Active Directory Enumeration

AD enumeration is the discovery phase after a domain foothold: map users, groups, computers, trusts, and policies before choosing an escalation path. It maps to MITRE ATT&CK Discovery techniques — T1087.002 (domain account discovery), T1069.002 (domain groups), T1018 (remote systems) — and most of it requires only a standard authenticated domain user, because AD is readable by default.

Tooling tiers

Tool	Profile	Notes
Built-ins (net users /domain, nltest)	Lowest noise	No tooling to drop; limited depth
RSAT ActiveDirectory module	Low	Often already present on admin hosts; powerful but clunky
ADSI / .NET DirectoryServices	Low-medium	Works without any module; scriptable
[[powerview	PowerView]]	Medium (script-block logging, AMSI)
[[bloodhound	BloodHound]] / SharpHound	High volume

RSAT ActiveDirectory module

Get-ADForest                                            # domains in forest
Get-ADUser -Properties * -Filter * | select name, Description
Get-ADGroup -Properties * -Filter * | select name, Description
Get-ADDomainController

The Description field deserves a dedicated look — credentials left there are readable by every domain user, and pentesters report finding passwords in account descriptions on a meaningful share of engagements (PowerView’s Find-UserField automates the search).

Built-in fallbacks

net users /domain
nltest /domain_trusts /all_trusts        # trust mesh → [[active-directory-trusts]]
nltest /dclist:$DOMAIN
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

ADSI searcher (no module, no PowerView)

([adsisearcher]'(&(objectCategory=Computer))').findall()
([adsisearcher]'serviceprincipalname=*').findall().properties.serviceprincipalname
([adsisearcher]'(&(objectCategory=user))').findall()

SPN enumeration is the bridge to kerberoasting — every hit is a service account whose ticket can be requested and cracked offline. PowerShell ISE (when reachable over RDP) is a handy parallel runner: each tab is an independent runspace and $psISE.PowerShellTabs can dispatch InvokeSynchronous queries across them.

What to collect, and why

• Users + properties (pwdlastset, badpwdcount, logoncount, adminCount) → stale accounts, as-rep-roasting candidates, password-spray targets
• Groups + recursive membership → privilege tiers, scope mistakes, weak ACLs
• SPNs → kerberoasting / targeted-kerberoasting
• Computers + OS → attack surface, legacy hosts
• Trusts → trust policy review and trust pivoting
• Sessions / logged-on users → where privileged tokens live (feeds lateral movement)

Defensive notes

• Alert on bulk LDAP queries from non-admin workstations, net group "Domain Admins" /domain from user endpoints, and SharpHound-style collection bursts.
• Passwords in Description are a hygiene failure; audit the attribute fleet-wide.

Sources

• MITRE ATT&CK T1087.002 — Account Discovery: Domain Account
• Permission Groups Discovery: Domain Groups — T1069.002
• MITRE ATT&CK S0521 — BloodHound
• ActiveDirectory Module

Related: powerview, windows-reconnaissance-powershell, bloodhound, active-directory-lateral-movement, active-directory-weak-permissions, active-directory-trusts, kerberoasting, windows-reconnaissance-commands, microsoft-365-federation, windows-local-service-accounts, sebackup-serestore-privileges, secedit-bulk-privilege-edit.