> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/domain-enumeration-locally.md).

# Domain Enumeration Locally

## General Domain Enumeration

### AdFind.exe

To get general AD-information with [AdFind.exe](https://www.joeware.net/freetools/tools/adfind/usage.htm)

```bat
adfind.exe -sc adinfo
```

<details>

<summary>Example run</summary>

```bat
Z:\Win_Programs>adfind.exe -sc adinfo

AdFind V01.62.00cpp Joe Richards (support@joeware.net) October 2023

Using server: Hydra-DC.MARVEL.local:389
Directory: Windows Server 2019
Current Time: 2025/04/15-14:12:15 W. Europe Daylight Time
Domain Mode: Windows Server 2016 Domain Mode
Forest Mode: Windows Server 2016 Forest Mode
Site Name: Default-First-Site-Name
Options: GC
Security Principal: MARVEL\fcastle

dn:
>approximateHighestInternalObjectID: 4034
>msDS-PrincipalName: MARVEL\fcastle
>tokengroups: MARVEL\fcastle
>tokengroups: MARVEL\Domain Users
>tokengroups: Everyone
>tokengroups: BUILTIN\Users
>tokengroups: BUILTIN\Pre-Windows 2000 Compatible Access
>tokengroups: NETWORK
>tokengroups: NT AUTHORITY\Authenticated Users
>tokengroups: This Organization
>tokengroups: Authentication authority asserted identity
>dnshostname: Hydra-DC.MARVEL.local


1 Objects returned
```

</details>

To list the domains with `AdFind.exe`

```bat
Z:\Win_Programs>adfind.exe -sc domainlist
MARVEL.local
```

### Get-ADDomain

To get information about domains with [Get-ADDomain](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addomain?view=windowsserver2016-ps) from [RSAT](https://www.microsoft.com/en-us/download/details.aspx?id=45520)

```powershell
Get-ADDomain | Select-Object Name, PDCEmulator, DNSRoot, DomainMode
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\fcastle> Get-ADDomain | Select-Object Name, PDCEmulator, DNSRoot, DomainMode

Name   PDCEmulator           DNSRoot             DomainMode
----   -----------           -------             ----------
MARVEL Hydra-DC.MARVEL.local MARVEL.local Windows2016Domain

```

</details>

### Get-Domain

[Get-Domain](https://powersploit.readthedocs.io/en/latest/Recon/Get-Domain/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetDomain`.

Import the module

```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```

To get information about the current domain

```powershell
Get-Domain
```

To get info about a specific domain

```powershell
Get-Domain -Domain testlab.local
```

### netdom.exe

To list [FSMO (Flexible Single Master Operation) roles](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/fsmo-roles) in the domain with [netdom.exe](netdom.exehttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netdom-query)

```bat
netdom.exe query fsmo
```

<details>

<summary>Example run</summary>

```bat
PS C:\Users\fcastle> netdom.exe query fsmo
Schema master               Hydra-DC.MARVEL.local
Domain naming master        Hydra-DC.MARVEL.local
PDC                         Hydra-DC.MARVEL.local
RID pool manager            Hydra-DC.MARVEL.local
Infrastructure master       Hydra-DC.MARVEL.local
The command completed successfully.
```

</details>

### nltest.exe

To get basic information on the current domain with [nltest.exe](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935\(v=ws.11\))

```bat
nltest.exe /dsgetdc:
```

<details>

<summary>Example run</summary>

```bat
PS C:\Users\fcastle> nltest.exe /dsgetdc:
           DC: \\Hydra-DC.MARVEL.local
      Address: \\192.168.140.129
     Dom Guid: 2902859d-3064-4d58-bc03-177a18f0aabe
     Dom Name: MARVEL.local
  Forest Name: MARVEL.local
 Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10 KEYLIST
The command completed successfully
```

</details>

## Resources

Active Directory - Enumeration - Internal All The Things: <https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adds-enumerate/>

**AdFind** - Docs: <https://www.joeware.net/freetools/tools/adfind/usage.htm>

**Get-ADDomain** - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addomain?view=winserver2012r2-ps>

**Get-Domain** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Get-Domain/>

**Netdom query** - Microsoft Learn: <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc835089(v=ws.11)>

**Nltest** - Microsoft Learn: <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731935(v=ws.11)>