# Domain Enumerations

## Checking for Domain Connections

```powershell
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()


net user /domain
net user atlante.phillis /domain

net group /domain
net group "IT Admins" /domain
```

## Current Domain

```powershell
Get-NetDomain
Get-ADDomain
```

## Another Domain:

```powershell
Get-NetDomain -Domain name
Get-ADDomain -Identity name
```

## Domain SID:

```powershell
Get-DomainSID
```

## Domain Policy

```powershell
get-domainpolicy
```

## Domain controler

```powershell
get-netdomaincontroller
get-netdomaincontroller -Domain name

get-addomaincontroler
```

## User Enumeration

```powershell
Get-NetUser
Get-NetUser -Username name
Get-NetUser | select * (any property)

get-aduser -Filter * -property *
get-aduser -identity name -property *

Get-userproperty #not working
Get-userProperty -Properties

get-aduser -filter -properties * | select * | select -first 1 | getmember -membertype * prperty |select name


very Importtant

Find-UserField -SearchField Description -SearchTerm "built"

get-aduser -Filter 'Description -like "*bulid"' -Properties Description | select name,Description

```

## Computer Enum:

```powershell
get-netComputer
get-netcomputer -operatingsystem "*Server 2016*"
get-netcomputer -Ping
get-netComputer -FullData


get-adcomputer -Filter * | Select name
get-adcomputer -Filter 'operatingSystem -like "*server 2016*"' - properties operatingsystem | select name,operating,system
get-adcomputer -filter * - properties DNSHostName | %{Test-Connection -count 1 -computername $_.DNSHostName}
get-adcomputer -Filter * -Properties 
```

## group Enum

```powershell
get-netgroup
get-netgroup -domain <target>
get-netgroup -Fulldata
get-netgroup *admin*
get-netgroupmember -GroupName "domain Admins" - Recurse
get-netgroup -username "student1"

get-adgroup -filter *  | select name
get-adgroup -filter * -Properties
get-adGroup -Filter 'Nmae -like "*admin*"' |select Name
get-adgroupmember -identity "Domain admins" -recursive
get-adprincipalgroupmembership -dentity student1

for local groups
get-netlocalgroup -computername {} -listgroup
get-netlocalgroup -computername {} -recurse
```

## logon check

```powershell
get-netloggedon -computername <severname>
get-loggedonlocal -computername <severname>
get-lastloggedon -computername
```

## Share enum important files

```powershell
Find-DomainShare -CheckShareAccess

invoke-sharefinder -verbose        

invoke-filefinder -verbose

get-netfileserver 
```

## GPO Enumerations

```powershell
get-netGPO
get-netGPO -Computername

get-netGPOGroup

gpresult /R

find-gpocomputeradmin -computername

find-gpolocation -usernmae <> -verbose
```

## OU Enums

```powershell
get-netou -fulldata

get-netgop -gponame
```

## ACL enumeration

```powershell
get-objectAcl -SamAccountname <> -ResolveGUIDS

getObjectAcl -ADSprefix 'CN=Administrator,CN=Users' -verbose

get-ObjectACL -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=Dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose

invoke-ACLScanner -ResolveGUIDs <- searchs for intersting ACL

get-pathAcl -Path "\\dcorp-dc.doolarcorp.moneycorp.local\sysvol"

Convert-SidToName
```

## Domain Trust Enumeration

* one way trust
* Two Way trust

```powershell
get-netdomaintrust
get-netdomaintrust -Domain 

get-adtrust
get-adtrust -Identity 
```

## Forest Enumeration

```powershell
get-netForest
get-netforest -Forest

get-ADforest
get-ADforest -identity

# all domain in current forest
get-netforestdomain
get-netforestdomain -Forest 
```

## Forest trust

```powershell
get-netforestcatalog
get-netforestcatalog -forest

get-adforest | select -Expandproperty GlobalCatalog


get-netforesttrust
get-netforesttrust -forest 

get-adtrust -filter 'msDS-TrustforestTrustInfo -ne "$null"'
```

## User Hunting

The permissions required to enumerate sessions with **NetSessionEnum** are defined in the **SrvsvcSessionInfo** registry key, which is located in the **HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity**

<pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">#PowerView 

Find-LocaladminAccess -verbose
Get-NetComputer           -> IMPT

<strong>Get-NetSession -> command uses the NetWkstaUserEnum and NetSessionEnum APIs under the hood
</strong><strong>
</strong>Invoke-CheckLocalAdminAccess

#use FIND-wmiLocalAdminAccess.ps1

Invoke-EnumarateLocalAdmin -Vervose // uses Get-NetLocalGroup

#Important
Invoke-UserHunter
Invoke-UserHunter -Stealth
Invoke-UserHunter -GroupName "RDPUsers"
//Uses Get-NetGroupMember

#Confirm admin access
Invoke-UserHunter -CheckAccess


</code></pre>
