6.5.2 Re-enumerate after an identity or host change
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A newly validated credential, session, privilege level, host, domain identity or network route. The transition must have actual verification evidence.
Where to look: Re-establish host/identity/token/network context. Revisit memberships, object rights, readable shares/configuration, service-specific host access, tickets/sources and routes that can differ under the new state.
Expected behavior / secure boundary: Two apparently ordinary users can have different delegated rights. A high-privilege token on one member host is not automatically domain administration. Refreshed group membership may not be present in an old token/cache.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.5.2.1 Baseline selection
Select the prerequisite check indicated by the interpreted result below. This chooser requires no additional tool or state change.
What this checks: The baseline verifies the new state rather than continuing from an assumed identity. Record what changed and revisit only the checks whose prerequisites could now differ.
6.5.2.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Before: EXAMPLE\analyst on APP01, user token
After: EXAMPLE\svc_reports on APP01, user token
New evidence: Finance share readable; local admin unverified
Original failed path: Helpdesk group write still denied
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| New identity, same host | A changed authorization context. | Recheck relevant group/object/share/host rights. | §6.2.1.1 — Baseline enumeration — users and groups |
| Finance readable | A new data capability. | Inspect selected useful files; do not claim execution. | §6.2.3.1 — Interpret scripts, configuration and exposed secrets |
| Old path still denied | No new support for that branch. | Keep it closed and follow the new file/identity evidence. | §6.2.1.1 — Baseline enumeration — users and groups |
Stop when: The new state is verified and only the checks affected by it are queued.
Revisit only when: Another identity, host, privilege or route transition occurs.
6.5.2.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | The transition is verified: update the map and investigate newly enabled checks. | §6.2.1.1 — Baseline enumeration — users and groups |
| Ruled out in this context | The tool claims success but host/identity/effect is unverified: verify before advancing. | §6.1.1.1 — Establish the current identity and domain |
| Inconclusive / failed check | No useful new rights appear: keep the evidence and rank another path. | §6.2.1.1 — Baseline enumeration — users and groups |
6.5.2.4 Tooling and complete procedure
Native identity/context verification is sufficient initially. Reuse the specific linked enumeration tools only where the new state changes their possible result. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.