Skip to content
HackIndex logo

HackIndex

Windows User and Group Enumeration

3 min read Jul 14, 2026

User and group enumeration maps the access control landscape on the target. It tells you who has admin rights, what groups exist, and which accounts are viable targets for credential attacks or lateral movement. In domain environments, this extends to all users and groups across the domain.

Local users and groups

PS C:\Users\Guest\Desktop> # All local users
PS C:\Users\Guest\Desktop> net user
PS C:\Users\Guest\Desktop> Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet, PasswordNeverExpires
 
PS C:\Users\Guest\Desktop> # Details on specific user
PS C:\Users\Guest\Desktop> net user $USER
PS C:\Users\Guest\Desktop> Get-LocalUser -Name $USER | Select-Object *
 
PS C:\Users\Guest\Desktop> # Currently logged in users
PS C:\Users\Guest\Desktop> query user
PS C:\Users\Guest\Desktop> qwinsta
 
PS C:\Users\Guest\Desktop> # Current user context
PS C:\Users\Guest\Desktop> whoami
PS C:\Users\Guest\Desktop> whoami /all
PS C:\Users\Guest\Desktop> whoami /priv
PS C:\Users\Guest\Desktop> # All local groups
PS C:\Users\Guest\Desktop> net localgroup
PS C:\Users\Guest\Desktop> Get-LocalGroup
 
PS C:\Users\Guest\Desktop> # High-value group memberships
PS C:\Users\Guest\Desktop> net localgroup Administrators
PS C:\Users\Guest\Desktop> net localgroup "Remote Desktop Users"
PS C:\Users\Guest\Desktop> net localgroup "Remote Management Users"
PS C:\Users\Guest\Desktop> net localgroup "Backup Operators"
 
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-LocalGroupMember -Group 'Administrators'
PS C:\Users\Guest\Desktop> Get-LocalGroupMember -Group 'Remote Desktop Users'

Domain users and groups

These commands require domain connectivity and run in the context of the current domain-joined user. No additional tools needed beyond what is built into Windows.

PS C:\Users\Guest\Desktop> # All domain users
PS C:\Users\Guest\Desktop> net user /domain
 
PS C:\Users\Guest\Desktop> # Details on specific domain user
PS C:\Users\Guest\Desktop> net user $USER /domain
 
PS C:\Users\Guest\Desktop> # Domain admins
PS C:\Users\Guest\Desktop> net group "Domain Admins" /domain
 
PS C:\Users\Guest\Desktop> # Enterprise Admins
PS C:\Users\Guest\Desktop> net group "Enterprise Admins" /domain
 
PS C:\Users\Guest\Desktop> # All domain groups
PS C:\Users\Guest\Desktop> net group /domain
 
PS C:\Users\Guest\Desktop> # PowerShell with ADSI (no RSAT needed)
PS C:\Users\Guest\Desktop> ([adsisearcher]"objectCategory=person").FindAll() | ForEach-Object { $_.Properties['samaccountname'] }
 
PS C:\Users\Guest\Desktop> # Find users with no pre-auth required (ASREPRoasting candidates)
PS C:\Users\Guest\Desktop> ([adsisearcher]"(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=4194304))").FindAll() | ForEach-Object { $_.Properties['samaccountname'] }
PS C:\Users\Guest\Desktop> # All domain groups
PS C:\Users\Guest\Desktop> net group /domain
 
PS C:\Users\Guest\Desktop> # Privileged groups
PS C:\Users\Guest\Desktop> net group "Domain Admins" /domain
PS C:\Users\Guest\Desktop> net group "Schema Admins" /domain
PS C:\Users\Guest\Desktop> net group "Group Policy Creator Owners" /domain
PS C:\Users\Guest\Desktop> net group "DnsAdmins" /domain
 
PS C:\Users\Guest\Desktop> # Find groups with admin-like names
PS C:\Users\Guest\Desktop> ([adsisearcher]"objectCategory=group").FindAll() | ForEach-Object { $_.Properties['cn'] } | Select-String -Pattern 'admin|operator|helpdesk|it|support' -CaseSensitive:$false

Token privileges

Dangerous token privileges give direct escalation paths regardless of group membership. Check these before anything else.

PS C:\Users\Guest\Desktop> whoami /priv
 
PS C:\Users\Guest\Desktop> # Filter for dangerous privileges
PS C:\Users\Guest\Desktop> whoami /priv | findstr /i "SeImpersonate SeBackup SeRestore SeDebug SeTakeOwnership SeAssignPrimaryToken SeLoadDriver" 
Privilege Name                Description                               State
============================= ========================================= ========
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeBackupPrivilege             Back up files and directories             Disabled

Disabled privileges can still be enabled programmatically — a Disabled state does not mean the privilege is unavailable. If SeImpersonatePrivilege is present in any state, escalation to SYSTEM is likely possible. See Token Impersonation.

Password policy

The password policy tells you whether brute force or spraying is viable without risking account lockouts.

PS C:\Users\Guest\Desktop> # Local policy
PS C:\Users\Guest\Desktop> net accounts
 
PS C:\Users\Guest\Desktop> # Domain policy
PS C:\Users\Guest\Desktop> net accounts /domain
 
PS C:\Users\Guest\Desktop> # Fine-grained password policies (AD)
PS C:\Users\Guest\Desktop> ([adsisearcher]"objectClass=msDS-PasswordSettings").FindAll() 
Lockout threshold:                            5
Lockout duration (minutes):                   30
Lockout observation window (minutes):         30