Skip to content
HackIndex.io

SMB User and Domain Enumeration

3 min read Created Jan 4, 2026 Last updated Jul 14, 2026

SMB exposes user and group data through RPC calls over port 445. The SAM database supplies account lists on standalone hosts. Domain controllers return domain account lists when queried with sufficient access. Service accounts are high-value targets alongside regular user accounts. They often hold weak or reused passwords and tend to run with elevated privileges. Disabled accounts appear in the output but cannot authenticate, so filter them before building spray lists.

NetExec User and Group Enumeration

Domain users:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --users

The output includes badpwdcount, last logon timestamps, and description fields. Check descriptions carefully. Administrators frequently leave passwords or credential hints in account descriptions. High badpwdcount values signal accounts close to lockout; skip those during spray phases. Local and domain groups:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --groups

Group membership maps the privilege structure. High-value groups to watch for:

  • Domain Admins, Enterprise Admins, local Administrators
  • Backup Operators (can read any file on the system)
  • Account Operators (can modify most domain accounts)
  • Remote Desktop Users (RDP access to servers)
  • Custom groups tied to databases, shares, or internal applications

Active sessions:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --sessions

Sessions show current connections to the target over SMB. A domain admin session on a workstation is a lateral movement opportunity. The session source IP tells you where to redirect attacks if you later compromise the target. Logged-on users:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --loggedon-users

Logged-on users includes interactive sessions, network logins, and cached credentials. This list is valuable after gaining access to a host because it identifies which hashes or tickets are worth extracting from memory. If a domain admin is logged on, that machine becomes the priority target for credential extraction.

RID Brute Force

Username from SID:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --rid-brute

RID brute cycles through Security Identifier values to resolve account names. Works on misconfigured hosts that permit null sessions without credentials. The default range covers RIDs 500 through 4000, which captures all built-in accounts and most domain user objects. Machine accounts appear with a trailing $ in the output. Exclude those before building spray lists.

Impacket SID Lookup

Authenticated SID brute:

┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP

impacket-lookupsid operates over the LSARPC named pipe and resolves SIDs to account names and types. It is more reliable than null-session RID brute on hardened targets because it uses authenticated RPC. Output distinguishes domain users, domain groups, and aliases, which helps separate spray candidates from non-user objects.

enum4linux-ng Full Enumeration

Comprehensive legacy-style:

┌──(kali㉿kali)-[~]
└─$ enum4linux-ng -A $TARGET_IP

enum4linux-ng covers users, groups, shares, password policy, and OS fingerprinting in one run. The password policy output is critical before any spray attempt. It shows minimum password length, lockout threshold, and observation window. A lockout threshold of 0 means no lockout and spray is safe. Any non-zero threshold means you must stay below it across all accounts. Machine accounts in the user list end in $ and should be filtered before spraying. Strip those and feed the remaining list into spray or AS-REP roasting workflows.

User lists feed into AD Password Spraying and AS-REP Roastable Account Enumeration. For deeper SID-based enumeration, see MSRPC SID Brute Forcing.

References