Disclaimer: This material is provided for educational purposes and authorized security testing only. You are solely responsible for how you use the information. Do not use these techniques on systems without explicit permission from the owner. We do not encourage any kind of illegal or harmful activity

Enumerate Domain Information

1. Retrieve detailed information about a domain user
   

   Get-DomainUser -Identity mmorgan -Domain inlanefreight.local | Select-Object -Property name, samaccountname, description, memberof, whencreated, pwdlastset, lastlogontimestamp, accountexpires, admincount, userprincipalname, serviceprincipalname, useraccountcontrol
   

2. List members of the "Domain Admins" group (including nested memberships)
   

   Get-DomainGroupMember -Identity "Domain Admins" -Recurse
   

3. List trust relationships for the domain
   

   Get-DomainTrustMapping
   

4. Check administrative access to a specific machine
   

   Test-AdminAccess -ComputerName ACADEMY-EA-MS01
   

5. Identify users with SPN property set (useful for Kerberoasting)
   

   Get-DomainUser -SPN -Properties samaccountname, ServicePrincipalName
   

6. Enumerate local groups on a target
   

   Get-NetLocalGroup -ComputerName <target>
   

7. Enumerate members of the local Administrators group on a target
   

   Get-NetLocalGroupMember -ComputerName <target> -GroupName "Administrators"
   

8. Enumerate shares on a target
   

   Get-NetShare -ComputerName <target>
   

9. Find reachable shares on domain machines
   

   Find-DomainShare
   

10. Search for files matching criteria on readable shares
    

    Find-InterestingDomainShareFile
    

11. List all distributed file systems for the domain
    

    Get-DomainDFSShare
    

12. Retrieve default domain or DC policy
    

    Get-DomainPolicy
    

Domain Information

1. Get current domain
   

   Get-NetDomain
   

2. Enumerate other domains
   

   Get-NetDomain -Domain $DomainName
   

3. Get domain SID
   

   Get-DomainSID
   

4. Retrieve domain policy
   

   Get-DomainPolicy
   (Get-DomainPolicy)."system access"
   (Get-DomainPolicy)."kerberos policy"
   

5. Get domain controllers
   

   Get-NetDomainController
   Get-NetDomainController -Domain $DomainName
   

6. Get detailed domain info
   

   Get-NetDomain -FullData
   

Enumerate Domain Users

1. Enumerate domain users
   

   Get-NetUser
   Get-NetUser -SamAccountName $user
   Get-NetUser | select cn
   Get-UserProperty
   

2. Check last password change
   

   Get-UserProperty -Properties pwdlastset
   

3. Get specific attribute value
   

   Find-UserField -SearchField Description -SearchTerm "wtver"
   

4. Enumerate users logged onto a machine
   

   Get-NetLoggedon -ComputerName $ComputerName
   

5. Enumerate session information
   

   Get-NetSession -ComputerName $ComputerName
   

6. Enumerate user locations
   

   Find-DomainUserLocation -Domain $DomainName | Select-Object UserName, SessionFromName
   

Enumerate Domain Computers

1. Enumerate domain computers
   

   Get-NetComputer -FullData
   Get-NetComputer -Ping
   

2. Enumerate live machines
   

   Get-NetComputer -Ping
   

Enumerate Groups and Group Members

1. Enumerate group members
   

   Get-NetGroupMember -GroupName "$GroupName" -Domain $DomainName
   

2. Get group members
   

   Get-DomainGroup -Identity $GroupName | Select-Object -ExpandProperty Member
   

3. Enumerate GPO local group membership
   

   Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName
   

4. Enumerate all groups
   

   Get-NetGroup -FullData
   

Enumerate Shares

1. Enumerate domain shares
   

   Find-DomainShare
   

2. Enumerate accessible domain shares
   

   Find-DomainShare -CheckShareAccess
   

Enumerate Group Policies

1. Get group policies
   

   Get-NetGPO
   

2. Get group policy for a machine
   

   Get-NetGPO -ComputerName $ComputerName
   

3. Get local admin group users
   

   Find-GPOComputerAdmin -ComputerName $ComputerName
   

Enumerate OUs

1. Enumerate organizational units
   

   Get-NetOU -FullData
   Get-NetGPO -GPOname $GPO_GUID
   

Enumerate ACLs

1. Get ACLs for a user
   

   Get-ObjectAcl -SamAccountName $UserName -ResolveGUIDs
   

2. Get ACLs for a specific path
   

   Get-PathAcl -Path $Path
   

3. Search for interesting ACEs
   

   Invoke-ACLScanner -ResolveGUIDs
   

Enumeration of Data

1. Enumerate domain trusts
   

   Get-NetDomainTrust
   Get-NetDomainTrust -Domain $DomainName
   

2. Enumerate forest trusts
   

   Get-NetForestTrust
   Get-NetForestDomain -Forest $ForestName
   

3. Get DNS zones and records
   

   Get-DNSZone
   Get-DNSRecord
   

4. Get all domain sites and subnets
   

   Get-NetSite
   Get-NetSubnet