ACTIVE DIRECTORY / ENUMERATION
Active Directory enumeration
Move from a domain credential or foothold to a defensible map of users, computers, groups, shares, and relationships.
LEARNING OBJECTIVES
What you should be able to do
- ✓Discover the domain and domain controller
- ✓Enumerate users, groups, computers, SPNs, and shares
- ✓Turn raw output into candidate attack paths and validate them
CORE CONCEPT
Understand before you run
AD is a relationship graph: permissions, group membership, sessions, and delegated rights create paths.
Manual enumeration explains what automated collectors are actually querying.
BloodHound visualizes relationships; it does not prove that every edge is exploitable in the current context.
COMMAND REFERENCE
Quick reference
nxc smb <dc> -u '<user>' -p '<password>' --users --groupsCollect basic domain account context
ldapsearch -x -H ldap://<dc> -D '<user>@<domain>' -W -b 'DC=example,DC=local' '(objectClass=user)' sAMAccountNameQuery directory objects with explicit scope
.\SharpHound.exe -c AllCollect graph data from an authorized Windows lab
COMMON MISTAKES
Check yourself
- Running a collector before recording DNS, domain, and current identity.
- Following the shortest graph path without validating required privileges.
- Confusing a Domain Admin membership edge with an active session or usable credential.