6.2.7 Enumerate and interpret sessions
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A scoped candidate host and permission to perform the selected session query. Other users' live credential material needs separate host privileges and protection checks.
Where to look: Inspect session evidence only on relevant hosts. Record who, which host, how collected and when. Join the observation to your actual ability to access/control that host; then select a justified credential source.
Expected behavior / secure boundary: User sessions are ordinary and volatile. Modern Windows can restrict enumeration. An empty or denied result is not proof of no sessions, and a session does not guarantee accessible or reusable credentials.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.2.7.1 Locate useful sessions and verify their identity context Session enumeration using PowerView
Run: Windows PowerShell with reviewed PowerView. Requires: RPC/API connectivity and the query-specific rights on selected hosts. Effect: Queries session evidence; denial means incomplete coverage.
Get-NetSession -ComputerName COMPUTER -Verbose
Get-NetLoggedon -ComputerName COMPUTER
6.2.7.2 Locate useful sessions and verify their identity context Session enumeration using PsLoggedOn
Run: Windows with PsLoggedOn. Requires: Relevant Remote Registry/session connectivity and permissions. Effect: Queries logon evidence; the query itself can create a network session.
PsLoggedOn.exe \\COMPUTER
What this checks: Session tools use different APIs/evidence. Remote Registry/profile artifacts, network sessions and interactive logons are not identical observations. The query itself can create network-session noise.
6.2.7.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Computer: APP01
UserName: EXAMPLE\admin_ops
Source: Session collection
Other host: Access denied
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| admin_ops on APP01 | A time-bound session candidate. | Verify freshness, host control and what kind of session was observed. | §6.2.6.1 — Validate host-specific access rights |
| You only have a low-privilege APP01 shell | You can run as yourself there. | Establish a privilege path before assuming process-memory access. | §6.3.5.1 — Select a credential source on a controlled host |
| Access denied | The collector lacked a needed right or access path. | Use another authorized source; mark this collection inconclusive. | §6.2.7.1 — Enumerate and interpret sessions |
Stop when: Source, time and collection coverage are recorded for the selected host.
Revisit only when: The session ages out or a relevant new host-control capability appears.
6.2.7.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Fresh useful session plus suitable host privileges: inspect the appropriate credential/ticket source. | §6.3.5.1 — Select a credential source on a controlled host |
| Ruled out in this context | You cannot control the relevant host or the session has ended: deprioritize that transition. | §6.2.5.1 — Enumerate and validate effective object permissions |
| Inconclusive / failed check | Denied/empty collection: retain uncertainty and use directory/object-right leads. | §6.2.8.1 — Enumerate using BloodHound and validate relationships |
6.2.7.5 Tooling and complete procedure
PowerView session functions or PsLoggedOn are targeted alternatives. RPC/Remote Registry, platform restrictions and query privileges determine what each can see. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.