> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/ldap-searching.md).

# LDAP Searching

## Searching via command-line tools

### Searching via ADSI

Generic ADSI PowerShell search function

```powershell
function LDAPSearch {
    param (
        [string]$LDAPQuery
    )
    $PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
    $DistinguishedName = ([adsi]'').distinguishedName
    $DirectoryEntry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$PDC/$DistinguishedName")
    $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher($DirectoryEntry, $LDAPQuery)
    return $DirectorySearcher.FindAll()
}
```

#### Sample usage

ADSI supports the LDAP search filters as defined in [RFC2254](https://www.rfc-editor.org/rfc/rfc2254).

**Users**

To search for all users via the [SAM-Account-Type](https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype) attribute

```powershell
LDAPSearch -LDAPQuery "(samAccountType=805306368)"
```

To search for all users via the [Object-Class](https://learn.microsoft.com/en-us/windows/win32/adschema/a-objectclass) attribute

```powershell
LDAPSearch -LDAPQuery "(objectclass=user)"
```

To search for all users and list the most interesting attributes

```powershell
foreach ($user in $(LDAPSearch -LDAPQuery "(objectCategory=user)")) {
$user.properties | select {$_.name}, {$_.samaccountname}, {$_.distinguishedname}, {$_.logoncount}, {$_.description}, {$_.memberof} 
}
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\stephanie> foreach ($user in $(LDAPSearch -LDAPQuery "(objectCategory=user)")) {
>> $user.properties | select {$_.logoncount}, {$_.name}, {$_.memberof}, {$_.cn}, {$_.distinguishedname}, {$_.samaccountname}
>> }


$_.logoncount        : 568
$_.name              : Administrator
$_.memberof          : {CN=Group Policy Creator Owners,CN=Users,DC=corp,DC=com, CN=Domain Admins,CN=Users,DC=corp,DC=com, CN=Enterprise Admins,CN=Users,DC=corp,DC=com,
                       CN=Schema Admins,CN=Users,DC=corp,DC=com...}
$_.cn                : Administrator
$_.distinguishedname : CN=Administrator,CN=Users,DC=corp,DC=com
$_.samaccountname    : Administrator

$_.logoncount        : 0
$_.name              : Guest
$_.memberof          : CN=Guests,CN=Builtin,DC=corp,DC=com
$_.cn                : Guest
$_.distinguishedname : CN=Guest,CN=Users,DC=corp,DC=com
$_.samaccountname    : Guest

$_.logoncount        : 0
$_.name              : krbtgt
$_.memberof          : CN=Denied RODC Password Replication Group,CN=Users,DC=corp,DC=com
$_.cn                : krbtgt
$_.distinguishedname : CN=krbtgt,CN=Users,DC=corp,DC=com
$_.samaccountname    : krbtgt

$_.logoncount        : 65535
$_.name              : dave
$_.memberof          : CN=Development Department,DC=corp,DC=com
$_.cn                : dave
$_.distinguishedname : CN=dave,CN=Users,DC=corp,DC=com
$_.samaccountname    : dave

$_.logoncount        : 122
$_.name              : stephanie
$_.memberof          : CN=Sales Department,DC=corp,DC=com
$_.cn                : stephanie
$_.distinguishedname : CN=stephanie,CN=Users,DC=corp,DC=com
$_.samaccountname    : stephanie

$_.logoncount        : 268
$_.name              : jeff
$_.memberof          :
$_.cn                : jeff
$_.distinguishedname : CN=jeff,CN=Users,DC=corp,DC=com
$_.samaccountname    : jeff

$_.logoncount        : 290
$_.name              : jeffadmin
$_.memberof          : {CN=Domain Admins,CN=Users,DC=corp,DC=com, CN=Administrators,CN=Builtin,DC=corp,DC=com}
$_.cn                : jeffadmin
$_.distinguishedname : CN=jeffadmin,CN=Users,DC=corp,DC=com
$_.samaccountname    : jeffadmin

$_.logoncount        : 72
$_.name              : iis_service
$_.memberof          :
$_.cn                : iis_service
$_.distinguishedname : CN=iis_service,CN=Users,DC=corp,DC=com
$_.samaccountname    : iis_service

$_.logoncount        : 28
$_.name              : pete
$_.memberof          : {CN=Development Department,DC=corp,DC=com, CN=Sales Department,DC=corp,DC=com}
$_.cn                : pete
$_.distinguishedname : CN=pete,CN=Users,DC=corp,DC=com
$_.samaccountname    : pete

$_.logoncount        : 155
$_.name              : jen
$_.memberof          : CN=Management Department,DC=corp,DC=com
$_.cn                : jen
$_.distinguishedname : CN=jen,CN=Users,DC=corp,DC=com
$_.samaccountname    : jen

$_.logoncount        : 0
$_.name              : bethany
$_.memberof          :
$_.cn                : bethany
$_.distinguishedname : CN=bethany,CN=Users,DC=corp,DC=com
$_.samaccountname    : bethany

$_.logoncount        : 0
$_.name              : alice
$_.memberof          :
$_.cn                : alice
$_.distinguishedname : CN=alice,CN=Users,DC=corp,DC=com
$_.samaccountname    : alice

$_.logoncount        : 0
$_.name              : bob
$_.memberof          :
$_.cn                : bob
$_.distinguishedname : CN=bob,CN=Users,DC=corp,DC=com
$_.samaccountname    : bob

$_.logoncount        : 0
$_.name              : robert
$_.memberof          :
$_.cn                : robert
$_.distinguishedname : CN=robert,CN=Users,DC=corp,DC=com
$_.samaccountname    : robert

$_.logoncount        : 0
$_.name              : dennis
$_.memberof          :
$_.cn                : dennis
$_.distinguishedname : CN=dennis,CN=Users,DC=corp,DC=com
$_.samaccountname    : dennis

$_.logoncount        : 0
$_.name              : travis
$_.memberof          :
$_.cn                : travis
$_.distinguishedname : CN=travis,CN=Users,DC=corp,DC=com
$_.samaccountname    : travis

$_.logoncount        : 0
$_.name              : charlotte
$_.memberof          :
$_.cn                : charlotte
$_.distinguishedname : CN=charlotte,CN=Users,DC=corp,DC=com
$_.samaccountname    : charlotte

$_.logoncount        : 0
$_.name              : sophia
$_.memberof          :
$_.cn                : sophia
$_.distinguishedname : CN=sophia,CN=Users,DC=corp,DC=com
$_.samaccountname    : sophia

$_.logoncount        : 0
$_.name              : james
$_.memberof          :
$_.cn                : james
$_.distinguishedname : CN=james,CN=Users,DC=corp,DC=com
$_.samaccountname    : james

$_.logoncount        : 0
$_.name              : michelle
$_.memberof          : CN=Customer support,CN=Users,DC=corp,DC=com
$_.cn                : michelle
$_.distinguishedname : CN=michelle,CN=Users,DC=corp,DC=com
$_.samaccountname    : michelle

```

</details>

**Groups**

To search for all groups via the [Object-Class](https://learn.microsoft.com/en-us/windows/win32/adschema/a-objectclass) attribute

```powershell
LDAPSearch -LDAPQuery "(objectclass=group)"
```

To search for all groups but only show the most interesting attributes

```bash
foreach ($group in $(LDAPSearch -LDAPQuery "(objectCategory=group)")) {
$group.properties | select {$_.name}, {$_.samaccountname}, {$_.distinguishedname}, {$_.description}, {$_.member}
}
```

To search for a specific group and print its members

```bash
$sales = LDAPSearch -LDAPQuery "(&(objectCategory=group)(cn=Sales Department))"
$sales.properties.member
```

## Searching via GUI-tools

### Using dsquery.dll

To open a GUI search window run

```batch
rundll32.exe dsquery.dll OpenQueryWindow
```

From a domain joined machine you can also access the search window via the shortcut\
`Win + Ctrl + f`.

## Resources

Active Directory Schema (AD Schema) - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/adschema/active-directory-schema>

ADSI Search Filter Syntax - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax>