# SMB Host Security Enumeration

> Enumerate SMB hosts to identify shares, sessions, users, and misconfigurations using tools like enum4linux, smbclient, and Nmap scripts.

- **URL:** https://hackindex.io/services/smb/enumeration/smb-host-security-enumeration
- **Path:** SMB > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/smb/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

Host details reveal multi-homed interfaces, AV presence, and vulnerable configs.

## NetExec Security Checks

Network interfaces:

```bash
nxc smb $TARGET_IP --interfaces
```

Leaks additional IPs.

Disks and volumes:

```bash
nxc smb $TARGET_IP --disks
```

BitLocker status:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M bitlocker
```

AV/EDR products:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M enum_av
```

SCCM presence:

```bash
nxc smb $TARGET_IP --sccm
```

Processes with creds:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD --tasklist
```

Key areas to check during host security enumeration:

- Network interfaces and additional IPs (multi-homed hosts)
- AV/EDR products installed on the target
- BitLocker encryption status on volumes
- SCCM client presence (deployment infrastructure)
- Running processes and loaded services

For SMB signing posture, see [SMB Signing Not Required Detection](https://hackindex.io/services/smb/vulnerability-discovery/smb-signing-not-required-detection) and [NTLM Relay Conditions](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ntlm-relay-conditions).

## References

- [NetExec repository](https://github.com/Pennyw0rth/NetExec) - Host configuration and AV enumeration