# Powerview

> Use for PowerShell-based Active Directory reconnaissance during authorized pentests. Trigger on approved domain object review, group and host relationship analysis, local admin exposure checks, and focused AD discovery inside a bounded scope.

- Skill: `timsonner/powerview` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/powerview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/powerview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/powerview

---


# PowerView

## Purpose

Use this skill for focused PowerShell-based AD reconnaissance when the engagement permits scripted domain discovery within an approved scope.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Threat Modeling and Test Planning, Retest and Closure

## Use When

- Need to inspect domain groups, users, computers, or local admin relationships.
- Need flexible AD discovery without a full graph collection.
- Need a repeatable PowerShell workflow for retest.

## Avoid When

- Scripted AD reconnaissance is not explicitly approved.
- Domain or host scope is unclear.

## Inputs

- Approved domain or host scope
- PowerShell execution constraints and logging expectations
- Specific AD question to answer

## Procedure

1. Load only the approved PowerView functions needed for the question.
2. Keep queries tightly aligned to the current hypothesis.
3. Record the exact host, user context, and functions used.
4. Correlate results with `bloodhound`, `ldapsearch`, or manual validation.
5. Preserve the exact query path for retest.

## Command Syntax

Replace sample commands with the minimum approved discovery functions.

```powershell
# Import PowerView
Import-Module .\PowerView.ps1

# Get domain information
Get-Domain -Domain contoso.com

# Enumerate domain users
Get-DomainUser | Select-Object SamAccountName, Description, MemberOf

# List domain administrators
Get-DomainGroupMember -Identity "Domain Admins"

# Find computers where domain admins are logged in
Find-DomainUserLocation -UserGroupIdentity "Domain Admins"

# Enumerate all computers
Get-DomainComputer | Select-Object DNSHostName, OperatingSystem

# Find ACEs interesting for privilege escalation
Find-InterestingDomainAcl -ResolveGUIDs

# Get domain trusts
Get-DomainTrust -Domain contoso.com

# Enumerate Kerberoastable accounts (have SPN)
Get-DomainUser -SPN | Select-Object SamAccountName, ServicePrincipalName
```

## Evidence to Capture

- Domain relationships or exposure that materially change risk
- Exact host, user context, and functions used
- Minimal output needed to support the finding

## Safety Boundaries

- Keep scripted queries narrowly scoped and approved.
- Avoid broad enumeration that exceeds the current phase objective.