Zach's Book

Powershell Domain Enumeration

Here are some commands for Powershell to do domain enumeration in an AD environment, these are all of my personal notes from a course I'm taking
  • Get current domain
    • Get-ADDomain
  • Get object from another domain
    • Get-ADDomain -Identity <insert target domain>
  • Get domain controllers for current domain
    • Get-ADDomainController
  • Get domain controller for another domain
    • Get-ADDomainController -DomainName <insert target domain> -Discover
  • Get a list of users in the current domain
    • Get-ADUser -Filter * -Properties *
    • Get-ADUser -Identity <insert user> -Properties *
  • Get list of all properties for users in the current domain
    • Get-ADUser -Filter * -Properties * | select -First 1 | Get-Member -MemberType
    • Get-ADUser -Filter * -Properties * | select Name, @{expression={[datetime]::fromFileTime($_.pwdlastset)}}
  • Search for a particular string in a user's attributes
    • Get-ADUser -Filter 'Description -like "*<insert search term>*"' -Properties Description | Select name, Description
  • Get list of computers in the current domain
    • Get-ADComputer -Filter * | select Name
    • Get-ADComputer -Filter 'OperatingSystem -like "*<insert OS>*"' -Properties OperatingSystem | select Name, OperatingSystem
    • Get-ADComputer -Filter * -Properties DNSHostName | %{Test-Connection -Count 1 -ComputerName $_.DNSHostName}
    • Get-ADComputer -Filter * -Properties *
  • Get all the groups in the current domain
    • Get-ADGroup -Filter * | select Name
    • Get-ADGroup -Filter * -Properties *
  • Get all groups containing the word "admin" in group name
    • Get-ADGroup -Filter 'Name -like "*admin*"' | select Name
  • Get all of the members of the Domain Admins group
    • Get-ADGroupMember -Identity "Domain Admins" -Recursive
  • Get the group membership for a user
    • Get-ADPrincipalGroupMembership -Identity <insert user>