# Active Directory Enumeration

> Domain discovery, unauthenticated user enumeration, object queries, ACL analysis, and BloodHound attack path mapping.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/active-directory-introduction-and-enumeration
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 3.5
- **Published:** 2026-09-25
- **Updated:** 2026-09-27

Active Directory controls authentication and authorization in most corporate Windows networks. PEN-200 introduces AD concepts (domains, forests, trusts, users, groups, OUs, GPOs) and then focuses on enumeration: mapping domain structure, finding users and groups, identifying ACL misconfigurations, and using BloodHound to visualize attack paths. The AD set on the OSCP exam is worth 40 points, so thorough enumeration is essential.

## Domain Discovery and Unauthenticated Enumeration

Before you have credentials, identify domain controllers through DNS and LDAP, enumerate the domain name, and brute-force usernames via Kerberos (Kerbrute) or RID cycling. These techniques work from the network without any domain account and produce the username list you need for password spraying in the next module.

## Authenticated Enumeration and BloodHound

With a domain account, enumeration expands to full object queries: users, groups, computers, GPOs, ACLs, and delegation settings. PowerView, ldapsearch, and the AD module cover manual queries. BloodHound (SharpHound collection + graph analysis) automates attack path discovery and highlights the shortest path to Domain Admin. Understanding BloodHound edges (GenericAll, WriteDACL, ForceChangePassword, DCSync) tells you exactly which objects to target.

## Study material

- [AD Domain and DC Discovery](https://hackindex.io/platforms/active-directory/reconnaissance/ad-domain-and-dc-discovery.md) (read, core)
- [Unauthenticated User Enumeration](https://hackindex.io/platforms/active-directory/reconnaissance/ad-unauthenticated-user-enumeration.md) (read, core)
- [Active Directory Enumeration](https://hackindex.io/platforms/windows/enumeration/active-directory-enumeration.md) (read, core)
- [Object Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-object-enumeration.md) (read, core)
- [ACL Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-acl-enumeration.md) (read, core)
- [GPO Enumeration](https://hackindex.io/platforms/active-directory/enumeration/ad-gpo-enumeration.md) (read, core)
- [Password Policy and Spray Surface](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-password-policy-and-spray-surface.md) (read, core)
- [BloodHound and SharpHound Collection](https://hackindex.io/platforms/active-directory/enumeration/bloodhound-and-sharphound-collection.md) (read, core)
- [BloodHound Edge Reference](https://hackindex.io/platforms/active-directory/enumeration/bloodhound-edge-reference.md) (read, core)