Active Directory enumeration
Active Directory enumeration is the process of mapping the structure, relationships, and configurations within a domain. It extends the concepts introduced in identity and trust discovery with techniques specific to Active Directory. The goal is to develop a thorough understanding of the domain before attempting any escalation.
Strategic context
Active Directory is used in most enterprise environments. Understanding its structure reveals how access is granted, inherited, and delegated. This understanding is what separates a targeted escalation attempt from a blind one.
Active Directory enumeration focuses on the specific configurations, permissions, and misconfigurations that define attack paths within a domain.
For security leaders, this phase shows how much information is available to authenticated domain user. Most of the techniques described here require nothing more than standard user credentials. The level of access given to low-privileged domain users is often surprising.
What information matters?
Effective Active Directory enumeration focuses on information that directly informs escalation and movement decisions.
High-value targets include:
Domain structure: domains, forests, trusts, organizational units, and group policy objects
Privileged accounts: domain administrators, service accounts, accounts with delegated permissions, and accounts with special configurations such as disabled pre-authentication or registered service principal names
Attack path relationships: group nesting, local admin access, session data, and ACL-based permissions that create indirect paths to privileged access
Service configurations: service principal names, delegation settings, and certificate services that may enable specific attack techniques
Execution examples
Active Directory enumeration typically begins with broad domain structure discovery and narrows toward specific attack path identification.
Domain structure
Understanding the domain layout provides context for everything that follows.
User and group enumeration
Enumerating users and groups reveals privilege distribution and potential targets.
Pay attention to user descriptions. Administrators occasionally store passwords or hints in the description field. NetExec's get-desc-users module automates this search, filtering descriptions against password complexity patterns:
Identifying escalation candidates
Certain account configurations create direct escalation opportunities. These should be identified during enumeration, not during escalation attempts.
Kerberoastable accounts (accounts with SPNs):
AS-REP roastable accounts (pre-authentication disabled):
Accounts with the adminCount attribute set (current or former members of administrative groups):
Accounts with constrained or unconstrained delegation:
NetExec provides a single command that identifies all delegation types, unconstrained, constrained, and resource-based constrained, across both user and computer accounts:
Attack path analysis
BloodHound transforms raw Active Directory data into a graph that helps visualize attack paths. It's the most effective tool for identifying non-obvious relationships between objects.
Collection:
After importing data, focus on queries that suggest actionable paths rather than browsing the full graph. Useful starting points include shortest paths to Domain Admin, kerberoastable users with paths to targets, and computers where current user has local admin access.
ACL-based permissions
Access control lists define what actions users and groups can perform on AD objects. Misconfigured ACLs frequently create unintended escalation paths.
Look for permissions such as GenericAll, GenericWrite, WriteDACL, WriteOwner, and ForceChangePassword on privileged objects.
Certificate services
If Active Directory Certificate Services (AD CS) is present, enumerate certificate templates for misconfigurations.
Vulnerable templates may allow certificate requests with alternate identities, enabling privilege escalation without using credentials directly.
Trust relationships
Trust relationships define how authority extends between domains and forests.
Bidirectional trusts and trusts with SID history enabled should be examined closely, as they may allow cross-domain escalation.
Common mistakes
Enumerating aggressively before understanding what security monitoring is in place
Focusing exclusively on Domain Admin
Treating enumeration as a checklist
Operator notes
Always consider OPSEC before using any tool
Enumeration should identify specific escalation candidates before any attack is attempted
Standard users are generously privileged in many environments, don't assume elevation is needed
Last updated