6.0 AD topic chooser — legacy entry AD quick reference
Quick commands: AD enumeration and lateral movement | Define LDAPSearch once
Use the full AD cheatsheet as the main working page. It includes the starting-point chooser, commands, concise interpretation and variants. This older URL remains a focused investigation index for existing links; annotated examples remain on the linked pages.
§6 — AD Notes | §6.5.3 — How to read output | §6.5.4 — Expected behavior
Start with your current access. Read the question, open one check, interpret its output and validate the missing condition. Commands are concept-study references; practical execution remains deferred until the practice phase. Examples are synthetic.
6.0.1 Find domain identities, relationships and access opportunities AD enumeration — check
- §6.1.1 — Your actual identity, domain, DC, DNS and time.
- §6.2.1 — Users, custom groups and nested memberships.
- §6.2.2 — Shares, SYSVOL, NETLOGON and useful files.
- §6.2.3 — What scripts/configurations reveal and what they do not.
- §6.2.4 — Service accounts and SPNs.
- §6.2.5 — Object ACLs and effective rights.
- §6.2.6 — Host-specific access and §6.2.7 — sessions.
- §6.2.8 — BloodHound collection and edge-by-edge validation.
6.0.2 Follow the clue — check
| What you observed | Next investigation |
|---|---|
| Account without Kerberos preauthentication | §6.3.3 — AS-REP material and failure interpretation |
| User-backed service SPN | §6.3.4 — Selected Kerberoasting and account value |
| Password, hash, ticket or opaque secret | §6.3.2 — Classify material before reuse |
| A usable directory-object right | §6.3.7 — Choose a permission-backed identity change |
| Delegated secret-read rights | §6.3.8 — LAPS / gMSA scope and protection |
| Possible domain-root replication rights | §6.3.9 — DCSync prerequisites |
| Controlled host with a useful credential lead | §6.3.5 — Select the credential source, then §6.3.6 — inspect tickets |
| Certificate/delegation/GPO evidence | §6.3.10 — Conditional branch chooser |
6.0.3 Move and recover — check
- §6.3.1 — Password policy before credential validation; do not spray by default.
- §6.4.1 — Match the credential to a reachable, authorized service.
- §6.4.2 — WinRM/RDP authorization and second-hop failures.
- §6.4.3 — SMB/WMI execution versus its output channel.
- §6.1.2 — Routes, naming and pivot connectivity.
- §6.5.1 — Failure layer and empty-output interpretation.
- §6.5.2 — Re-enumerate after any identity, host, privilege or route change.
Decision rule: observed clue -> missing prerequisite -> cheapest decisive check -> enabled / ruled out here / inconclusive -> next page. A feature being present is not a finding, and a failed collection is not proof of absence.