Net Commands (From Domain-Joined Host)
net user /domain
net user USERNAME /domain
net group /domain
net group "Domain Admins" /domain
net group "Domain Controllers" /domain
net accounts /domain
net share
nltest /dclist:DOMAIN
nltest /domain_trusts
PowerShell AD Module
Import-Module ActiveDirectory
Get-ADDomain
Get-ADForest
Get-ADUser -Filter * -Properties *
Get-ADUser -Filter * | Select Name, SamAccountName
Get-ADGroup -Filter * | Select Name
Get-ADGroupMember "Domain Admins"
Get-ADComputer -Filter * | Select Name, DNSHostName
Get-ADTrust -Filter *
dsquery
dsquery user -limit 0
dsquery computer -limit 0
dsquery group -limit 0
dsquery * -filter "(servicePrincipalName=*)" -attr distinguishedName servicePrincipalName
ldapsearch (Linux)
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local"
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "[email protected]" -w 'password'
Users
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "[email protected]" -w 'pass' "(objectClass=user)" sAMAccountName
Groups
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(objectClass=group)" cn member
Domain Admins
ldapsearch -x -H ldap://DC_IP -b "CN=Domain Admins,CN=Users,DC=domain,DC=local" member
SPNs (Kerberoastable)
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(servicePrincipalName=*)" sAMAccountName servicePrincipalName
Key Objects to Enumerate
| Object | Why |
|---|---|
| Domain Admins | High-value targets |
| Service accounts | Kerberoasting candidates |
| Domain Controllers | Core infrastructure |
| Trusts | Lateral movement paths |
| GPOs | Policy misconfigurations |
| OUs | Structure understanding |
| DNS records | Internal host discovery |
Quick Reference
| Task | Command |
|---|---|
| List users | net user /domain |
| Domain admins | net group "Domain Admins" /domain |
| LDAP enum | ldapsearch -x -H ldap://DC -b "DC=dom,DC=local" |
| SPNs | ldapsearch ... "(servicePrincipalName=*)" |
| Trusts | nltest /domain_trusts |