> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AD Enumeration

> Active Directory enumeration: net commands, dsquery, ldapsearch, domain info gathering.

## Net Commands (From Domain-Joined Host)

```cmd theme={"dark"}
net user /domain
net user USERNAME /domain
net group /domain
net group "Domain Admins" /domain
net group "Domain Controllers" /domain
net accounts /domain
net share
nltest /dclist:DOMAIN
nltest /domain_trusts
```

***

## PowerShell AD Module

```powershell theme={"dark"}
Import-Module ActiveDirectory

Get-ADDomain
Get-ADForest
Get-ADUser -Filter * -Properties *
Get-ADUser -Filter * | Select Name, SamAccountName
Get-ADGroup -Filter * | Select Name
Get-ADGroupMember "Domain Admins"
Get-ADComputer -Filter * | Select Name, DNSHostName
Get-ADTrust -Filter *
```

***

## dsquery

```cmd theme={"dark"}
dsquery user -limit 0
dsquery computer -limit 0
dsquery group -limit 0
dsquery * -filter "(servicePrincipalName=*)" -attr distinguishedName servicePrincipalName
```

***

## ldapsearch (Linux)

```bash theme={"dark"}
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local"
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "user@domain.local" -w 'password'
```

### Users

```bash theme={"dark"}
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "user@domain.local" -w 'pass' "(objectClass=user)" sAMAccountName
```

### Groups

```bash theme={"dark"}
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(objectClass=group)" cn member
```

### Domain Admins

```bash theme={"dark"}
ldapsearch -x -H ldap://DC_IP -b "CN=Domain Admins,CN=Users,DC=domain,DC=local" member
```

### SPNs (Kerberoastable)

```bash theme={"dark"}
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(servicePrincipalName=*)" sAMAccountName servicePrincipalName
```

***

## Key Objects to Enumerate

| Object             | Why                      |
| ------------------ | ------------------------ |
| Domain Admins      | High-value targets       |
| Service accounts   | Kerberoasting candidates |
| Domain Controllers | Core infrastructure      |
| Trusts             | Lateral movement paths   |
| GPOs               | Policy misconfigurations |
| OUs                | Structure understanding  |
| DNS records        | Internal host discovery  |

***

## Quick Reference

| Task          | Command                                           |
| ------------- | ------------------------------------------------- |
| List users    | `net user /domain`                                |
| Domain admins | `net group "Domain Admins" /domain`               |
| LDAP enum     | `ldapsearch -x -H ldap://DC -b "DC=dom,DC=local"` |
| SPNs          | `ldapsearch ... "(servicePrincipalName=*)"`       |
| Trusts        | `nltest /domain_trusts`                           |