Active Directory Enumeration Checklists with PowerView
Using PowerView
PowerView is a PowerShell tool to gain network situational awareness on Windows domains. It contains a set of pure-PowerShell replacements for various windows "net *" commands, which utilize PowerShell AD hooks and underlying Win32 API functions to perform useful Windows domain functionality.
Enumerates the domain controllers for the current or specified domain. By default built in .NET methods are used. The -LDAP switch uses Get-DomainComputer to search for domain controllers.
Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria.
# Enumerate Domain User
Get-DomainUser
Get-DomainUser -Domain domain.lab
Get-DomainUser -Identity "Asuka.Soryu"
Get-DomainUser -Properties samaccountname,logonCount
# Search for a particular string in a user's attributes
Get-DomainUser -LDAPFilter "Description=*built*" | Select name,Description
Get-DomainComputer
Return all computers or specific computer objects in AD.
# Get a list of computers in the current domain
Get-DomainComputer | select Name,serviceprincipalname
Get-DomainComputer | select -ExpandProperty dnshostname
Get-DomainComputer -OperatingSystem "*Server 2022*"
Get-DomainComputer -Ping
# Check Constrained Delegation
Get-DomainComputer -TrustedToAuth
# Return computer objects that have unconstrained delegation
Get-DomainComputer -Unconstrained
# Get all the members of the Domain Admins group
Get-DomainGroupMember -Identity "Domain Admins" -Recurse
# Get all the members of the Enterprise Admins group
Get-DomainGroupMember -Identity "Enterprise Admins" -Domain domain.lab
# Get the group membership for a user
Get-DomainGroup -UserName "Asuka-Soryu"
Get-DomainOU
Search for all organization units (OUs) or specific OU objects in AD.
# Get OUs in a domain
Get-DomainOU
Get-DomainOU | select -ExpandProperty name
Get-DomainOU -Identity StudentMachines
# List all computers in StudentsMachines OU
(Get-DomainOU -Identity StudentMachines).distinguishedname | %{Get-DomainComputer -SearchBase $_} | select name
Enumerate GPOs
# Get list of GPO in current domain
Get-DomainGPO
Get-DomainGPO -ComputerIdentity DCORP-STD_X
# Enumerate GPO applied on StudentMachines OU
(Get-DomainOU -Identity StudentMachines).gplink
Get-DomainGPO -Identity '{7478F170-6A0C-490C-B355-9E4618BC785D}'
Get-DomainObjectAcl
Returns the ACLs associated with a specific active directory object.