AdvancedActive Directory

Domain Enumeration: Active Directory Reconnaissance Techniques

Comprehensive guide to Active Directory enumeration using native tools, PowerShell, and specialized utilities for discovering users, groups, computers, and trust relationships.

#Domain Enumeration#Active Directory#Reconnaissance#PowerView#AD Recon

The Importance of Domain Enumeration

Domain enumeration gathers information about an Active Directory environment. It is the foundation of every AD assessment, whether offensive or defensive. Understanding what exists in a domain — users, groups, computers, trusts, ACLs, GPOs, and service accounts — is essential for identifying attack paths and security gaps.

Prerequisites

**Active Directory Fundamentals** — Understanding of AD components

**PowerShell** — Basic scripting ability

**BloodHound Guide** — Graph-based analysis complements enumeration

Native Windows Enumeration

net user /domain                    # List domain users
net group "Domain Admins" /domain   # Domain Admins members
net view /domain                    # List computers
nltest /dclist:corp.local           # List domain controllers
nltest /domain_trusts               # List trusts
dsquery user -name "*admin*"        # Find admin users

PowerShell Enumeration

# AD Module cmdlets
Get-ADUser -Filter * -Properties Name,SamAccountName,Enabled,LastLogonDate
Get-ADGroupMember -Identity "Domain Admins" -Recursive
Get-ADComputer -Filter {OperatingSystem -like "*Server*"}
Get-ADTrust -Filter *

# Service Principal Name enumeration
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

PowerView for Advanced Enumeration

Import-Module .\PowerView.ps1

Get-NetDomain                       # Domain information
Get-NetUser -SPN                    # Kerberoastable users
Get-NetGroupMember -GroupName "Domain Admins"
Get-NetComputer -OperatingSystem "Windows 10*"
Get-NetSession -ComputerName target-server  # Session enumeration
Get-ObjectAcl -ResolveGUIDs         # ACL enumeration
Get-NetDomainTrust                  # Trust enumeration

Enumeration Focus Areas

Users: Enabled/disabled status, last logon, password policies, SPN presence, group membership.

Groups: Nested membership (effective access often differs from explicit membership).

Computers: Operating system, last logon, IPv4 address.

ACLs: GenericAll, WriteDacl, WriteOwner, GenericWrite permissions on critical objects.

Trusts: Direction (bidirectional, one-way), type (external, forest), transitivity.

Sessions: Where do Domain Admins have active sessions? This reveals lateral movement opportunities.

Real-World Example

A tester gains access to a workstation and uses PowerView to enumerate: 1,200 users, 80 groups (including nested Domain Admin membership revealing 12 effective DAs), 40 kerberoastable accounts, and 3 domain trusts. Session enumeration shows a DA logged into a file server. The tester moves laterally to the file server and dumps credentials.

Common Mistakes

Relying on net commands alone (limited data)

Missing nested group enumeration

Ignoring ACL enumeration (reveals subtle privilege escalations)

Overlooking trusts (cross-domain escalation paths)

Best Practices

Enumerate in phases — start with least noisy methods

Document everything — enumeration is the assessment foundation

Use multiple tools — cross-reference results

Know your detection risk — some techniques trigger security controls

Related Tools

**PowerView** — Comprehensive AD enumeration

**ADExplorer** — Sysinternals AD browser

**CrackMapExec** — Multi-purpose AD assessment

**LDAPPER** — Python-based AD enumeration

[SMBClient](/tools/smbclient) — SMB share enumeration and access

BloodHound Guide: Mapping Active Directory Relationships

Active Directory Fundamentals: Windows Network Domains

Lateral Movement: Moving Through Network Environments

Pass-the-Hash: Understanding NTLM Authentication Attacks

Summary

Domain enumeration is the most critical phase of any AD assessment. Using native tools, PowerShell, and PowerView, security professionals can build a comprehensive picture of users, groups, computers, ACLs, GPOs, and trust relationships. Thorough enumeration reveals the attack surface and provides the foundation for both offensive exploitation and defensive remediation.

Related SMB Tool Recommendations

[SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares

[Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies

[Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output

[NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing

[CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks

[NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

Knowledge Check

What is the difference between explicit and nested group membership?

Why are service accounts with SPNs significant?

What information does session enumeration provide an attacker?

Why is trust enumeration important?

Frequently Asked Questions

What is domain enumeration in Active Directory?

Domain enumeration is the process of collecting information about users, groups, computers, and trust relationships within an Active Directory environment. It is the foundation of every AD assessment, whether for penetration testing or security auditing.

What is the difference between explicit and nested group membership?

Explicit membership means a user is directly added to a group. Nested membership means a user belongs to a group that is a member of another group, granting inherited permissions. Effective access often differs from what `net group` shows.

Why are Service Principal Names (SPNs) important during enumeration?

SPNs identify services running under domain accounts. Accounts with SPNs are Kerberoastable, meaning an attacker can request a service ticket and crack it offline to recover the password. Enumerating SPNs reveals high-value targets.

What does session enumeration reveal to an attacker?

Session enumeration shows which users have active sessions on a specific machine. If a Domain Admin is logged into a file server, an attacker who compromises that server can dump their credentials from LSASS memory.

How is PowerView different from native AD cmdlets?

PowerView is a PowerShell module designed for offensive AD enumeration. It provides more granular queries (ACLs, sessions, GPOs) and can operate without RSAT or the AD module being installed on the target system.

What information does ACL enumeration provide?

ACL enumeration reveals permissions like GenericAll, WriteDacl, WriteOwner, and GenericWrite on AD objects. These often represent subtle privilege escalation paths that standard group enumeration misses.

Why is trust enumeration important in AD assessments?

Trust relationships between domains or forests can allow cross-domain privilege escalation. An attacker in a child domain can sometimes escalate to Enterprise Admin rights in the root forest via trust misconfigurations.

What is the difference between net commands and PowerView for enumeration?

Net commands (net user, net group) provide basic information but miss nested groups, ACLs, and sessions. PowerView offers comprehensive enumeration including SPNs, GPOs, trusts, and session data with lower detection risk when used properly.

How many Domain Admins should a typical organization have?

Best practice recommends 2-5 Domain Admin accounts. Large numbers of DAs increase the attack surface. Effective DA count often exceeds the explicit count due to nested group membership — always enumerate recursively.

What tools complement domain enumeration for a full AD assessment?

BloodHound maps attack paths visually, CrackMapExec scales enumeration across networks, ADExplorer provides a GUI browser, and LDAPPER offers Python-based LDAP enumeration. Each tool fills gaps the others may miss.