# Impacket Getnpusers

> Use for AS-REP roasting exposure review during authorized internal pentests. Trigger on Kerberos preauthentication analysis, user account posture review, and validating whether specific accounts create offline password risk.

- Skill: `timsonner/impacket-getnpusers` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-getnpusers`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-getnpusers/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-getnpusers

---


# Impacket GetNPUsers

## Purpose

Use this skill to validate whether approved AD accounts are exposed to AS-REP roasting risk.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Threat Modeling and Test Planning, Retest and Closure

## Use When

- Need to determine whether specific accounts lack Kerberos preauthentication.
- Need to assess whether offline password risk exists for targeted identities.
- Need a repeatable retest after account-hardening changes.

## Avoid When

- The account set is not explicitly approved.
- The check would exceed the agreed identity-testing scope.

## Inputs

- Approved domain and controller
- Narrow list of accounts or a tightly bounded group
- Guidance on whether ticket retrieval is approved

## Procedure

1. Keep the user scope tightly bounded.
2. Validate only the accounts relevant to the current hypothesis.
3. Protect any returned material as sensitive evidence.
4. Correlate the result with password policy and business impact.
5. Preserve the exact user scope for retest.

## Command Syntax

Replace sample domains, controllers, and user lists with approved in-scope values.

```bash
# AS-REP Roast: unauthenticated, enumerate pre-auth disabled accounts
GetNPUsers.py contoso.com/ -dc-ip 10.10.10.10 -usersfile users.txt -no-pass -format hashcat -outputfile contoso-asrep.txt

# Authenticated enumeration (no need for user list)
GetNPUsers.py contoso.com/auditor:'<password>' -dc-ip 10.10.10.10 -format hashcat -outputfile contoso-asrep.txt

# Request hashes for all vulnerable accounts
GetNPUsers.py contoso.com/ -dc-ip 10.10.10.10 -usersfile users.txt -no-pass
```

## Evidence to Capture

- Whether approved accounts are exposed to AS-REP roasting risk
- Exact user scope and domain context used
- Minimal proof needed to support remediation

## Safety Boundaries

- Keep the user list narrow and approved.
- Protect any returned ticket material as sensitive evidence.