backtick

Appearance

Enumeration with Active Directory Module ​

Import Module

powershell
Import-Module C:\AD\Tools\ADModule-master\Microsoft.ActiveDirectory.Management.dll
Import-Module C:\AD\Tools\ADModule-master\ActiveDirectory\ActiveDirectory.psd1

Get current domain

powershell
Get-ADDomai

Get object of another domain

powershell
Get-ADDomain -Identity techcorp.local

Get domain SID for the current domain

powershell
(Get-ADDomain).DomainSID

Get domain policy for the current domain

powershell
echo None

Get domain policy for another domain

powershell
echo None

Get domain controllers for the current domain

powershell
Get-ADDomainController

Get domain controllers for another domain

powershell
Get-ADDomainController -DomainName techcorp.local -Discover

Get a list of users in the current domain

powershell
Get-ADUser -Filter * -Properties *
Get-ADUser -Identity studentuser1 -Properties *
Get-ADUser -Filter * -Properties * | select -First 1 | Get-Member -MemberType *Property | select Name
Get-ADUser -Filter * -Properties * | select name,@{expression={[datetime]::fromFileTime($_.pwdlastset)}}

Search for a particular string in a user's attributes

powershell
Get-ADUser -Filter 'Description -like "*built*"' -Properties Description | select name,Description

Get a list of computers in the current domain

powershell
Get-ADComputer -Filter * | select Name
Get-ADComputer -Filter 'OperatingSystem -like "*Windows Server 2019 Standard*"' -Properties OperatingSystem | select Name,OperatingSystem
Get-ADComputer -Filter * -Properties DNSHostName | %{Test-Connection -Count 1 -ComputerName $_.DNSHostName}
Get-ADComputer -Filter * -Properties *

Get all the groups in the current domain

powershell
Get-ADGroup -Filter * | select Name
Get-ADGroup -Filter * -Properties *

Get all groups containing the word "admin" in group name

powershell
Get-ADGroup -Filter 'Name -like "*admin*"' | select Name

Get all the members of the Domain Admins group

powershell
Get-ADGroupMember -Identity "Domain Admins" -Recursive
Get-ADGroupMember -Identity 'Enterprise Admins' -Server techcorp.local

Get the group membership for a user

powershell
Get-ADPrincipalGroupMembership -Identity studentuser1

Get the group memership for a user recursively

powershell
function Get-ADPrincipalGroupMembershipRecursive ($SamAccountName)
{
    $groups = @(Get-ADPrincipalGroupMembership -Identity $SamAccountName |
    select -ExpandProperty distinguishedname)
    $groups
    if ($groups.count -gt 0){
        foreach ($group in $groups){
            Get-ADPrincipalGroupMembershipRecursive $group
        }
    }
}
Get-ADPrincipalGroupMembershipRecursive "studentuser19"

Get all the local groups on a machine (needs administrator privs on nondc machines)

powershell
echo None

Get members of all local groups on a machine (needs administrator privs on non-dc machines)

powershell
echo None

Get members of the local group "Administrators" on a machine (needs administrator privs on non-dc machines)

powershell
echo None

Get list of GPO in current domain

powershell
echo None

Get GPO(s) which use Restricted Groups or groups.xml for interesting users

powershell
echo None

Get users which are in a local group of a machine using GPO

powershell
echo None

Get machines where the given user is member of a specific group

powershell
echo None

Get OUs in a domain

powershell
Get-DomainOU

Get GPO applied on an OU. Read GPOname from gplink attribute from Get-DomainOU

powershell
echo None

Get users which are in a local group of a machine in any OU using GPO

powershell
echo None

Get users which are in a local group of a machine in a particular OU using GPO

powershell
echo None

There is a bug in PowerView, otherwise the below command would work

powershell
echo None

We can also enumerate ACLs using the ActiveDirectory module but without resolving GUIDs

powershell
(Get-Acl 'AD:\CN=Administrator,CN=Users,DC=us,DC=techcorp,DC=local').Access

Get a list of all domain trusts for the current domain

powershell
Get-ADTrust
Get-ADTrust -Identity techcorp.local

Get details about the current forest

powershell
Get-ADForest

Get all domains in the current forest

powershell
(Get-ADForest).Domains

Get all global catalogs for the current forest

powershell
Get-ADForest | select -ExpandProperty GlobalCatalogs

Map trusts of a forest

powershell
Get-ADTrust -Filter 'intraForest -ne $True' -Server (Get-ADForest).Name

Kerberoastable users

powershell
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName