How do I install the Powerview skill?

Run npx skillmds@latest add timsonner/powerview in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Powerview safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Powerview?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Powerview free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Powerview?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Powerview by timsonner — Agent Skill

Name: Powerview
Author: timsonner

Powerview

Use for PowerShell-based Active Directory reconnaissance during authorized pentests. Trigger on approved domain object review, group and host relationship analysis, local admin exposure checks, and focused AD discovery inside a bounded scope.

timsonner 6d43408 2.5 KB Updated Sep 17, 2026

File contents

PowerView

Purpose

Use this skill for focused PowerShell-based AD reconnaissance when the engagement permits scripted domain discovery within an approved scope.

Phase Fit

Primary: Discovery and Reconnaissance, Vulnerability Analysis
Secondary: Threat Modeling and Test Planning, Retest and Closure

Use When

Need to inspect domain groups, users, computers, or local admin relationships.
Need flexible AD discovery without a full graph collection.
Need a repeatable PowerShell workflow for retest.

Avoid When

Scripted AD reconnaissance is not explicitly approved.
Domain or host scope is unclear.

Inputs

Approved domain or host scope
PowerShell execution constraints and logging expectations
Specific AD question to answer

Procedure

Load only the approved PowerView functions needed for the question.
Keep queries tightly aligned to the current hypothesis.
Record the exact host, user context, and functions used.
Correlate results with bloodhound, ldapsearch, or manual validation.
Preserve the exact query path for retest.

Command Syntax

Replace sample commands with the minimum approved discovery functions.

# Import PowerView
Import-Module .\PowerView.ps1

# Get domain information
Get-Domain -Domain contoso.com

# Enumerate domain users
Get-DomainUser | Select-Object SamAccountName, Description, MemberOf

# List domain administrators
Get-DomainGroupMember -Identity "Domain Admins"

# Find computers where domain admins are logged in
Find-DomainUserLocation -UserGroupIdentity "Domain Admins"

# Enumerate all computers
Get-DomainComputer | Select-Object DNSHostName, OperatingSystem

# Find ACEs interesting for privilege escalation
Find-InterestingDomainAcl -ResolveGUIDs

# Get domain trusts
Get-DomainTrust -Domain contoso.com

# Enumerate Kerberoastable accounts (have SPN)
Get-DomainUser -SPN | Select-Object SamAccountName, ServicePrincipalName

Evidence to Capture

Domain relationships or exposure that materially change risk
Exact host, user context, and functions used
Minimal output needed to support the finding

Safety Boundaries

Keep scripted queries narrowly scoped and approved.
Avoid broad enumeration that exceeds the current phase objective.

---name: powerviewdescription: Use for PowerShell-based Active Directory reconnaissance during authorized pentests. Trigger on approved domain object review, group and host relationship analysis, local admin exposure checks, and focused AD discovery inside a bounded scope.license: MIT---# PowerView## PurposeUse this skill for focused PowerShell-based AD reconnaissance when the engagement permits scripted domain discovery within an approved scope.## Phase Fit- Primary: Discovery and Reconnaissance, Vulnerability Analysis- Secondary: Threat Modeling and Test Planning, Retest and Closure## Use When- Need to inspect domain groups, users, computers, or local admin relationships.- Need flexible AD discovery without a full graph collection.- Need a repeatable PowerShell workflow for retest.## Avoid When- Scripted AD reconnaissance is not explicitly approved.- Domain or host scope is unclear.## Inputs- Approved domain or host scope- PowerShell execution constraints and logging expectations- Specific AD question to answer## Procedure1. Load only the approved PowerView functions needed for the question.2. Keep queries tightly aligned to the current hypothesis.3. Record the exact host, user context, and functions used.4. Correlate results with `bloodhound`, `ldapsearch`, or manual validation.5. Preserve the exact query path for retest.## Command SyntaxReplace sample commands with the minimum approved discovery functions.```powershell# Import PowerViewImport-Module .\PowerView.ps1# Get domain informationGet-Domain -Domain contoso.com# Enumerate domain usersGet-DomainUser | Select-Object SamAccountName, Description, MemberOf# List domain administratorsGet-DomainGroupMember -Identity "Domain Admins"# Find computers where domain admins are logged inFind-DomainUserLocation -UserGroupIdentity "Domain Admins"# Enumerate all computersGet-DomainComputer | Select-Object DNSHostName, OperatingSystem# Find ACEs interesting for privilege escalationFind-InterestingDomainAcl -ResolveGUIDs# Get domain trustsGet-DomainTrust -Domain contoso.com# Enumerate Kerberoastable accounts (have SPN)Get-DomainUser -SPN | Select-Object SamAccountName, ServicePrincipalName```## Evidence to Capture- Domain relationships or exposure that materially change risk- Exact host, user context, and functions used- Minimal output needed to support the finding## Safety Boundaries- Keep scripted queries narrowly scoped and approved.- Avoid broad enumeration that exceeds the current phase objective.

Frequently asked questions