> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory/ad-enumeration.md).

# AD Enumeration

### Enumerating AD Users <a href="#kerberoasting" id="kerberoasting"></a>

Let's use some Impacket scripts to Enumerate users if we have a normal user account access.

```
                                                                                                                                                                       
┌──(kali㉿kali)-[~/Desktop]
└─$ impacket-GetADUsers -all -dc-ip 10.10.10.100 active.htb/SVC_TGS      
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

Password:
[*] Querying 10.10.10.100 for information about domain.
Name                  Email                           PasswordLastSet      LastLogon           
--------------------  ------------------------------  -------------------  -------------------
Administrator                                         2018-07-18 15:06:40.351723  2023-07-21 02:36:10.518169 
Guest                                                 <never>              <never>             
krbtgt            
```

### Check if we have local admin access on domain controller

<figure><img src="/files/z3CTlKOyfmyZh2swX7zd" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/OQQrqOpSpwZpktGzRFYI" alt=""><figcaption></figcaption></figure>