Skip to content
HackIndex.io

OSCP · Module 16

Active Directory Enumeration

Domain discovery, unauthenticated user enumeration, object queries, ACL analysis, and BloodHound attack path mapping.

~3.5 h 9 resources Last updated September 27, 2026

Active Directory controls authentication and authorization in most corporate Windows networks. PEN-200 introduces AD concepts (domains, forests, trusts, users, groups, OUs, GPOs) and then focuses on enumeration: mapping domain structure, finding users and groups, identifying ACL misconfigurations, and using BloodHound to visualize attack paths. The AD set on the OSCP exam is worth 40 points, so thorough enumeration is essential.

Domain Discovery and Unauthenticated Enumeration

Before you have credentials, identify domain controllers through DNS and LDAP, enumerate the domain name, and brute-force usernames via Kerberos (Kerbrute) or RID cycling. These techniques work from the network without any domain account and produce the username list you need for password spraying in the next module.

Authenticated Enumeration and BloodHound

With a domain account, enumeration expands to full object queries: users, groups, computers, GPOs, ACLs, and delegation settings. PowerView, ldapsearch, and the AD module cover manual queries. BloodHound (SharpHound collection + graph analysis) automates attack path discovery and highlights the shortest path to Domain Admin. Understanding BloodHound edges (GenericAll, WriteDACL, ForceChangePassword, DCSync) tells you exactly which objects to target.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Practice

Apply the module hands-on.

  • Cascade HackTheBox Medium
  • Ypuffy HackTheBox Medium
  • Object HackTheBox Hard
  • Pikaboo HackTheBox Hard
  • Reel HackTheBox Hard
All OSCP practice machines