Powerview

PowerView

PowerShell Active Directory enumeration toolkit — maps domain structure, ACLs, groups, and privilege escalation paths.

Quick Start

# Load the script
. .\PowerView.ps1

# Enumerate domain users
Get-NetUser

# Find domain admins
Get-NetGroupMember -GroupName "Domain Admins"

# Enumerate computers
Get-NetComputer

# Find interesting shares
Invoke-ShareFinder -Verbose

# Map domain structure
Get-NetDomain

Core Functions

User Enumeration

Group Enumeration

Computer Enumeration

ACL & Permission Enumeration

Forest & Domain Info

Share & File Enumeration

Privilege Escalation Discovery

Common Workflows

Full domain mapping

. .\PowerView.ps1

# 1. Domain structure
Get-NetDomain
Get-NetForestDomain
Get-NetDomainTrust

# 2. User inventory
Get-NetUser | Select name, mail, pwdlastset
Get-NetUser -AdminCount | Select name

# 3. Kerberoastable accounts (crackable)
Get-NetUser -SPN | Select name, serviceprincipalname

# 4. Computers & delegation
Get-NetComputer -Properties name, operatingsystem
Get-NetComputer -Unconstrained | Select name

# 5. Share enumeration
Invoke-ShareFinder

# 6. Privilege paths to Domain Admin
Get-ObjectAcl -Identity "Domain Admins" -ResolveGUIDs

Find privileged users with logged-on sessions

# 1. Get domain admins
$admins = Get-NetGroupMember -GroupName "Domain Admins" | Select -ExpandProperty membername

# 2. Find where they're logged in
foreach ($admin in $admins) {
    Find-DomainUserLocation -UserIdentity $admin
}

# 3. Pivot to their machines

Unconstrained delegation exploitation preparation

# Find unconstrained delegation machines
$unconstrained = Get-NetComputer -Unconstrained | Select name

# These machines can capture TGTs from users
# → Use Rubeus to monitor and capture → forge Golden Ticket

# Review who logs in to these machines
foreach ($comp in $unconstrained.name) {
    Get-NetLoggedOnUser $comp
}

Trust enumeration (forest/cross-domain)

# Forest structure
Get-NetForest

# Inter-domain trusts
Get-NetDomainTrust -Domain corp.local

# Trust direction can enable lateral domain movement

Output Formatting

Filter and export:

# Export users to CSV
Get-NetUser | Export-Csv users.csv

# Find specific attributes
Get-NetUser | Select name, mail, department, manager

# Count by property
Get-NetComputer | Group-Object -Property operatingsystem | Select name, count

Integration with Other Tools

Performance Notes

• Find-LocalAdminAccess → Very slow (queries every computer); use with caution
• Invoke-ACLScanner → Noisy; may trigger alerts
• Add -Verbose for detailed output
• Use -PageSize 1000 to speed up large queries

Resources