> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/computer-enumeration-locally.md).

# Computer Enumeration Locally

## Local Enumeration

### Enumeration with PowerView

#### Get-DomainComputer

[Get-DomainComputer](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetComputer`.

Import the module

```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```

To list the most interesting information about all computers in the domain

```powershell
Get-DomainComputer | select name, dnshostname, distinguishedname, operatingsystem, operatingsystemversion, lastlogontimestamp, logoncount
```

To list **all** information about the all domain computers

```powershell
Get-DomainComputer
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools> Get-DomainComputer


pwdlastset                    : 4/18/2026 12:50:15 AM
logoncount                    : 725
msds-generationid             : {197, 187, 6, 161...}
serverreferencebl             : CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=corp,DC=com
badpasswordtime               : 12/31/1600 4:00:00 PM
distinguishedname             : CN=DC1,OU=Domain Controllers,DC=corp,DC=com
objectclass                   : {top, person, organizationalPerson, user...}
lastlogontimestamp            : 4/18/2026 12:50:15 AM
name                          : DC1
objectsid                     : S-1-5-21-1987370270-658905905-1781884369-1000
samaccountname                : DC1$
localpolicyflags              : 0
codepage                      : 0
samaccounttype                : MACHINE_ACCOUNT
whenchanged                   : 4/18/2026 7:50:15 AM
accountexpires                : NEVER
countrycode                   : 0
operatingsystem               : Windows Server 2022 Standard
instancetype                  : 4
msdfsr-computerreferencebl    : CN=DC1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=corp,DC=com
objectguid                    : 8db9e06d-068f-41bc-945d-221622bca952
operatingsystemversion        : 10.0 (20348)
lastlogoff                    : 12/31/1600 4:00:00 PM
objectcategory                : CN=Computer,CN=Schema,CN=Configuration,DC=corp,DC=com
dscorepropagationdata         : {9/2/2022 11:10:48 PM, 1/1/1601 12:00:01 AM}
serviceprincipalname          : {TERMSRV/DC1, TERMSRV/DC1.corp.com, Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/DC1.corp.com, ldap/DC1.corp.com/ForestDnsZones.corp.com...}
usncreated                    : 12293
lastlogon                     : 4/18/2026 12:50:17 AM
badpwdcount                   : 0
cn                            : DC1
useraccountcontrol            : SERVER_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
whencreated                   : 9/2/2022 11:10:48 PM
primarygroupid                : 516
iscriticalsystemobject        : True
msds-supportedencryptiontypes : 28
usnchanged                    : 557170
ridsetreferences              : CN=RID Set,CN=DC1,OU=Domain Controllers,DC=corp,DC=com
dnshostname                   : DC1.corp.com

logoncount                    : 506
badpasswordtime               : 9/26/2023 2:04:51 AM
distinguishedname             : CN=web04,CN=Computers,DC=corp,DC=com
objectclass                   : {top, person, organizationalPerson, user...}
badpwdcount                   : 0
lastlogontimestamp            : 4/18/2026 12:50:38 AM
objectsid                     : S-1-5-21-1987370270-658905905-1781884369-1112
samaccountname                : WEB04$
localpolicyflags              : 0
codepage                      : 0
samaccounttype                : MACHINE_ACCOUNT
countrycode                   : 0
cn                            : web04
accountexpires                : NEVER
whenchanged                   : 4/18/2026 8:05:36 AM
instancetype                  : 4
usncreated                    : 20506
objectguid                    : 2e01aeed-b4a6-40c4-9753-dc4e309f9021
operatingsystem               : Windows Server 2022 Standard
operatingsystemversion        : 10.0 (20348)
lastlogoff                    : 12/31/1600 4:00:00 PM
objectcategory                : CN=Computer,CN=Schema,CN=Configuration,DC=corp,DC=com
dscorepropagationdata         : {9/5/2022 3:58:26 PM, 1/1/1601 12:00:00 AM}
serviceprincipalname          : {HOST/web04.corp.com, HOST/web04, TERMSRV/WEB04, TERMSRV/web04.corp.com...}
lastlogon                     : 4/18/2026 3:01:25 AM
iscriticalsystemobject        : False
usnchanged                    : 557407
useraccountcontrol            : WORKSTATION_TRUST_ACCOUNT
whencreated                   : 9/5/2022 3:21:29 PM
primarygroupid                : 515
pwdlastset                    : 4/18/2026 1:05:36 AM
msds-supportedencryptiontypes : 28
name                          : web04
dnshostname                   : web04.corp.com

<---snip--->
```

</details>

#### Find-LocalAdminAccess

[Find-LocalAdminAccess](https://powersploit.readthedocs.io/en/latest/Recon/Find-LocalAdminAccess/) finds machines on the local domain where the current user has local administrator access.

```powershell
Find-LocalAdminAccess
```

## Resources

**Get-DomainComputer** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/>

**Find-LocalAdminAccess** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Find-LocalAdminAccess/>