Validate host access and volatile session candidates
Needs: Reachable destination service and its actual authorization; session evidence must be current and collection rights sufficient
PowerShell commands
# Baseline
Find-LocalAdminAccess
Shell commands
# Baseline
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares
PowerShell commands
# Baseline
Get-NetSession -ComputerName COMPUTER -Verbose
Get-NetLoggedon -ComputerName COMPUTER
Windows commands
REM Baseline
PsLoggedOn.exe \\COMPUTER
- empty/denied is inconclusive, not proof of no users;
- a session is a time-sensitive observation, not a durable ACL;
- a session matters only if the current identity can reach/control that host and a later credential/ticket technique applies;
- session presence does not prove credentials are resident, accessible or reusable.
Verify → Record the destination-specific successful action and freshness/limits of session evidence.
If it fails → Collection denial is not proof that no sessions exist; a valid credential is not proof of every host-access method. More detail ↓
Explanation & examples
Validate host access and volatile session candidates
- USE WHEN
- Group-to-host access edges or a privileged user's possible session
- STARTING ACCESS
- A known domain identity or a directory endpoint that permits the selected anonymous query
- RESULT
- Verified service access or a prioritized host/session hypothesis
Recognize the clue
Correlate directory group/session relationships with a specific host's service and local access policy, rather than treating all host edges as administrator access.
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares
SMB authentication: accepted
SHARE: READ
RDP/WinRM/WMI authorization: not establishedMeans: A permitted SMB action identifies a host capability; it does not establish RDP/WinRM/SCM rights. Investigate sessions only with a supported, permitted remote query.
Confirm: Verify actual group effectiveness, service/logon rights, session freshness and collection visibility.
- After validation
- The intended host service accepts the account and action: use that particular access form.
- Ruled out in this context
- RDP membership does not grant the proposed service-creation right: reject that method.
- Still inconclusive
- Denied session enumeration is a visibility limit, not proof that no useful sessions exist.
Troubleshooting: Collection denial is not proof that no sessions exist; a valid credential is not proof of every host-access method.
Additional prerequisite checks
whoami /groups
net localgroup Administrators
Find-LocalAdminAccess is a broad candidate generator and can be noisy or blocked by firewall/RPC controls. Validate a selected host with the service you may actually use. NetExec's (Pwn3d!) indicates administrative SMB context according to that tool; it does not establish RDP, WinRM, WMI/DCOM or directory rights. RDP, WinRM, SMB/service control and WMI/DCOM each have different ports, services, policies and authorization.
Get-NetSession relies on workstation/session enumeration APIs that modern Windows may restrict. PsLoggedOn combines Registry profile evidence with NetSessionEnum; remote Registry access and sufficient rights are relevant, and querying can itself create a network-session entry. Therefore:
- empty/denied is inconclusive, not proof of no users;
- a session is a time-sensitive observation, not a durable ACL;
- a session matters only if the current identity can reach/control that host and a later credential/ticket technique applies;
- session presence does not prove credentials are resident, accessible or reusable.
Why it works
Local admin, RDP, WinRM and share-read relationships grant different capabilities. A historical session does not guarantee current credential material or the right to read it.
Worked example · hypothetical
Observation: a graph marks a user as able to RDP to a host. Test: validate the reachable RDP service and effective logon right. Illustrative output: RDP works but remote service creation is denied. Interpretation: retain the actual access form and inspect that host's new opportunities.
New identity, privilege, host or route? Re-enumerate → All topic tasks →