Skip to content
HackIndex logo

HackIndex

SAMR LSA Enumeration with rpcclient

2 min read May 15, 2026

rpcclient binds to SAMR/LSA pipes for domain context. Anonymous often works on DCs; pulls users, groups, policy.

Anonymous rpcclient Connection

Null session:

┌──(kali㉿kali)-[~]
└─$ rpcclient -U '' -N $TARGET_IP 
enumdomusers
enumdomgroups
lsaquery
getdompwinfo
netshareenum
netshareenumall
srvinfo
Explain command
-U '' Connect with an empty/anonymous username (null session).
-N Suppress password prompt, use no password (null authentication).
$TARGET_IP Placeholder for the target host IP address to connect to.

  • enumdomusers - returns [username] [RID].

  • enumdomgroups - lists groups with RIDs.

  • lsaquery - shows domain SID.

  • getdompwinfo - leaks lockout and complexity.

Authenticated rpcclient

Standard creds:

┌──(kali㉿kali)-[~]
└─$ rpcclient -U "$DOMAIN\\$USER%$PASSWORD" $TARGET_IP
Explain command
-U "$DOMAIN\\$USER%$PASSWORD" Specifies credentials in DOMAIN\username%password format for authentication.
$TARGET_IP Target host IP address to connect to via RPC.

Kerberos:

┌──(kali㉿kali)-[~]
└─$ rpcclient -k $TARGET_IP
Explain command
-k Use Kerberos authentication instead of NTLM.
$TARGET_IP Placeholder for the target host IP address or hostname.

Query user details:

rpcclient $> queryuser <RID>

Group members:

rpcclient $> querygroup <RID>
rpcclient $> querygroupmem <RID>

Resolve names:

rpcclient $> lookupnames $USERNAME
rpcclient $> lookupsids $SID-<RID>

net rpc Variants

Group members anonymous:

C:\Users\Guest\Desktop> net rpc group members 'Domain Users' -I $TARGET_IP -U ''
Explain command
group Specifies the RPC group management subcommand.
members Lists all members of the specified group.
'Domain Users' Target group name to enumerate members from.
-I $TARGET_IP Specifies the IP address of the target host.
-U '' Authenticates with an empty/null username (anonymous).

Requires workgroup match sometimes.

User and group output from SAMR is a direct input for AD Password Spraying. Before running any spray, check which accounts have pre-authentication disabled — see AS-REP Roastable Account Enumeration. For broader null-session enumeration including share and policy data, see SMB Null Session Enumeration.