> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/group-enumeration-locally.md). # Group Enumeration Locally ## Group Enumeration ### Enumeration with net.exe To list the names of ALL domain groups in the domain with [net.exe](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754051\(v=ws.11\)) ```bat net group /domain ```
Example run ```bat Z:\Win_Programs> net group /domain The request will be processed at a domain controller for domain MARVEL.local. Group Accounts for \\Hydra-DC.MARVEL.local ------------------------------------------------------------------------------- *Cloneable Domain Controllers *DnsUpdateProxy *Domain Admins *Domain Computers *Domain Controllers *Domain Guests *Domain Users *Enterprise Admins *Enterprise Key Admins *Enterprise Read-only Domain Controllers *Group Policy Creator Owners *Key Admins *Protected Users *Read-only Domain Controllers *Schema Admins The command completed successfully. ```
The lookup is using SMB (tcp/445) and DCE/RPC ([SAMR](https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SAMR/4df07fab-1bbc-452f-8e92-7853a3c7e380)). ### Enumeration with PowerView #### Get-DomainGroup [Get-DomainGroup](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetGroup`. Import the module ```powershell powershell -ep bypass Import-Module .\PowerView.ps1 ``` To list the most interesting information about all groups in the domain ```powershell Get-DomainGroup | select name, samaccountname, distinguishedname, description, whencreated, whenchanged, member, grouptype ``` To list **all** information about the all domain groups ```powershell Get-DomainGroup ```
Example run ```powershell PS C:\Tools> Get-DomainGroup grouptype : CREATED_BY_SYSTEM, DOMAIN_LOCAL_SCOPE, SECURITY admincount : 1 iscriticalsystemobject : True samaccounttype : ALIAS_OBJECT samaccountname : Administrators whenchanged : 9/3/2022 5:59:23 AM objectsid : S-1-5-32-544 objectclass : {top, group} cn : Administrators usnchanged : 12874 systemflags : -1946157056 name : Administrators dscorepropagationdata : {9/2/2022 11:25:58 PM, 9/2/2022 11:10:48 PM, 1/1/1601 12:04:16 AM} description : Administrators have complete and unrestricted access to the computer/domain distinguishedname : CN=Administrators,CN=Builtin,DC=corp,DC=com member : {CN=jeffadmin,CN=Users,DC=corp,DC=com, CN=Domain Admins,CN=Users,DC=corp,DC=com, CN=Enterprise Admins,CN=Users,DC=corp,DC=com, CN=Administrator,CN=Users,DC=corp,DC=com} usncreated : 8199 whencreated : 9/2/2022 11:08:27 PM instancetype : 4 objectguid : af663558-e458-4909-95c3-843a1c90dc36 objectcategory : CN=Group,CN=Schema,CN=Configuration,DC=corp,DC=com grouptype : CREATED_BY_SYSTEM, DOMAIN_LOCAL_SCOPE, SECURITY systemflags : -1946157056 iscriticalsystemobject : True samaccounttype : ALIAS_OBJECT samaccountname : Users whenchanged : 9/2/2022 11:10:48 PM objectsid : S-1-5-32-545 objectclass : {top, group} cn : Users usnchanged : 12381 dscorepropagationdata : {9/2/2022 11:10:48 PM, 1/1/1601 12:00:01 AM} name : Users description : Users are prevented from making accidental or intentional system-wide changes and can run most applications distinguishedname : CN=Users,CN=Builtin,DC=corp,DC=com member : {CN=Domain Users,CN=Users,DC=corp,DC=com, CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=corp,DC=com, CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC=corp,DC=com} usncreated : 8202 whencreated : 9/2/2022 11:08:27 PM instancetype : 4 objectguid : 45cd2fca-157e-41a1-89db-b169b29cc1cb objectcategory : CN=Group,CN=Schema,CN=Configuration,DC=corp,DC=com <---snip---> ```
#### Get-NetLocalGroupMember [Get-NetLocalGroupMember](https://powersploit.readthedocs.io/en/latest/Recon/Get-NetLocalGroupMember/) can be used to enumerate members of a specific **local group** on the local (or remote) machine. The default group is `Administrators`. To list all local administrators ```powershell Get-NetLocalGroupMember ``` To list all local administrators on a remote machine ```powershell Get-NetLocalGroupMember -ComputerName client74 ``` To list all members of the `Remote Desktop Users` group on a remote machine ```powershell Get-NetLocalGroupMember -ComputerName client74 -GroupName "Remote Desktop Users" ```
Example run ```powershell PS C:\Tools> Get-NetLocalGroupMember -ComputerName client74 -GroupName "Remote Desktop Users" ComputerName : client74 GroupName : Remote Desktop Users MemberName : CORP\jeff SID : S-1-5-21-1987370270-658905905-1781884369-1105 IsGroup : False IsDomain : UNKNOWN ComputerName : client74 GroupName : Remote Desktop Users MemberName : CORP\jeffadmin SID : S-1-5-21-1987370270-658905905-1781884369-1106 IsGroup : False IsDomain : UNKNOWN ComputerName : client74 GroupName : Remote Desktop Users MemberName : CORP\jen SID : S-1-5-21-1987370270-658905905-1781884369-1124 IsGroup : False IsDomain : UNKNOWN ```
## Resources Active Directory - Enumeration - Internal All The Things: **Get-DomainGroup** - PowerSploit Docs: **Get-NetLocalGroupMember** - PowerSploit Docs: **Net group** - Microsoft Learn: