Enumerating AD with net
Description
The net command is a built-in Windows utility used for managing and querying network resources. It can be used by red teams or attackers to enumerate Active Directory (AD) environments without needing any special tools.
Local System Enumeration Using net
- net user – Lists local users on the system
- net user user.name – Retrieves information about a specific local user
- net localgroup – Lists local groups on the system
- net localgroup group_name – Lists users in a local group
- net accounts – Retrieves the local account security policy
Domain Enumeration Using net
- net user /domain – Run on a domain-joined host to enumerate domain users
- net user user.name /domain – Run on a domain-joined host to get information about a specific domain user
- net group /domain – Run on a domain-joined host to enumerate domain groups
- net group groupName /domain – Run on a domain-joined host to list members of a domain group
- net accounts /domain – Run on a domain-joined host to display domain password and account lockout policy