Active Directory

Start with your identity and domain context

Run these from a Windows domain member with a domain logon:

whoami /all
echo %USERDOMAIN%
echo %LOGONSERVER%
net user /domain
net group /domain
net accounts /domain

Inspect a selected identity/group rather than dumping every object's properties:

net user USER /domain
net group "GROUP NAME" /domain

Choose the next AD page

• Need names, groups, computers or SPNs: manual enumeration.
• Need relationship collection: automatic enumeration; validate useful graph edges against the actual object and your effective rights.
• Have a hash, ticket or password: authentication; distinguish an NT hash from a challenge-response capture and a TGT from a service ticket.
• Have valid credentials: lateral movement; test the particular host and transport. Successful SMB login does not imply local administrator or WinRM/RDP rights.
• Have a roasting/ticket clue: Kerberos; verify domain DNS, DC reachability, clock alignment and the selected account's conditions first.

Directory ACL, GPO and AD CS findings require a controlled object plus a usable privileged consumer or enrollment path. Check the exact right/template requirements before choosing an attack; generic write access somewhere in the domain is insufficient. After obtaining a new identity, repeat group, object-right and host-access checks.