> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/get-group-information-locally.md). # Get Group Information Locally ## Get Group Information ### net.exe To get information about a specific AD-group, in this case `Domain Administrators`, with [net.exe](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865\(v=ws.11\)) ```bat net group /domain "Domain Administrators" ``` {% hint style="info" %} WARNING The net.exe command only shows user object and NOT nested group objects. As a result, users [can be missed](https://redsiege.com/tools-techniques/2018/01/beyond-net-user-part-1-limitations-of/)! {% endhint %} ### Get-ADGroup [Get-ADGroup](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2022-ps) from the Windows [Remote Server Administration Tools](https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools) (RSAT) #### List properties {% hint style="info" %} NOTE Get-ADGroup will show the properties in alphabetical order! {% endhint %} To list the standard properties of a specfic group ```powershell Get-ADGroup "Tier 2 Admins" ```

Example run

```powershell PS C:\Users\sarah.bryan> Get-ADGroup "Tier 2 Admins" DistinguishedName : CN=Tier 2 Admins,OU=Groups,DC=za,DC=tryhackme,DC=com GroupCategory : Security GroupScope : Global Name : Tier 2 Admins ObjectClass : group ObjectGUID : 6edab731-c305-4959-bd34-4ca1eefe2b3f SamAccountName : Tier 2 Admins SID : S-1-5-21-3330634377-1326264276-632209373-1104 ```

To list **all** properties of a specific group ```powershell Get-ADGroup "Tier 2 Admins" -Properties * ``` To list only the properties with names that contains `create` of a specific group ```powershell Get-ADGroup "Tier 2 Admins" -Properties * | Select -Property *create* | Format-List ```

Example run

```powershell PS C:\Users\sarah.bryan> Get-ADGroup "Tier 2 Admins" -Properties * | Select -Property *create* | Format-List Created : 2/24/2022 10:04:41 PM createTimeStamp : 2/24/2022 10:04:41 PM uSNCreated : 12781 whenCreated : 2/24/2022 10:04:41 PM ```

### Get-DomainGroup [Get-DomainGroup](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetGroup`. Import the module ```powershell powershell -ep bypass Import-Module .\PowerView.ps1 ``` #### List properties {% hint style="info" %} NOTE Get-Domain will show the properties in what looks like random order! {% endhint %} To list basic information about all groups in the domain ```powershell Get-DomainGroup | select name, distinguishedname, description, member, grouptype ``` To list more detailed information about all groups in the domain ```powershell Get-DomainGroup | select name, samaccountname, distinguishedname, description, whencreated, whenchanged, member, grouptype ``` To list **all** information about the all domain groups ```powershell Get-DomainGroup ```

Example run

```powershell PS C:\Tools> Get-DomainGroup grouptype : CREATED_BY_SYSTEM, DOMAIN_LOCAL_SCOPE, SECURITY admincount : 1 iscriticalsystemobject : True samaccounttype : ALIAS_OBJECT samaccountname : Administrators whenchanged : 9/3/2022 5:59:23 AM objectsid : S-1-5-32-544 objectclass : {top, group} cn : Administrators usnchanged : 12874 systemflags : -1946157056 name : Administrators dscorepropagationdata : {9/2/2022 11:25:58 PM, 9/2/2022 11:10:48 PM, 1/1/1601 12:04:16 AM} description : Administrators have complete and unrestricted access to the computer/domain distinguishedname : CN=Administrators,CN=Builtin,DC=corp,DC=com member : {CN=jeffadmin,CN=Users,DC=corp,DC=com, CN=Domain Admins,CN=Users,DC=corp,DC=com, CN=Enterprise Admins,CN=Users,DC=corp,DC=com, CN=Administrator,CN=Users,DC=corp,DC=com} usncreated : 8199 whencreated : 9/2/2022 11:08:27 PM instancetype : 4 objectguid : af663558-e458-4909-95c3-843a1c90dc36 objectcategory : CN=Group,CN=Schema,CN=Configuration,DC=corp,DC=com grouptype : CREATED_BY_SYSTEM, DOMAIN_LOCAL_SCOPE, SECURITY systemflags : -1946157056 iscriticalsystemobject : True samaccounttype : ALIAS_OBJECT samaccountname : Users whenchanged : 9/2/2022 11:10:48 PM objectsid : S-1-5-32-545 objectclass : {top, group} cn : Users usnchanged : 12381 dscorepropagationdata : {9/2/2022 11:10:48 PM, 1/1/1601 12:00:01 AM} name : Users description : Users are prevented from making accidental or intentional system-wide changes and can run most applications distinguishedname : CN=Users,CN=Builtin,DC=corp,DC=com member : {CN=Domain Users,CN=Users,DC=corp,DC=com, CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=corp,DC=com, CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC=corp,DC=com} usncreated : 8202 whencreated : 9/2/2022 11:08:27 PM instancetype : 4 objectguid : 45cd2fca-157e-41a1-89db-b169b29cc1cb objectcategory : CN=Group,CN=Schema,CN=Configuration,DC=corp,DC=com <---snip---> ```

#### List Members To list members of a specific domain, in this case `Sales Department` ```powershell Get-DomainGroup "Sales Department" | select -ExpandProperty member ```

Example run

```powershell PS C:\Tools> Get-DomainGroup "Sales Department" | select -ExpandProperty member CN=Development Department,DC=corp,DC=com CN=pete,CN=Users,DC=corp,DC=com CN=stephanie,CN=Users,DC=corp,DC=com PS C:\Tools> ```

#### Search for Admin groups To search for all groups with `admin` in their names ```ps Get-DomainGroup *admin* | select name, samaccountname, distinguishedname, description, whencreated, whenchanged, member, grouptype ``` ## Resources Active Directory Enumeration with AD Module without RSAT or Admin Privileges - Red Team Notes: Active Directory - Enumeration - Internal All The Things: ActiveDirectory PowerShell Module - Microsoft Learn: **Get-ADGroup** - Microsoft Learn: **Get-DomainGroup** - PowerSploit Docs: **Net group** - Microsoft Learn: