Skip to content
HackIndex logo

HackIndex

Kerberos Valid User Enumeration

4 min read May 15, 2026

Kerberos responses on a DC can distinguish valid principals from nonexistent ones. This builds a high-confidence user list for AS-REP roastable account discovery and AD password spraying.

Fast no-cred enumeration with kerbrute

Hit the DC directly. This is the default move when only $DOMAIN and a DC IP are known.

┌──(kali㉿kali)-[~]
└─$ kerbrute userenum -d $DOMAIN --dc $TARGET_IP users.txt
Explain command
userenum Enumerate valid domain usernames via Kerberos pre-auth bruteforcing.
-d $DOMAIN Specifies the target Active Directory domain to enumerate against.
--dc $TARGET_IP Specifies the domain controller IP to send Kerberos requests to.
users.txt Wordlist file containing usernames to test against the domain.

Interpretation:

  • Lines indicating validity are the output of interest. Save confirmed users and stop wasting time on the rest.

  • If results are inconsistent, reduce rate and retry to rule out throttling/noise.

Large lists:

┌──(kali㉿kali)-[~]
└─$ kerbrute userenum -d $DOMAIN --dc $TARGET_IP /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
Explain command
userenum Subcommand to enumerate valid domain usernames via Kerberos.
-d $DOMAIN Specifies the target Active Directory domain name.
--dc $TARGET_IP Specifies the domain controller IP to send Kerberos requests to.
/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt Wordlist file containing usernames to test against the domain.

Cross-check via LDAP surface with nxc

If anonymous LDAP allows enumeration, it’s faster and richer than Kerberos-only signals.

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP --users
Explain command
$TARGET_IP Target IP address of the LDAP server to connect to.
--users Enumerate user accounts from the LDAP directory.

Interpretation:

  • If it returns users without creds, pivot to LDAP-based enumeration for attributes/groups.

  • If it fails or is empty, stick to Kerberos-driven validation and only use LDAP when creds exist.

Kerberos-backed validity check with empty password attempts (nxc)

This is not “login”; it’s a way to differentiate responses when Kerberos is in play. Keep it controlled and within engagement rules.

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u users.txt -p '' --kerberos --continue-on-success
Explain command
$TARGET_IP Target host IP address for the LDAP connection.
-u users.txt File containing list of usernames to authenticate with.
-p '' Uses an empty string as the password for each attempt.
--kerberos Authenticates using Kerberos instead of NTLM.
--continue-on-success Continues spraying even after a successful authentication.

Interpretation:

  • Response differences usually separate “valid user but bad creds” from “user does not exist”.

  • If everything looks identical, the environment may normalize errors; rely on kerbrute output instead.

Authenticated user pull with Impacket GetADUsers

Use this when credentials exist or anonymous binds are allowed in the environment.

Anonymous/no-pass attempt:

┌──(kali㉿kali)-[~]
└─$ impacket-GetADUsers "$DOMAIN/" -no-pass -dc-ip $TARGET_IP
Explain command
$DOMAIN/ Target Active Directory domain to query users from.
-no-pass Attempt authentication without a password (null/anonymous session).
-dc-ip $TARGET_IP Specifies the IP address of the Domain Controller to connect to.

Authenticated:

┌──(kali㉿kali)-[~]
└─$ impacket-GetADUsers "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP
Explain command
$DOMAIN/$USER:$PASSWORD Target domain with authenticating username and password credentials.
-dc-ip $TARGET_IP Specifies the IP address of the domain controller to query.

Interpretation:

  • Authenticated output is useful for UAC flags, disabled accounts, and narrowing to sprayable users.

  • If -no-pass fails, don’t loop it. Move on.

Nmap Kerberos script (slow, situational)

Good when Nmap is already running and a quick integrated check is needed.

┌──(kali㉿kali)-[~]
└─$ nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm=$DOMAIN,userdb=users.txt $TARGET_IP
Explain command
-p 88 Scan only port 88, the default Kerberos authentication port.
--script krb5-enum-users Run NSE script to enumerate valid Kerberos usernames.
--script-args krb5-enum-users.realm=$DOMAIN Set the Kerberos realm/domain to target for enumeration.
userdb=users.txt Specify a wordlist file of usernames to test against Kerberos.
$TARGET_IP Placeholder for the IP address of the target Kerberos/DC host.

Interpretation:

  • Treat this as a confirmation path, not the primary enumerator.

Manual validation with kinit error parsing

Useful when tool output is ambiguous or a minimal-dependency check is needed.

for u in $(cat users.txt); do
  kinit "$u@@$DOMAIN" <<< "" 2>&1 | grep -qi "not found" || echo "$u"
done

Interpretation:

  • Filter on “principal not found” style errors.

  • Anything else is not automatically “valid and sprayable”; it can also mean “preauth required”, “password incorrect”, “client not found”, policy blocks, etc. Treat it as “needs follow-up”.

References