# Enumeration

> RPC endpoint scanning, SAMR/LSA queries, SID brute forcing, coercion interf

- **URL:** https://hackindex.io/services/msrpc/enumeration
- **Service:** [MSRPC](https://hackindex.io/services/msrpc.md)
- **Tags:** services, users, endpoints
- **Published:** 2026-01-04
- **Updated:** 2026-03-29

MSRPC enumeration maps the RPC endpoints exposed on a Windows host. The endpoint mapper on port 135 reveals registered interfaces, their UUIDs, and the named pipes or TCP ports they bind to.

Interface discovery identifies services like SAMR, LSARPC, and DRSUAPI that enable further enumeration. Through these interfaces you can pull user and group lists, SID lookups, password policies, and share information without needing domain credentials in many configurations.

## Guides

- [Detecting Sensitive MSRPC Interfaces](https://hackindex.io/services/msrpc/enumeration/detecting-sensitive-msrpc-interfaces.md): Enumerates exposed MSRPC interfaces to identify sensitive endpoints like SAMR, LSARPC, and DRSUAPI that may allow credential theft or privilege escalation.
- [MSRPC Endpoint Enumeration](https://hackindex.io/services/msrpc/enumeration/msrpc-endpoint-enumeration.md)
- [MSRPC SID Brute Forcing](https://hackindex.io/services/msrpc/enumeration/msrpc-sid-brute-forcing.md): Enumerate valid Windows SIDs via MSRPC using brute-force techniques to discover user accounts, groups, and domain objects through the LSA and SAMR interfaces.
- [SAMR LSA Enumeration with rpcclient](https://hackindex.io/services/msrpc/enumeration/samr-lsa-enumeration-with-rpcclient.md)