Impacket Getnpusers

Impacket GetNPUsers

Purpose

Use this skill to validate whether approved AD accounts are exposed to AS-REP roasting risk.

Phase Fit

• Primary: Vulnerability Analysis
• Secondary: Threat Modeling and Test Planning, Retest and Closure

Use When

• Need to determine whether specific accounts lack Kerberos preauthentication.
• Need to assess whether offline password risk exists for targeted identities.
• Need a repeatable retest after account-hardening changes.

Avoid When

• The account set is not explicitly approved.
• The check would exceed the agreed identity-testing scope.

Inputs

• Approved domain and controller
• Narrow list of accounts or a tightly bounded group
• Guidance on whether ticket retrieval is approved

Procedure

1. Keep the user scope tightly bounded.
2. Validate only the accounts relevant to the current hypothesis.
3. Protect any returned material as sensitive evidence.
4. Correlate the result with password policy and business impact.
5. Preserve the exact user scope for retest.

Command Syntax

Replace sample domains, controllers, and user lists with approved in-scope values.

# AS-REP Roast: unauthenticated, enumerate pre-auth disabled accounts
GetNPUsers.py contoso.com/ -dc-ip 10.10.10.10 -usersfile users.txt -no-pass -format hashcat -outputfile contoso-asrep.txt

# Authenticated enumeration (no need for user list)
GetNPUsers.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10 -format hashcat -outputfile contoso-asrep.txt

# Request hashes for all vulnerable accounts
GetNPUsers.py contoso.com/ -dc-ip 10.10.10.10 -usersfile users.txt -no-pass

Evidence to Capture

• Whether approved accounts are exposed to AS-REP roasting risk
• Exact user scope and domain context used
• Minimal proof needed to support remediation

Safety Boundaries

• Keep the user list narrow and approved.
• Protect any returned ticket material as sensitive evidence.