.1 — Enumerate and validate effective object permissions
§6.2.8.1 — Enumerate using BloodHound and validate relationships