> For the complete documentation index, see [llms.txt](https://csforza.gitbook.io/pentesting-articles-and-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://csforza.gitbook.io/pentesting-articles-and-notes/windows/active-directory/enumeration/basic-enumeration.md). # Basic Enumeration We can use either PowerView\.ps1 or the Active Directory Module to do domain enumeration from PowerShell. For basic enumeration, the AD Module may be better since it uses Microsoft tools. PowerView could potentially be blocked. PowerView commands will appear first in each code block, AD Module commands second if there are two different commands in a block. Otherwise, I will indicate which module to use. Go here to grab the AD Module: Some commands also utilize PowerView\_dev.ps1 which can be grabbed here: ## **Importing PowerView and the AD Module** ```powershell Import-Module .\PowerView.ps1 Import-Module .\Microsoft.ActiveDirectory.Management.dll Import-Module .\ActiveDirectory.psd1 ``` ## **Enumerating the domain** ### Get the Current Domain ```powershell Get-NetDomain Get-ADDomain ``` ### Get the Object of Another Domain ```powershell Get-NetDomain -Domain bizcorp.local Get-ADDomain -Identity bizcorp.local ``` ### Get Domain SID's ```powershell Get-DomainSID (Get-ADDomain).DomainSID ``` ### Get Domain Policy for the Current Domain ```powershell Get-DomainPolicy ``` ### Get Domain Policy for Another Domain (AD Module) ```powershell (Get-DomainPolicy -domain bizcorp.local)."system access" ``` ### Dump the Password Policy ```powershell (Get-DomainPolicy)."system access" Get-ADDefaultDomainPasswordPolicy ``` * Using crackmapexec ```bash crackmapexec smb -u -p --pass-pol ``` ### Get Domain Controllers for the Current Domain ```powershell Get-NetDomainController Get-ADDomainController ``` ### Get Domain Controllers for Another Domain ```powershell Get-NetDomainController -Domain bizcorp.local Get-ADDomainController - DomainName bizcorp.local -Discover ``` ## **Enumerating Users in the Domain** ### Get Users for the Current Domain * I should note that I find the AD Module to be more informative. ```powershell Get-NetUser [-Username ] Get-ADUser -Filter * -Properties * Get-ADUser -Identity -Properties * ``` * Using crackmapexec ```bash crackmapexec smb/ldap -u -p --users ``` ### Get All Property Names for Users in the Current Domain ```powershell Get-UserProperty Get-ADUser -Filter * -Properties * | select -First 1 | Get-Member -MemberType *Property | select Name ``` ### Selecting a Specific Property to Examine ```powershell Get-UserProperty -Properties pwdlastset Get-ADUser -Filter * -Properties * | select name,@{expression={[datetime]::fromFileTime($_.pwdlastset)}} Interesting Properties To Examine: pwdlastset badpwdcount logoncount OfficePhone/HomePhone/MobilePhone/Fax any properites that give away location info like POBox EmailAddress Description (may find credentials) ``` ### Searching For a String in a User's Attributes ```powershell Find-UserField -SearchField Description -SearchTerm "built" Get-ADUser -Filter 'Description -Like "*built*"' -Properties Description | select name,Description ``` ## **Enumerating Computers** ### Listing the Computers in the Current Domain ```powershell Get-NetComputer Get-NetComputer –OperatingSystem "*Server 2016*" Get-NetComputer -Ping Get-NetComputer -FullData Get-ADComputer -Filter * | select Name Get-ADComputer -Filter 'OperatingSystem -like "*Server 2016*"' - Properties OperatingSystem | select Name,OperatingSystem Get-ADComputer -Filter * -Properties DNSHostName | %{Test- Connection -Count 1 -ComputerName $_.DNSHostName} Get-ADComputer -Filter * -Properties * ``` * Using crackmapexec ```bash crackmapexec smb -u -p --computers ``` ## **Enumerating Groups** ### List All the Groups in the Current Domain ```powershell Get-NetGroup Get-NetGroup –Domain Get-NetGroup –FullData Get-ADGroup -Filter * | select Name Get-ADGroup -Filter * -Properties * ``` * Using crackmapexec ```bash crackmapexec smb/ldap -u -p --groups ``` ### Searching for Groups With a Particular Word in the Name ```powershell Get-NetGroup *admin* Get-ADGroup -Filter 'Name -like "*admin*"' | select Name ``` ### Find All Domain Admins ```powershell Get-NetGroupMember -GroupName "Domain Admins" -Recurse Get-ADGroupMember -Identity "Domain Admins" -Recursive ``` ### Enumerate Group Memberships of a User ```powershell Get-NetGroup –UserName Get-ADPrincipalGroupMembership -Identity ``` ### List All Local Groups on the Current Machine (on non-DC machines it requires admin privileges) (PowerView) ```powershell Get-NetLocalGroup -ComputerName bizcorp.local -ListGroups ``` ### List All Local Groups on Another Machine (on non-DC machines it requires admin privileges) (PowerView) ```powershell Get-NetLocalGroup -ComputerName bizcorp.local -Recurse ``` * Using crackmapexec ```bash crackmapexec smb -u -p --local-groups ``` ## **Finding Logged-On Users** ### Get Active Users on a Machine (requires local admin rights on the target) (PowerView) ```powershell Get-NetLoggedon –ComputerName ``` * Using crackmapexec ```bash crackmapexec smb -u -p --loggedon-users ``` ### Get Local Logged-On Users on Another Machine (needs remote registry on the target - started by-default on server OS) (PowerView\_dev) ```powershell Get-LoggedonLocal -ComputerName dc.bizcorp.local ``` ### Get the Last Logged-On User on a Computer (needs admin privileges and remote registry on the target) (PowerView) ```powershell Get-LastLoggedOn –ComputerName ``` ### Finding Interesting Files and Shares (PowerView) ```powershell Invoke-ShareFinder –Verbose Invoke-FileFinder –Verbose ``` * Using crackmapexec ```bash crackmapexec smb -u -p --shares/--disks ``` ### Find All File Servers on the Domain With a Focus on High Value Targets (PowerView) ```powershell Get-NetFileServer ``` ## **Group Policy Objects (GPO's)** ### Find GPO's in the Current Domain ```powershell Get-NetGPO [-ComputerName dc.bizcorp.local] Get-GPO -All ``` ### Find GPO's Which Use Restricted Groups or groups.xml for Interesting Users ```powershell Get-Net-GPOGroup # PowerView ``` ### Find Users Which Are in a Local Group of a Machine Using a GPO ```powershell Find-GPOComputerAdmin -ComputerName bizcorp.local ``` ### Find Machines Where a User is a Member of a Specific Group ```powershell Find-GPOLocation -Username -Verbose ``` ### Get OU's in a Domain ```powershell Get-NetOU -FullData Get-ADOrganizationalUnit -Filter * -Properties * ``` ### Get-GPO Applied on an OU and Read GPO Name from the GPLink Attribute ```powershell 1) Get-ADOrganizationalUnit -Filter * -Properties * | select gplink 2) Get-NetGPO -GPOName <{AB306569....}> # PowerView Get-GPO -Guid # AD Module ``` ## Enumeration From Outside of the Network I included some commands using crackmapexec. In addition, many of these commands can be replicated from outside the network using [pywerview.py](https://github.com/the-useless-one/pywerview).