# SAMR LSA Enumeration with rpcclient

- **URL:** https://hackindex.io/services/msrpc/enumeration/samr-lsa-enumeration-with-rpcclient
- **Path:** MSRPC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/msrpc/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

rpcclient binds directly to the SAMR and LSA named pipes over SMB. SAMR exposes domain user and group objects. LSA exposes the domain SID and trust relationships. Null sessions work when the DC allows anonymous IPC$ access. This is common in legacy Windows domains and some lab environments. If anonymous fails, use any valid low-privilege credential instead.

## Anonymous rpcclient Connection

Null session:

```bash
rpcclient -U '' -N $TARGET_IP
# enumdomusers
# enumdomgroups
# lsaquery
# getdompwinfo
# netshareenum
# netshareenumall
# srvinfo
```

- enumdomusers returns every domain account with its RID. The RID is the numeric suffix shown in brackets. Use RIDs with queryuser to pull account flags, password age, and last logon time.
- enumdomgroups lists all domain groups with their RIDs. Note the RID of privileged groups such as Domain Admins. Pass those RIDs to querygroupmem to enumerate their members.
- lsaquery returns the domain SID. Combine it with any user RID to build a full SID for lookupsids or ACL analysis.
- getdompwinfo reveals the minimum password length, complexity requirement, and lockout threshold. A lockout count of 0 means no lockout is enforced. Counts of 3 to 5 require slow spraying to avoid locking accounts.

## Authenticated rpcclient

Even a low-privilege account gives full SAMR read access in most domains. Authenticated sessions work regardless of RestrictAnonymous settings. Standard creds:

```bash
rpcclient -U "$DOMAIN\\$USER%$PASSWORD" $TARGET_IP
```

If you have Kerberos credentials cached, the -k flag requests a ticket-based session. The flag is deprecated in current samba builds and unreliable on modern targets. Prefer NTLM credentials when available.

Kerberos:

> [!WARNING]
> WARNING: The option -k|--kerberos is deprecated!

```bash
rpcclient -k $TARGET_IP
```

Once inside the rpcclient shell, query individual accounts by RID. The RID is the number shown in brackets by enumdomusers. For example, [0x1f4] is decimal 500, the built-in Administrator. Query user details:

```bash
queryuser <RID>
```

queryuser returns account flags, last logon time, logon count, and password expiry state. A logon count of 0 means the account was created but never used. Accounts with PASSWD_NOTREQD in the flags field can authenticate with an empty password. Group members:

```bash
querygroup <RID>
querygroupmem <RID>
```

querygroup returns the group description and attribute count. querygroupmem returns the RID of every member. Run queryuser against each returned RID to build a full picture of group membership. Use this pattern to enumerate Domain Admins without triggering Kerberoast or AS-REP collection noise. Resolve names:

```bash
lookupnames $USERNAME
lookupsids $SID-<RID>
```

lookupnames returns the account type and full SID. lookupsids translates a SID back to an account name. This is useful when ACL enumeration returns raw foreign SIDs and you need to identify the principals. Combine the domain SID from lsaquery with RIDs from enumdomusers to build a SID list for bulk resolution.

## net rpc Variants

net rpc wraps the same SAMR calls in a non-interactive format. Use it in scripts or when rpcclient fails to hold an interactive session.

Group members anonymous:

```bash
net rpc group members 'Domain Users' -I $TARGET_IP -U ''
```

Requires workgroup match sometimes. If the command returns NT_STATUS_LOGON_FAILURE with empty credentials, the target requires a workgroup match. Pass it with -W or --workgroup to match the NetBIOS domain name. SAMR enumeration fails entirely when RestrictAnonymous is set to 2 in the registry. At that level, anonymous IPC$ connections are blocked. A low-privilege account bypasses this restriction. RestrictAnonymousSAM set to 1 blocks only anonymous user enumeration, not other IPC access.

SAMR queries generate Windows Security event log entries on monitored environments. Event IDs 4661 and 4662 appear when SAMR objects are accessed. Keep this in mind on red team engagements with active detection.

User and group output from SAMR is a direct input for [AD Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying). Before running any spray, check which accounts have pre-authentication disabled: see [AS-REP Roastable Account Enumeration](https://hackindex.io/services/kerberos/enumeration/as-rep-roastable-account-enumeration). For broader null-session enumeration including share and policy data, see [SMB Null Session Enumeration](https://hackindex.io/services/smb/enumeration/smb-null-session-enumeration).

## References

- [rpcclient(1) Man Page](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) - rpcclient manual page with SAMR and LSA command reference
- [MS-SAMR Protocol Documentation](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/) - Microsoft SAMR protocol specification for domain account management