> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/user-enumeration-locally.md).

# User Enumeration Locally

## User Enumeration

### Enumeration with AdFind.exe

To list details of all persons in the domain with `AdFind.exe`

```bat
adfind.exe -f "(objectcategory=person)"
```

<details>

<summary>Example run</summary>

```bat
Z:\Win_Programs> adfind.exe -f "(objectcategory=person)"

AdFind V01.62.00cpp Joe Richards (support@joeware.net) October 2023

Using server: Hydra-DC.MARVEL.local:389
Directory: Windows Server 2019
Base DN: DC=MARVEL,DC=local

dn:CN=Administrator,CN=Users,DC=MARVEL,DC=local
>objectClass: top
>objectClass: person
>objectClass: organizationalPerson
>objectClass: user
>cn: Administrator
>description: Built-in account for administering the computer/domain
>distinguishedName: CN=Administrator,CN=Users,DC=MARVEL,DC=local
>instanceType: 4
>whenCreated: 20231111103822.0Z
>whenChanged: 20250415053232.0Z
>uSNCreated: 8196
>memberOf: CN=Group Policy Creator Owners,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Domain Admins,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Enterprise Admins,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Schema Admins,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Administrators,CN=Builtin,DC=MARVEL,DC=local
>uSNChanged: 69657
>name: Administrator
>objectguid: {B549B032-2543-409A-A566-16CFFEC39A6B}
>userAccountControl: 66048
>badPwdCount: 0
>codePage: 0
>countryCode: 0
>badPasswordTime: 133759551674043699
>lastLogoff: 0
>lastLogon: 133891716613751178
>pwdLastSet: 133441709079047081
>primaryGroupID: 513
>objectsid: S-1-5-21-1396090500-2521347296-3096082587-500
>adminCount: 1
>accountExpires: 9223372036854775807
>logonCount: 26
>sAMAccountName: Administrator
>sAMAccountType: 805306368
>objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=MARVEL,DC=local
>isCriticalSystemObject: TRUE
>dSCorePropagationData: 20231111105420.0Z
>dSCorePropagationData: 20231111105420.0Z
>dSCorePropagationData: 20231111103910.0Z
>dSCorePropagationData: 16010101181216.0Z
>lastLogonTimestamp: 133891687525991627

dn:CN=Guest,CN=Users,DC=MARVEL,DC=local
>objectClass: top
>objectClass: person
<---snip--->

7 Objects returned
```

</details>

### Enumeration with net.exe

To list the names of all users in the domain with `net.exe`

```batch
net.exe user /domain
```

The lookup is using SMB (tcp/445) and DCE/RPC ([SAMR](https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SAMR/4df07fab-1bbc-452f-8e92-7853a3c7e380)).

### Enumeration with PowerView

#### Get-DomainUser

[Get-DomainUser](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetUser`.

Import the module

```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```

To list the most interesting information about all users in the domain

```powershell
Get-DomainUser | select name, samaccountname, distinguishedname, logoncount, title, description, lastlogon, lastlogoff, pwdlastset, whenchanged, memberof, useraccountcontrol
```

To list **all** information about the all domain users

```powershell
Get-DomainUser
```

## Resources

**AdFind** - Homepage: <https://joeware.net/freetools/tools/adfind/>

**Get-DomainUser** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/>

**Net user** - Microsoft Learn: <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865(v=ws.11)>