Active Directory:

Reconnaissance

Discover AD domains, DCs, and users without credentials

2 guides • Created Apr 5, 2026 • Updated Aug 11, 2026

2 guides

AD Domain and DC Discovery

Techniques for enumerating AD domains and locating Domain Controllers using DNS, LDAP, and native Windows tools during initial reconnaissance.

Jun 9, 2026 • 4 min read

Unauthenticated User Enumeration

Identifies valid AD usernames without credentials using Kerberos pre-auth errors, LDAP null binds, and SMB probing to map attack surface.

Jun 9, 2026 • 3 min read

AD reconnaissance gathers domain information without direct interaction with the target environment. This means passive DNS lookups, public certificate transparency logs, and metadata leakage from exposed documents and services.

DNS records reveal domain controller hostnames, mail servers, and naming conventions. Certificate transparency databases expose internal hostnames and subdomain structures registered through public CAs. Metadata from publicly accessible documents, job postings, and code repositories can leak internal domain names, usernames, and software versions.