> For the complete documentation index, see [llms.txt](https://lanzt.gitbook.io/cheatsheet-pentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lanzt.gitbook.io/cheatsheet-pentest/windows-things/active-directory-methodology.md).

# Active Directory Methodology

## Extract domain info using IPC$ Share

IPC$ Share is essential for communication between programs and remotely accessing or managing another computer.

```bash
enum4linux IP
```

{% embed url="<https://dec-solutions.com/what-is-the-ipc-share-and-why-should-you-care/>" %}

## Find objects updated since a specific date

```powershell
$ChangeDate = New-Object DateTime(2022, 02, 28, 12, 00, 00)
Get-ADObject -Filter 'whenChanged -gt $ChangeDate' -includeDeletedObjects -Server za.tryhackme.com
```

## Show domain users

```powershell
net user /domain
```

## Show specific info of domain user

```powershell
net user william.torres /domain
```

## Show domain groups

```powershell
net group /domain
```

## Show members of a group

```powershell
net group "Tier 1 Admins" /domain
```

## Show Password Policy

```powershell
net accounts /domain
```

## Show info about the Domain

```powershell
Get-ADDomain -Server za.tryhackme.com
```

## Perform password-spray attack without locking accounts

We need to search accounts with the `badPwdCount` attribute greater than 0, those accounts will be avoided in our password-spray attack.

```powershell
Get-ADObject -Filter 'badPwdCount -gt 0' -Server za.tryhackme.com
```

> This will only show results if one of the users in the network mistyped their password a couple of times.