PowerView

PowerView is a pure-PowerShell domain reconnaissance tool written by Will Schroeder (@harmj0y) as part of the PowerSploit offensive framework. It implements replacements for the Windows net * commands using PowerShell AD hooks and underlying Win32 API calls, plus “metafunctions” for user hunting, local-admin discovery, share hunting, and domain trust enumeration. Because it runs in-memory as script, it became the canonical tool for Active Directory enumeration from a compromised domain workstation — and a canonical AMSI bypass target, since modern Defender signatures flag it on load.

PowerView 2.0 renamed the classic cmdlets (Get-NetUser → Get-DomainUser, Invoke-UserHunter → Find-DomainUserLocation, Invoke-ShareFinder → Find-DomainShare, etc.); both naming generations appear below since older cheatsheets and implants still use the v1 names.

Passive reconnaissance

These calls replicate functions a normal domain client performs routinely, so they are rarely logged or alerted on:

Get-NetDomain; Get-NetDomainController
Get-NetUser; Get-NetUser -Username $USER
Get-NetComputer
Get-NetGroup "Domain Admins"; Get-NetGroupMember "Domain Admins" -Recurse
Get-NetDomainTrust; Get-NetForest
Get-DomainPolicy; (Get-DomainPolicy)."Kerberos Policy"
Get-UserProperty -Properties pwdlastset, logoncount, badpwdcount
Find-UserField -SearchField Description -SearchTerm "built"

Find-UserField is a sleeper hit: admins periodically stash passwords or hints in user Description fields, readable by any authenticated domain user — see active-directory-enumeration.

Domain enumeration (LDAP-backed)

Get-DomainUser | select name, memberof          # users + group membership
Get-DomainUser -SPN                             # service accounts → [[kerberoasting]]
Get-DomainGroupMember -Identity $GROUP          # incl. nested groups
Get-NetLoggedon                                 # historical logons (needs admin remotely)
Get-NetSession                                  # live sessions (NetSessionEnum — no admin needed from servers)

Get-DomainUser -SPN is the classic first step of kerberoasting: any account with a servicePrincipalName yields a crackable service ticket. Users with pre-authentication disabled feed as-rep-roasting; -KerberosPreuthNotRequired finds them directly.

Active reconnaissance

These functions touch every machine or share in the domain. Any org running netflow or SMB session monitoring will see the fan-out — treat as noisy:

Invoke-ShareFinder -Verbose            # → Find-DomainShare
Invoke-FileFinder -Verbose             # → Find-InterestingDomainShareFile
Invoke-EnumerateLocalAdmin -Verbose
Find-LocalAdminAccess -Verbose         # machines where YOU have local admin
Find-PSRemotingAccess

User hunting (Invoke-UserHunter → Find-DomainUserLocation) is PowerView’s signature capability: it queries every domain machine with Get-NetSession / Get-NetLoggedon and reports where target users (default: Domain Admins) are logged in — no admin rights required for the session enumeration itself:

Invoke-UserHunter                      # find DA sessions domain-wide
Invoke-UserHunter -GroupName "RDPUsers"
Invoke-UserHunter -CheckAccess         # also test local admin on hits
Invoke-UserHunter -Stealth             # file-server-only, far less traffic

The -Stealth variant (formerly Invoke-StealthUserHunter) queries only file servers hosting user home directories — one session check per server instead of per machine. Once a privileged session is located, see active-directory-lateral-movement for the hop and active-directory-weak-permissions for ACL-based escalation that avoids touching the target’s password.

Opsec

• Defender and AMSI detect stock PowerView on load; AMSI bypass or in-memory obfuscation is a prerequisite on patched systems.
• Get-* LDAP queries blend with normal directory traffic; Find-*/Invoke-* metafunctions generate one connection per domain host and are detectable.
• Alternatives with a different telemetry profile: the RSAT ActiveDirectory module (active-directory-enumeration), ADSI searcher, or BloodHound (which automates the same collection and graphs the result).

Sources

• readthedocs-powersploit-recon-readme
• github-powersploit-powerview-ps1
• harmj0y-make-powerview-great-again-2016
• harmj0y-i-hunt-sysadmins-2015

Related: active-directory-enumeration, active-directory-lateral-movement, active-directory-weak-permissions, kerberoasting, as-rep-roasting, amsi-bypass, bloodhound, windows-reconnaissance-powershell.