> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/get-domain-information-locally.md).
# Get Domain Information Locally
## Password Policy
### Get password policy with AD PowerShell module
We can get basic password policy information with [Get-ADDefaultDomainPasswordPolicy](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2025-ps) from the ActiveDirectory Powershell module
```powershell
Get-ADDefaultDomainPasswordPolicy
```
Example run
```powershell
PS C:\> Get-ADDefaultDomainPasswordPolicy
ComplexityEnabled : True
DistinguishedName : DC=tryhackme,DC=loc
LockoutDuration : 00:30:00
LockoutObservationWindow : 00:30:00
LockoutThreshold : 0
MaxPasswordAge : 42.00:00:00
MinPasswordAge : 1.00:00:00
MinPasswordLength : 7
objectClass : {domainDNS}
objectGuid : 4bd7e370-1577-4ab2-894c-ea0781ea33f9
PasswordHistoryCount : 24
ReversibleEncryptionEnabled : False
```
## Shares
### Enumerating shares with PowerView
Import the module
```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```
#### Find-DomainShare
[Find-DomainShare](https://powersploit.readthedocs.io/en/latest/Recon/Find-DomainShare/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview).
To search for all list all shares in the domain
```powershell
Find-DomainShare
```
Example run
```powershell
PS C:\Tools> Find-DomainShare
Name Type Remark ComputerName
---- ---- ------ ------------
ADMIN$ 2147483648 Remote Admin DC1.corp.com
C$ 2147483648 Default share DC1.corp.com
IPC$ 2147483651 Remote IPC DC1.corp.com
NETLOGON 0 Logon server share DC1.corp.com
SYSVOL 0 Logon server share DC1.corp.com
ADMIN$ 2147483648 Remote Admin web04.corp.com
backup 0 web04.corp.com
C$ 2147483648 Default share web04.corp.com
IPC$ 2147483651 Remote IPC web04.corp.com
ADMIN$ 2147483648 Remote Admin FILES04.corp.com
C 0 FILES04.corp.com
C$ 2147483648 Default share FILES04.corp.com
docshare 0 Documentation purposes FILES04.corp.com
IPC$ 2147483651 Remote IPC FILES04.corp.com
Tools 0 FILES04.corp.com
Users 0 FILES04.corp.com
Windows 0 FILES04.corp.com
ADMIN$ 2147483648 Remote Admin client74.corp.com
C$ 2147483648 Default share client74.corp.com
IPC$ 2147483651 Remote IPC client74.corp.com
ADMIN$ 2147483648 Remote Admin client75.corp.com
C$ 2147483648 Default share client75.corp.com
IPC$ 2147483651 Remote IPC client75.corp.com
sharing 0 client75.corp.com
ADMIN$ 2147483648 Remote Admin CLIENT76.corp.com
C$ 2147483648 Default share CLIENT76.corp.com
IPC$ 2147483651 Remote IPC CLIENT76.corp.com
```
Find all domain shares in the current domain that the current user has read access to.
```powershell
Find-DomainShare -CheckShareAccess
```
Example run
```powershell
PS C:\Tools> Find-DomainShare -CheckShareAccess
Name Type Remark ComputerName
---- ---- ------ ------------
NETLOGON 0 Logon server share DC1.corp.com
SYSVOL 0 Logon server share DC1.corp.com
docshare 0 Documentation purposes FILES04.corp.com
Users 0 FILES04.corp.com
ADMIN$ 2147483648 Remote Admin client74.corp.com
C$ 2147483648 Default share client74.corp.com
ADMIN$ 2147483648 Remote Admin client75.corp.com
C$ 2147483648 Default share client75.corp.com
```
#### Find-InterestingDomainShareFile
[Find-InterestingDomainShareFile](https://powersploit.readthedocs.io/en/latest/Recon/Find-InterestingDomainShareFile/) enumerates all machines on the current (or specified) domain using Get-DomainComputer, and enumerates the available shares for each machine with Get-NetShare. It will then use [Find-InterestingFile](https://powersploit.readthedocs.io/en/latest/Recon/Find-InterestingFile/) on each readable share, searching for files marching specific criteria. The default keywords are: pass, sensitive, secret, admin, login and unattend\*.xml
```powershell
Find-InterestingDomainShareFile
```
Example run
```powershell
PS C:\Tools> Find-InterestingDomainShareFile
Owner : NT AUTHORITY\SYSTEM
CreationTime : 5/8/2021 1:14:58 AM
Path : \\FILES04.corp.com\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
LastAccessTime : 5/8/2021 1:14:58 AM
LastWriteTime : 5/8/2021 1:14:58 AM
Length : 1281
Owner : CORP\stephanie
CreationTime : 9/26/2023 5:26:21 AM
Path : \\FILES04.corp.com\Users\stephanie\AppData\Local\Microsoft\Credentials
LastAccessTime : 9/26/2023 5:26:21 AM
LastWriteTime : 9/26/2023 5:26:21 AM
Length : 1
Owner : CORP\stephanie
CreationTime : 9/26/2023 5:26:21 AM
Path : \\FILES04.corp.com\Users\stephanie\AppData\Roaming\Microsoft\Credentials
LastAccessTime : 9/26/2023 5:26:21 AM
LastWriteTime : 9/26/2023 5:26:21 AM
Length : 1
Owner : CORP\stephanie
CreationTime : 9/26/2023 5:26:17 AM
Path : \\FILES04.corp.com\Users\stephanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
LastAccessTime : 9/26/2023 5:26:17 AM
LastWriteTime : 5/8/2021 1:14:58 AM
Length : 1281
```
## Resources
**Find-DomainShare** - PowerSploit Docs:
**Find-InterestingDomainShareFile** - PowerSploit Docs: