6.2.1 Baseline enumeration — users and groups
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A working domain query context. Native Windows commands use the current network context; off-domain clients need explicit supported authentication.
Where to look: Query domain users, then expand selected accounts and custom or privileged groups. Follow direct and nested memberships toward an actual object right or host permission. Inspect descriptions and account state without assuming names reveal privileges.
Expected behavior / secure boundary: Authenticated directory reads and membership in Domain Users are ordinarily expected. Administrative-looking names, adminCount and old password dates are leads, not proof of current administrative rights. A direct memberOf list may omit nested and primary-group relationships.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.2.1.1 Baseline enumeration with native Windows commands
Run: Windows. Requires: Current domain query context; /domain selects directory rather than local accounts. Effect: Reads user, group and policy information.
net user /domain
net user USER /domain
net group /domain
net group "Domain Admins" /domain
net group "GROUP" /domain
net accounts /domain
nltest /domain_trusts /all_trusts
net view /domain
net view \\DC_HOST
6.2.1.2 Find domain users, groups and computers through RSAT Enumeration using RSAT PowerShell
Run: Windows PowerShell with RSAT. Requires: ActiveDirectory module plus permitted authenticated directory access. Effect: Reads directory objects; does not grant the returned memberships.
Get-Command -Module ActiveDirectory
Get-ADDomain
Get-ADForest
Get-ADDomainController -Filter *
Get-ADUser -Filter * -Properties Enabled,Description,MemberOf,ServicePrincipalName,UserPrincipalName,PasswordLastSet,LastLogonDate,AdminCount
Get-ADGroup -Filter * -Properties GroupScope,GroupCategory,Members,Description
Get-ADGroupMember -Identity 'GROUP' -Recursive
Get-ADComputer -Filter * -Properties DNSHostName,OperatingSystem,OperatingSystemVersion,ServicePrincipalName,TrustedForDelegation,LastLogonDate
Get-ADTrust -Filter *
What this checks: The /domain switch selects domain objects rather than the local SAM. User detail connects an account to memberships; group detail identifies principals to investigate. RSAT adds structured queries only when its module exists.
6.2.1.3 Interpret the output
Raw/view evidence first. These are synthetic, abbreviated tool or graph-view excerpts. Graph relationship rows are a representative view, not collector console output. Version-specific wording and spacing can differ. The normalized observations below are a separate interpretation.
6.2.1.3.1 Expected — raw evidence
Command/view: net user USER /domain
User name analyst
Account active Yes
Global Group memberships *Domain Users
The command completed successfully.
Decisive clue: Global Group memberships: Domain Users.
Supported: An ordinary account and one displayed membership are visible.
Still missing: Nested/primary memberships and useful object/host rights are not established.
Next check: §6.2.5.1 — Enumerate and validate effective object permissions
6.2.1.3.2 Interesting — raw evidence
Command/view: net user USER /domain
User name analyst
Account active Yes
Global Group memberships *Domain Users *Support
The command completed successfully.
Decisive clue: The additional Support membership.
Supported: A custom group is worth tracing into an exact right.
Still missing: The name Support does not identify what it can administer.
Next check: §6.2.5.1 — Enumerate and validate effective object permissions
6.2.1.3.3 Failed / inconclusive — raw evidence
Command/view: net user /domain
System error 1355 has occurred.
The specified domain either does not exist or could not be contacted.
Decisive clue: The domain-query dependency failed.
Supported: This command did not establish a directory user list.
Still missing: Domain context, DC discovery, DNS and route need checking; no account-password conclusion follows.
Next check: §6.1.1.1 — Establish the current identity and domain
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
User name: svc_reports
Account active: Yes
Global Group memberships: *Domain Users *Reporting Operators
Group: Reporting Operators
Members: svc_reports, analyst
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| svc_reports | A discovered enabled account; its name suggests a purpose only. | Inspect its SPNs, effective groups and any documented object/host rights. | §6.2.4.1 — Enumerate service accounts and SPNs |
| Reporting Operators | A custom group shared with the controlled user. | Determine what this group can access or modify; the name does not establish admin. | §6.2.5.1 — Enumerate and validate effective object permissions |
| Get-ADUser is not recognized | RSAT is absent or not loaded. | Use native commands, ADSI, PowerView or authenticated LDAP. | §6.2.1.1 — Baseline enumeration — users and groups |
Stop when: Selected accounts, memberships and the next useful right are identified; unexplained names remain leads.
Revisit only when: A new identity or changed membership reveals different effective access.
6.2.1.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | A membership reaches a useful right: validate that right on the exact target. | §6.2.5.1 — Enumerate and validate effective object permissions |
| Ruled out in this context | A selected group has no relevant access in this context: continue another lead. | §6.2.2.1 — Enumerate shares, SYSVOL and NETLOGON |
| Inconclusive / failed check | Membership is partial or a query is denied: retain the gap; do not record the group as empty. | §6.2.1.1 — Baseline enumeration — users and groups |
6.2.1.5 Tooling and complete procedure
net.exe is the Windows baseline. RSAT Get-AD* is an optional structured alternative; ADSI/LDAP/PowerView fallbacks are in the owning procedure. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.