Manually Enumerate AD

Tooling

• admodule
• powerview
• SharpView
• seatbelt

Users, Groups, Computers

Area	AD Module	PowerView
Users	Get-ADUser -Filter *	Get-DomainUser
Computer	Get-ADComputer -Filter *	Get-DomainComputer
Domain	Get-ADDomain	Get-Domain
Domain-Controller	Get-ADDomainController	Get-ADDomainController
Domain-Admin	Get-ADGroup -Identity 'Domain Admins' -Properties *	Get-DomainUser -Identity 'Domain Admins
Domain-Admins	Get-ADGroupMember -Identity 'Domain Admins' -Recursive	Get-DomainGroupMember -Identity 'Domain Admins' -Recurse
Enterprise-Admins	Get-ADGroupMember -Identity 'Enterprise Admins' -Recurse
Kerberos Policy		(Get-DomainPoliay).KerberosPolicy
My groups		Get-ADPrincipalGroupMembership -Identity studentuser21
Groups for User		` Get-DomainGroup -MemberIdentity studentuser21
Groups for User	Get-ADPrincipalGroupMembership -Identity studentuser1	` Get-DomainGroup -UserName studentuser21

GPO, OUs, RestrictedGroups

Area	AD Module	PowerView
Restricted Groups		Get-DomainGPOLocalGroup
List Domain OUs	Get-ADOrganizationalUnit -Filter * -Properties *	`Get-DomainOU