Active Directory:

Enumeration

AD object, ACL, and attack path enumeration using BloodHound and more

5 guides • Created Apr 5, 2026 • Updated Aug 11, 2026

5 guides

ACL Enumeration

Techniques for enumerating Access Control Lists in Active Directory to identify misconfigured permissions and potential privilege escalation paths.

Apr 5, 2026 • 4 min read

Object Enumeration

Enumerates AD objects including users, groups, OUs, and GPOs to map domain structure and identify privilege escalation paths.

Apr 5, 2026 • 8 min read

GPO Enumeration

Techniques for enumerating Group Policy Objects in Active Directory to identify misconfigurations, privileged settings, and potential attack paths.

Jun 11, 2026 • 5 min read

BloodHound and SharpHound Collection

Covers deploying SharpHound to collect AD relationship data and ingesting results into BloodHound to visualise attack paths and privilege escalation routes.

Apr 5, 2026 • 6 min read

BloodHound Edge Reference

Maps AD attack paths via BloodHound edges, detailing exploitation techniques, required privileges, and lateral movement vectors for offensive AD enumeration.

Jun 9, 2026 • 31 min read

AD enumeration maps the domain structure you need before picking an attack path. BloodHound collection, LDAP queries, and native RPC calls reveal users, groups, trusts, ACLs, and service accounts.

Unauthenticated enumeration through null sessions and anonymous LDAP binds is increasingly rare, but still worth checking. With any domain credential, BloodHound and PowerView expose group nesting, delegation settings, GPO links, and ACL chains that manual querying would miss.

Trust enumeration identifies cross-domain and cross-forest relationships that expand your attack surface. ACL mapping shows who can modify what, often the shortest path to escalation.