> For the complete documentation index, see [llms.txt](https://blog.tyler-staut.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.tyler-staut.cloud/pentesting/active-directory/domain-enumeration.md).

# Domain Enumeration

[PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) is an enumeration script included in PowerSploit toolkit

```powershell
Get-NetDomain ## Gather information for the current users domain.
Get-NetDomain -Domain myhackingblog.local  ##Gather information on myhackingblog.local
Get-DomainSID  ## Get the current domain's SID.
Get-NetDomainController -Domain myhackingblog.local
Get-NetUser -Domain myhackingblog.local ## Get AD information for all users
Get-NetUser -UserName thecorrectjames  ## Get information for a specific user.
Get-NetGroup *admin*
Get-NetComputer -FullData
Find-LocalAdminAccess -Verbose  ##Find all computers the current user has local adminaccess
Get-NetSession -ComputerName myhackingblog-dc ##List sessions on a computer
Invoke-UserHunter -CheckAccess
Get-NetDomainTrust
Get-NetForest
Get-NetForestDomain
```

[Active Directory Modules](https://docs.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps) are written and provided by Microsoft, less likely to trigger alerts as they have a legitimate business use.

```powershell
Get-ADDomain
Get-ADDomain -Identity myhackingblog.local
(Get-ADDomain).DOMAINSID.Value
Get-ADDomainController -Discover -DomainName myhackingblog.local
Get-ADUser -Filter * -Properties * ## Get AD information for all users
Get-ADUser -Server dc.myhackingblog.local get user information from specific domain controller.
Get-ADUser -Identity thecorrectjames ## Get information for a specific user.
Get-ADGroup -Filter * | select Name  ##Get all the group names
Get-ADGroup -Filter 'Name -like "*admin*"' | select Name
Get-ADcComputer -Filter * -Properties *
Invoke-EnumerateLocalAdmin -Verbose
Get-ADTrust -Filter *
Get-ADForest
(Get-ADForest).Domains
```