Skip to content
HackIndex logo

HackIndex

SMB User and Domain Enumeration

1 min read Jul 14, 2026

SMB leaks user lists, groups, and sessions. RID brute confirms domain context and valid SIDs.

NetExec User and Group Enumeration

Domain users:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --users

Local/domain groups:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --groups

Active sessions:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --sessions

Logged-on users:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --loggedon-users

RID Brute Force

Username from SID:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --rid-brute

Outputs valid usernames and SIDs up to threshold.

Impacket SID Lookup

Authenticated SID brute:

┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP

Resolves SIDs to names.

enum4linux-ng Full Enumeration

Comprehensive legacy-style:

┌──(kali㉿kali)-[~]
└─$ enum4linux-ng -A $TARGET_IP

Covers users, groups, shares, policy.

User lists feed into AD Password Spraying and AS-REP Roastable Account Enumeration. For deeper SID-based enumeration, see MSRPC SID Brute Forcing.

References