Skip to content
HackIndex.io

SAMR LSA Enumeration with rpcclient

4 min read Created Jan 4, 2026 Last updated May 15, 2026

rpcclient binds directly to the SAMR and LSA named pipes over SMB. SAMR exposes domain user and group objects. LSA exposes the domain SID and trust relationships. Null sessions work when the DC allows anonymous IPC$ access. This is common in legacy Windows domains and some lab environments. If anonymous fails, use any valid low-privilege credential instead.

Anonymous rpcclient Connection

Null session:

┌──(kali㉿kali)-[~]
└─$ rpcclient -U '' -N $TARGET_IP 
enumdomusers
enumdomgroups
lsaquery
getdompwinfo
netshareenum
netshareenumall
srvinfo
Explain command
-U '' Connect with an empty/anonymous username (null session).
-N Suppress password prompt, use no password (null authentication).
$TARGET_IP Placeholder for the target host IP address to connect to.

  • enumdomusers returns every domain account with its RID. The RID is the numeric suffix shown in brackets. Use RIDs with queryuser to pull account flags, password age, and last logon time.

  • enumdomgroups lists all domain groups with their RIDs. Note the RID of privileged groups such as Domain Admins. Pass those RIDs to querygroupmem to enumerate their members.

  • lsaquery returns the domain SID. Combine it with any user RID to build a full SID for lookupsids or ACL analysis.

  • getdompwinfo reveals the minimum password length, complexity requirement, and lockout threshold. A lockout count of 0 means no lockout is enforced. Counts of 3 to 5 require slow spraying to avoid locking accounts.

Authenticated rpcclient

Even a low-privilege account gives full SAMR read access in most domains. Authenticated sessions work regardless of RestrictAnonymous settings. Standard creds:

┌──(kali㉿kali)-[~]
└─$ rpcclient -U "$DOMAIN\\$USER%$PASSWORD" $TARGET_IP
Explain command
-U "$DOMAIN\\$USER%$PASSWORD" Specifies credentials in DOMAIN\username%password format for authentication.
$TARGET_IP Target host IP address to connect to via RPC.

If you have Kerberos credentials cached, the -k flag requests a ticket-based session. The flag is deprecated in current samba builds and unreliable on modern targets. Prefer NTLM credentials when available.

Kerberos:

┌──(kali㉿kali)-[~]
└─$ rpcclient -k $TARGET_IP
Explain command
-k Use Kerberos authentication instead of NTLM.
$TARGET_IP Placeholder for the target host IP address or hostname.

Once inside the rpcclient shell, query individual accounts by RID. The RID is the number shown in brackets by enumdomusers. For example, [0x1f4] is decimal 500, the built-in Administrator. Query user details:

rpcclient $> queryuser <RID>

queryuser returns account flags, last logon time, logon count, and password expiry state. A logon count of 0 means the account was created but never used. Accounts with PASSWD_NOTREQD in the flags field can authenticate with an empty password. Group members:

rpcclient $> querygroup <RID>
rpcclient $> querygroupmem <RID>

querygroup returns the group description and attribute count. querygroupmem returns the RID of every member. Run queryuser against each returned RID to build a full picture of group membership. Use this pattern to enumerate Domain Admins without triggering Kerberoast or AS-REP collection noise. Resolve names:

rpcclient $> lookupnames $USERNAME
rpcclient $> lookupsids $SID-<RID>

lookupnames returns the account type and full SID. lookupsids translates a SID back to an account name. This is useful when ACL enumeration returns raw foreign SIDs and you need to identify the principals. Combine the domain SID from lsaquery with RIDs from enumdomusers to build a SID list for bulk resolution.

net rpc Variants

net rpc wraps the same SAMR calls in a non-interactive format. Use it in scripts or when rpcclient fails to hold an interactive session.

Group members anonymous:

┌──(kali㉿kali)-[~]
└─$ net rpc group members 'Domain Users' -I $TARGET_IP -U ''
Explain command
group Specifies the RPC group management subcommand.
members Lists all members of the specified group.
'Domain Users' Target group name to enumerate members from.
-I $TARGET_IP Specifies the IP address of the target host.
-U '' Authenticates with an empty/null username (anonymous).

Requires workgroup match sometimes. If the command returns NT_STATUS_LOGON_FAILURE with empty credentials, the target requires a workgroup match. Pass it with -W or --workgroup to match the NetBIOS domain name. SAMR enumeration fails entirely when RestrictAnonymous is set to 2 in the registry. At that level, anonymous IPC$ connections are blocked. A low-privilege account bypasses this restriction. RestrictAnonymousSAM set to 1 blocks only anonymous user enumeration, not other IPC access.

SAMR queries generate Windows Security event log entries on monitored environments. Event IDs 4661 and 4662 appear when SAMR objects are accessed. Keep this in mind on red team engagements with active detection.

User and group output from SAMR is a direct input for AD Password Spraying. Before running any spray, check which accounts have pre-authentication disabled: see AS-REP Roastable Account Enumeration. For broader null-session enumeration including share and policy data, see SMB Null Session Enumeration.

References