# LDAP Authenticated Deep Dive

- **URL:** https://hackindex.io/services/ldap/enumeration/ldap-authenticated-deep-dive
- **Path:** LDAP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ldap/enumeration.md)
- **Published:** 2026-04-05
- **Updated:** 2026-05-15

Beyond user and group enumeration, authenticated LDAP access exposes domain trusts, Group Policy objects, organizational unit structure, computer accounts, and ACL configurations that reveal attack paths not visible in basic queries. Run this when you have credentials and need a complete picture of the domain before planning your next move.

## Domain and forest structure

**Domain and forest enumeration**

```bash
# Domain controllers
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" dNSHostName operatingSystem

# Domain trusts
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=System,$BASE_DN" "(objectClass=trustedDomain)" name trustDirection trustType trustAttributes flatName

# Sites and subnets (reveals internal network layout)
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Sites,CN=Configuration,$BASE_DN" "(objectClass=site)" cn
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Subnets,CN=Sites,CN=Configuration,$BASE_DN" "(objectClass=subnet)" cn siteObject
```

`trustDirection` values: 1 = inbound (they trust us), 2 = outbound (we trust them), 3 = bidirectional. An outbound trust means accounts from the trusted domain can authenticate in this domain. `trustAttributes` value 8 means the trust is transitive: it extends to all domains trusted by the trusted domain. For exploitation paths, see [AD Domain Trust Abuse](https://hackindex.io/platforms/active-directory/post-exploitation/ad-domain-trust-abuse).

## Organizational units

OU structure tells you how the environment is organised and where specific computer types and users live. High-value OUs to note: servers, domain controllers, service accounts, and any OU that appears locked down differently from the rest.

**OU structure enumeration**

```bash
# All OUs with description
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=organizationalUnit)" ou description

# Objects in a specific OU
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "OU=Servers,$BASE_DN" "(objectClass=computer)" dNSHostName operatingSystem

# Count objects per OU
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=organizationalUnit)" ou | grep "^ou:"
```

## Computer accounts

Computer accounts are often overlooked as attack targets. They have passwords, can have SPNs, and can have delegation configured. A machine account compromise can be leveraged the same way a user account can.

**Computer account enumeration**

```bash
# All computers with OS and last logon
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=computer)" dNSHostName operatingSystem operatingSystemVersion lastLogon sAMAccountName

# Computers with SPNs set
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=computer)(servicePrincipalName=*))" dNSHostName servicePrincipalName

# Computers not logged in for 90+ days (stale: often unpatched)
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=computer)(lastLogon<=133000000000000000))" dNSHostName operatingSystem
```

## Group Policy Objects

GPOs frequently contain useful information: local admin configurations, software deployments, logon scripts, and occasionally hardcoded credentials in script paths. The GPO name alone tells you a lot about what is being configured.

**GPO enumeration**

```bash
# All GPOs
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Policies,CN=System,$BASE_DN" "(objectClass=groupPolicyContainer)" displayName gPCFileSysPath

# GPO links on OUs
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(gPLink=*)" distinguishedName gPLink

# Read GPO files from SYSVOL (credentials often in scripts)
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Policies,CN=System,$BASE_DN" "(objectClass=groupPolicyContainer)" gPCFileSysPath | grep gPCFileSysPath
# gPCFileSysPath: \\corp.local\SysVol\corp.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
```

The `gPCFileSysPath` value is the UNC path to the GPO's files on SYSVOL. Mount that path via SMB and inspect the scripts and XML files: Group Policy Preferences XML files historically contained encrypted passwords (`cpassword`) that are trivially decrypted with a published AES key.

## ACL-based attack paths

Object ACLs in AD control who can modify objects. Misconfigurations like WriteDACL, GenericWrite, or ForceChangePassword rights on high-value objects allow privilege escalation without exploiting any software vulnerability.

**ACL enumeration with windapsearch**

```bash
# Read ACL of a specific object
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(sAMAccountName=targetuser)" nTSecurityDescriptor

# windapsearch: formatted ACL output
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD custom --filter "(sAMAccountName=Domain Admins)" --attrs nTSecurityDescriptor

# BloodHound is the most effective tool for ACL path analysis
# Run SharpHound on a domain-joined host:
SharpHound.exe -c All --outputdirectory C:\Windows\Temp\bh

# Or from Linux with BloodHound.py
pipx install bloodhound
bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All
```

BloodHound is the most practical tool for ACL-based attack path analysis. After collection, the pre-built queries **Shortest Paths to Domain Admins** and **Find Principals with DCSync Rights** immediately surface the most direct escalation paths in the environment. For structured ACL enumeration see [Active Directory ACL Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-acl-enumeration); for exploitation see [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation).

## Using windapsearch for structured output

windapsearch wraps common AD LDAP queries and formats output cleanly. Faster than raw ldapsearch for most tasks.

**windapsearch common queries**

```bash
# All users
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD users

# All computers
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD computers

# All groups
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD groups

# Privileged users
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD privileged-users

# GPOs
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD gpos

# Unconstrained delegation
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD unconstrained-users
windapsearch -d $DOMAIN --dc $TARGET_IP -u $USER -p $PASSWORD unconstrained-computers
```

Where to go from here:

- Unconstrained delegation results feed into [Unconstrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/unconstrained-delegation-abuse)
- ADCS template misconfigurations go to [ADCS Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/adcs-misconfiguration-discovery)
- ACL issues on high-value objects go to [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation)

## References

- [windapsearch: GitHub](https://github.com/ropnop/windapsearch) - Full module list and custom query syntax
- [BloodHound.py: GitHub](https://github.com/dirkjanm/BloodHound.py) - Linux-based BloodHound data collector
- [SharpHound: GitHub](https://github.com/BloodHoundAD/SharpHound) - Windows-based BloodHound collector, full collection methods