# Kerberos Valid User Enumeration

> Enumerate valid AD usernames via Kerberos pre-auth errors using tools like Kerbrute, exploiting AS-REQ responses to identify existing accounts without authentication.

- **URL:** https://hackindex.io/services/kerberos/enumeration/kerberos-valid-user-enumeration
- **Path:** Kerberos > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/kerberos/enumeration.md)
- **Published:** 2026-01-03
- **Updated:** 2026-08-17

Kerberos responses on a DC can distinguish valid principals from nonexistent ones. This builds a high-confidence user list for [AS-REP roastable account discovery](https://hackindex.io/services/kerberos/enumeration/as-rep-roastable-account-enumeration) and [AD password spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying).

## Fast no-cred enumeration with kerbrute

Hit the DC directly. This is the default move when only `$DOMAIN` and a DC IP are known.

```bash
kerbrute userenum -d $DOMAIN --dc $TARGET_IP users.txt
```

Interpretation:

- Lines indicating validity are the output of interest. Save confirmed users and stop wasting time on the rest.
- If results are inconsistent, reduce rate and retry to rule out throttling/noise.

Large lists:

```bash
kerbrute userenum -d $DOMAIN --dc $TARGET_IP /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
```

## Cross-check via LDAP surface with nxc

If anonymous LDAP allows enumeration, it’s faster and richer than Kerberos-only signals.

```bash
nxc ldap $TARGET_IP --users
```

Interpretation:

- If it returns users without creds, pivot to LDAP-based enumeration for attributes/groups.
- If it fails or is empty, stick to Kerberos-driven validation and only use LDAP when creds exist.

## Kerberos-backed validity check with empty password attempts (nxc)

This is not “login”; it’s a way to differentiate responses when Kerberos is in play. Keep it controlled and within engagement rules.

```bash
nxc ldap $TARGET_IP -u users.txt -p '' --kerberos --continue-on-success
```

Interpretation:

- Response differences usually separate “valid user but bad creds” from “user does not exist”.
- If everything looks identical, the environment may normalize errors; rely on kerbrute output instead.

## Authenticated user pull with Impacket GetADUsers

Use this when credentials exist or anonymous binds are allowed in the environment.

Anonymous/no-pass attempt:

```bash
impacket-GetADUsers "$DOMAIN/" -no-pass -dc-ip $TARGET_IP
```

Authenticated:

```bash
impacket-GetADUsers "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP
```

Interpretation:

- Authenticated output is useful for UAC flags, disabled accounts, and narrowing to sprayable users.
- If `-no-pass` fails, don’t loop it. Move on.

## Nmap Kerberos script (slow, situational)

Good when Nmap is already running and a quick integrated check is needed.

```bash
nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm=$DOMAIN,userdb=users.txt $TARGET_IP
```

Interpretation:

- Treat this as a confirmation path, not the primary enumerator.

## Manual validation with kinit error parsing

Useful when tool output is ambiguous or a minimal-dependency check is needed.

```bash
for u in $(cat users.txt); do
  kinit "$u@$DOMAIN" <<< "" 2>&1 | grep -qi "not found" || echo "$u"
done

```

Interpretation:

- Filter on “principal not found” style errors.
- Anything else is not automatically “valid and sprayable”; it can also mean “preauth required”, “password incorrect”, “client not found”, policy blocks, etc. Treat it as “needs follow-up”.

## References

- [kerbrute](https://github.com/ropnop/kerbrute) - Kerberos user enumeration tool
- [NetExec](https://github.com/Pennyw0rth/NetExec) - CrackMapExec successor with LDAP/Kerberos workflows
- [Impacket](https://github.com/fortra/impacket) - Includes GetADUsers for AD user enumeration
- [Nmap krb5-enum-users NSE](https://nmap.org/nsedoc/scripts/krb5-enum-users.html) - Kerberos user enumeration script
- [MIT Kerberos kinit](https://web.mit.edu/kerberos/krb5-latest/doc/user/user_commands/kinit.html) - CLI behavior and error context