Active Directory Enumeration Checklists with PowerView
Using PowerView
PowerView is a PowerShell tool to gain network situational awareness on Windows domains. It contains a set of pure-PowerShell replacements for various windows "net *" commands, which utilize PowerShell AD hooks and underlying Win32 API functions to perform useful Windows domain functionality.
Import PowerView
. C:\AD\Tools\PowerView.ps1
Get-DomainController
Enumerates the domain controllers for the current or specified domain. By default built in .NET methods are used. The -LDAP switch uses Get-DomainComputer to search for domain controllers.
Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria.
# Enumerate Domain UserGet-DomainUserGet-DomainUser-Domain domain.lab Get-DomainUser-Identity "Asuka-Soryu"Get-DomainUser-Properties samaccountname,logonCount# Search for a particular string in a user's attributesGet-DomainUser-LDAPFilter "Description=*built*"| Select name,Description
Get-DomainComputer
Return all computers or specific computer objects in AD.
# Get a list of computers in the current domain Get-DomainComputer| select Name,serviceprincipalnameGet-DomainComputer| select -ExpandProperty dnshostnameGet-DomainComputer-OperatingSystem "*Server 2022*"Get-DomainComputer-Ping# Check Constrained DelegationGet-DomainComputer-TrustedToAuth# Return computer objects that have unconstrained delegationGet-DomainComputer-Unconstrained
Get-DomainGroup
Return all groups or specific group objects in AD.
# Get all the members of the Domain Admins groupGet-DomainGroupMember-Identity "Domain Admins"-Recurse# Get all the members of the Enterprise Admins groupGet-DomainGroupMember-Identity "Enterprise Admins"-Domain domain.lab# Get the group membership for a userGet-DomainGroup-UserName "Asuka-Soryu"
Get-DomainOU
Search for all organization units (OUs) or specific OU objects in AD.
# Get OUs in a domainGet-DomainOUGet-DomainOU| select -ExpandProperty nameGet-DomainOU-Identity StudentMachines# List all computers in StudentsMachines OU(Get-DomainOU-Identity StudentMachines).distinguishedname |%{Get-DomainComputer-SearchBase $_} | select name
Enumerate GPOs
# Get list of GPO in current domainGet-DomainGPOGet-DomainGPO-ComputerIdentity DCORP-STD_X# Enumerate GPO applied on StudentMachines OU(Get-DomainOU-Identity StudentMachines).gplinkGet-DomainGPO-Identity '{7478F170-6A0C-490C-B355-9E4618BC785D}'
Get-DomainObjectAcl
Returns the ACLs associated with a specific active directory object.