AD enumeration

Domain-joined Windows source

CopyREM Domain-joined Windows source
whoami /all
echo %USERDNSDOMAIN%
echo %USERDOMAIN%
echo %LOGONSERVER%
nltest /dsgetdc:DOMAIN
nltest /dclist:DOMAIN
w32tm /query /status

Domain-joined Windows source

Copy# Domain-joined Windows source
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.DOMAIN
Resolve-DnsName -Type SRV _kerberos._tcp.DOMAIN

Decisive output: domain FQDN, DC FQDN/IP, current user SID/groups, DNS SRV answers and a plausible time source. USERDOMAIN can be a NetBIOS label; prefer the DNS domain for LDAP/Kerberos.

Kali/off-domain source

Copy# Kali/off-domain source
dig +short SRV _ldap._tcp.dc._msdcs.DOMAIN @DC_IP
dig +short SRV _kerberos._tcp.DOMAIN @DC_IP
nxc smb DC_IP -d DOMAIN -u USER -p 'PASSWORD'
ldapsearch -x -LLL -H ldap://DC_HOST:389 -s base -b '' \
  defaultNamingContext configurationNamingContext rootDomainNamingContext dnsHostName

Remote Windows session and double-hop caveat

CopyREM Remote Windows session and double-hop caveat
whoami /all
klist
dir \\DC_HOST\SYSVOL

Remote Windows session and double-hop caveat

A supplied credential may create the remote session without being delegated onward to the DC. If local identity commands work but access to a second host fails, distinguish a WinRM/PowerShell remoting credential-delegation problem from invalid credentials. An interactive RDP session, explicit credentials, /netonly network credentials or an off-domain LDAP client may create a different context; always record which identity is used locally and over the network.

Copy# Remote Windows session and double-hop caveat
IDENTITY MAP: USER/COMPUTER -> DIRECT + NESTED GROUPS -> DIRECTORY RIGHTS
HOST MAP:     COMPUTER -> OS/ROLE -> LOCAL/REMOTE-ACCESS RIGHTS -> SESSIONS
ROUTE MAP:    SOURCE -> DNS/KDC/DC/HOST -> REQUIRED PORT/SERVICE
LEAD MAP:     EVIDENCE -> HYPOTHESIS -> MINIMUM VALIDATION -> NEXT BLOCK

# Remote Windows session and double-hop caveat
AS-REQ/AS-REP: user proves knowledge of long-term key -> receives TGT
TGS-REQ/TGS-REP: TGT requests SERVICE/HOST -> receives service ticket
AP-REQ: client presents service ticket -> service authenticates client
AUTHORIZATION: target service still evaluates the represented identity/claims

Before changing credentials or tools

Copy# Before changing credentials or tools
getent hosts DC_HOST
nc -nvz DC_IP 88
date -u

Remote Windows session and double-hop caveat

CopyREM Remote Windows session and double-hop caveat
w32tm /query /status
klist

Windows commands

CopyREM Baseline
net user /domain
net user USER /domain
net group /domain
net group "Domain Admins" /domain
net group "GROUP" /domain
net accounts /domain
nltest /domain_trusts /all_trusts
net view /domain
net view \\DC_HOST

RSAT ActiveDirectory module, only when installed

Copy# RSAT ActiveDirectory module, only when installed
Get-Command -Module ActiveDirectory
Get-ADDomain
Get-ADForest
Get-ADDomainController -Filter *
Get-ADUser -Filter * -Properties Enabled,Description,MemberOf,ServicePrincipalName,UserPrincipalName,PasswordLastSet,LastLogonDate,AdminCount
Get-ADGroup -Filter * -Properties GroupScope,GroupCategory,Members,Description
Get-ADGroupMember -Identity 'GROUP' -Recursive
Get-ADComputer -Filter * -Properties DNSHostName,OperatingSystem,OperatingSystemVersion,ServicePrincipalName,TrustedForDelegation,LastLogonDate
Get-ADTrust -Filter *

RSAT ActiveDirectory module, only when installed

Get-AD* cmdlets require the RSAT ActiveDirectory module. Its absence on a client is normal; use ADSI, LDAP, PowerView or an off-domain client.

For automatic, explicitly scoped inventory, run the AD surface helpers with an explicit DC/domain. Collection runs by default, prints a bounded findings summary and saves a unique private evidence directory; -Preview displays checks without connecting. The helper preserves query failures, candidate clues, account-context limits and linked manual-validation handoffs without requesting roast material or changing directory objects.

For repeated queries, define LDAPSearch once inline, then use its purpose-labelled calls. The transparent one-off procedure below remains useful when no helper is loaded.

Copy# RSAT ActiveDirectory module, only when installed
$root = [ADSI]'LDAP://RootDSE'
$base = [ADSI]("LDAP://" + $root.defaultNamingContext)
$searcher = New-Object System.DirectoryServices.DirectorySearcher($base)
$searcher.PageSize = 1000
$searcher.PropertiesToLoad.AddRange(@('samaccountname','userprincipalname','objectsid','memberof','serviceprincipalname','description','useraccountcontrol','pwdlastset','lastlogontimestamp'))
$searcher.Filter = '(&(objectCategory=person)(objectClass=user))'
$searcher.FindAll() | ForEach-Object { $_.Properties }

Change only the filter and requested attributes for another object class

Copy# Change only the filter and requested attributes for another object class
# Groups
$searcher.Filter = '(objectCategory=group)'
$searcher.PropertiesToLoad.Clear()
$searcher.PropertiesToLoad.AddRange(@('samaccountname','objectsid','member','grouptype','description'))
$searcher.FindAll() | ForEach-Object { $_.Properties }

# Computers
$searcher.Filter = '(objectCategory=computer)'
$searcher.PropertiesToLoad.Clear()
$searcher.PropertiesToLoad.AddRange(@('dnshostname','operatingsystem','operatingsystemversion','serviceprincipalname','useraccountcontrol','lastlogontimestamp'))
$searcher.FindAll() | ForEach-Object { $_.Properties }

Discover the naming context

Copy# Discover the naming context
ldapsearch -x -LLL -H ldap://DC_HOST:389 -s base -b '' \
  defaultNamingContext configurationNamingContext rootDomainNamingContext dnsHostName

# Users, groups and computers
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName objectSid userAccountControl memberOf description servicePrincipalName pwdLastSet lastLogonTimestamp adminCount

# Users, groups and computers
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(objectCategory=group)' sAMAccountName objectSid member groupType description

# Users, groups and computers
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(objectCategory=computer)' dNSHostName operatingSystem operatingSystemVersion servicePrincipalName userAccountControl lastLogonTimestamp

# SPNs, trusts and GPO/OU context
# SPN-bearing accounts: mapping only; do not request tickets in this block.
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))' \
  sAMAccountName servicePrincipalName memberOf userAccountControl pwdLastSet

# SPNs, trusts and GPO/OU context
# Trusted-domain objects
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=trustedDomain)' \
  cn securityIdentifier trustDirection trustType trustAttributes

# SPNs, trusts and GPO/OU context
# OUs and GPO containers; correlate links before inferring host effect.
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W \
  -E pr=1000/noprompt -b 'DC=DOMAIN,DC=TLD' \
  '(|(objectClass=organizationalUnit)(objectClass=groupPolicyContainer))' \
  distinguishedName displayName name gPLink gPOptions

LDAP failure router

Result	Interpretation	Next action
Invalid credentials (49)	Bind identity/secret/context failed; subcodes may refine the cause	Recheck UPN vs DOMAIN\USER, account state and exact secret; do not infer authorization
Strong(er) authentication required / confidentiality required	Server policy rejects that bind/transport	Use the permitted LDAPS/StartTLS or Kerberos/SASL path; do not disable protections
Size limit exceeded or suspiciously round count	Search is incomplete	Add paged results and narrow the base/filter
Referral/partial results	Search crossed a naming-context boundary	Query the referred domain/partition or compatible Global Catalog deliberately
Bind succeeds, search empty	Wrong base/filter, ACL filtering or genuinely no matches	Verify RootDSE base, test a known object and request fewer attributes
Works by IP, Kerberos fails	Route exists but name/SPN/DNS/time path is wrong	Use DC FQDN, AD DNS, correct realm and synchronized time

Copy# LDAP failure router
Import-Module .\PowerView.ps1
Get-Command -Module PowerView
Get-Domain
Get-DomainController
Get-DomainTrust
Get-DomainUser | Select-Object samaccountname,userprincipalname,description,memberof,serviceprincipalname
Get-DomainGroup
Get-DomainGroupMember -Identity 'GROUP' -Recurse
Get-DomainComputer | Select-Object dnshostname,operatingsystem,operatingsystemversion
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname,memberof

LDAP failure router

Copy# LDAP failure router
NEW PASSWORD/HASH/KEY/TICKET
-> VERIFY TYPE, CLIENT, REALM, VALIDITY
-> AUTHENTICATE THROUGH ONE COMPATIBLE SERVICE
-> CONFIRM IDENTITY
-> REPEAT GROUP/ACL/SHARE/HOST/SESSION/ROUTE MAPPING

Inventory, then test the object

CopyREM Inventory, then test the object
net view \\DC_HOST
dir \\DC_HOST\SYSVOL
dir \\DC_HOST\NETLOGON

Inventory, then test the object

Copy# Inventory, then test the object
nxc smb DC_IP -d DOMAIN -u USER -p 'PASSWORD' --shares
smbclient -L //DC_IP -U 'DOMAIN/USER'
smbclient //DC_IP/SYSVOL -U 'DOMAIN/USER' -c 'recurse ON; ls'
smbclient //DC_IP/SHARE -U 'DOMAIN/USER'

Inside smbclient, use ls, cd, get FILE and a harmless approved put only when write validation is needed. Share listing, share connection, file read and file write are separate permissions.

Windows commands

CopyREM Baseline
setspn -Q */*
setspn -L ACCOUNT

PowerShell commands

Copy# Baseline
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname,memberof,useraccountcontrol,pwdlastset

Record account → service class/host/port → groups → password age/encryption/delegation clues → reachable service. An SPN means the account represents a Kerberos service identity; it does not mean the password is weak, the service is reachable or the account is privileged. Ticket acquisition/cracking is Block 11.

PowerShell commands

Copy# Baseline
Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs |
  Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|ExtendedRight|WriteProperty|Self' } |
  Select-Object ObjectDN,SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType,IsInherited,InheritanceType

Compatible copy that actually emits IdentityReference

Use this projection only when inspecting the returned object confirms that the loaded implementation provides IdentityReference.

Copy# Compatible copy that actually emits IdentityReference
Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs |
  Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|ExtendedRight|WriteProperty|Self' } |
  Select-Object ObjectDN,IdentityReference,ActiveDirectoryRights,ObjectAceType,AceType,IsInherited,InheritanceType

Enumerate a target's ACL with resolved GUIDs

If the value is an unresolved SID, resolve it before applying the rule to a controlled principal.

Copy# Enumerate a target's ACL with resolved GUIDs
Import-Module .\PowerView.ps1
Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs |
  Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|ExtendedRight' }

# Resolve trustees
ConvertFrom-SID 'S-1-5-21-...'
Get-DomainObject -Identity 'S-1-5-21-...' | Select-Object samaccountname,objectclass

Common effects require different rights:

PowerShell commands

Copy# Baseline
Find-LocalAdminAccess

Shell commands

Copy# Baseline
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

PowerShell commands

Copy# Baseline
Get-NetSession -ComputerName COMPUTER -Verbose
Get-NetLoggedon -ComputerName COMPUTER

Windows commands

CopyREM Baseline
PsLoggedOn.exe \\COMPUTER

• empty/denied is inconclusive, not proof of no users;
• a session is a time-sensitive observation, not a durable ACL;
• a session matters only if the current identity can reach/control that host and a later credential/ticket technique applies;
• session presence does not prove credentials are resident, accessible or reusable.

Low-noise directory baseline that avoids contacting every workstation

Copy# Low-noise directory baseline that avoids contacting every workstation
.\SharpHound.exe --CollectionMethods DCOnly --OutputDirectory .\bh --ZipFileName domain-dconly.zip

Add host facts only when they can answer the next question

Copy# Add host facts only when they can answer the next question
.\SharpHound.exe --CollectionMethods LocalGroup --ComputerFile .\candidate-hosts.txt --OutputDirectory .\bh --ZipFileName candidate-localgroups.zip
.\SharpHound.exe --CollectionMethods Session --ComputerFile .\candidate-hosts.txt --Loop --LoopDuration 00:10:00 --OutputDirectory .\bh --ZipFileName candidate-sessions.zip

# Collector variants and compatibility
# Inspect the actual collector before using copied syntax.
.\SharpHound.exe --help

Collector variants and compatibility

Copy# Collector variants and compatibility
# Community Linux collector; flags and output compatibility vary by release.
bloodhound-python --help
bloodhound-python -u USER -p 'PASSWORD' -d DOMAIN -ns DC_IP -dc DC_HOST -c All --zip

Collector variants and compatibility

Copy# Collector variants and compatibility
# Legacy/course PowerShell collector; use only with a compatible legacy deployment.
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory .\bh -ZipFileName legacy.zip

Analyze in this order

1. Mark only identities/hosts actually controlled. A low-privilege session on a host does not make the host itself fully owned.
2. Inspect the controlled principal's direct and nested group memberships and outbound object-control edges.
3. Inspect reachable computers where it has local admin, RDP, WinRM/DCOM or other applicable rights.
4. Inspect high-value goals and shortest paths only as hypothesis generation.
5. Classify each selected edge:
   • directory/static-ish: group, ACL, GPO, OU, trust;
   • host-derived: local group or user right;
   • volatile: session;
   • route-dependent: the required host/service must be reachable now.
6. Reproduce the minimum important relationship manually before handing it to Block 11 or 12.

Copy# Analyze in this order
ID | CONTROLLED PRINCIPAL | RELATIONSHIP | TARGET | SOURCE EVIDENCE
   | EFFECTIVE? | ROUTE/SERVICE | VOLATILITY | EXPECTED TRANSITION
   | MINIMUM VALIDATION | STATUS | NEXT BLOCK

1. confidence that the relationship is effective;
2. deterministic value of the resulting identity/access;
3. route and service availability;
4. stability versus volatile session timing;
5. reversibility and impact;
6. number of unsupported assumptions.