> For the complete documentation index, see [llms.txt](https://lanzt.gitbook.io/cheatsheet-pentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lanzt.gitbook.io/cheatsheet-pentest/windows-things/active-directory-methodology/commands-to-create-ad-environment.md).

# Commands to create AD environment

## Install AD Dependencies

### Windows Server Datacenter (GUI)

<figure><img src="/files/9d6zOfBdsKrKpJb4tDff" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/X8CKCbSCudIbFtAO4Imt" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/sl8lnLT2SOFcOFU68BEU" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/ihdADkIzWqiPbnDu1Woc" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/gWVtAW6azN0B7LFiiV0T" alt=""><figcaption></figcaption></figure>

Next and Install.

### Windows Server Standard (CLI)

From here <https://medium.com/@serkanturan_79203/installing-active-directory-with-powershell-ea48de56088c>

Install AD DS (Active Directory Domain Services):

```powershell
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
```

Configure a new Forest:

```powershell
Import-Module ADDSDeployment
Install-ADDSForest -DomainName "lanz-corp.com" -InstallDNS
```

Verify installation:

```powershell
Get-Service adws,kdc,netlogon,dns
```

## Promote Server to Domain Controller (GUI)

<figure><img src="/files/MGxLkVXkEwHRDzDqqcTS" alt=""><figcaption></figcaption></figure>

Click on "Promote this server to a domain controller":

<figure><img src="/files/vUO1WerkzOgRnfmV4ytn" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/OrboAwcaqX7oKRpBaOnJ" alt=""><figcaption><p>Domain name: freed-om-corp.com</p></figcaption></figure>

<figure><img src="/files/miOegloEkVSgDOR8ACTb" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/cuuwnkri5wHxvmMnjBoA" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/sskYbYcQvEym8A7d4y5k" alt=""><figcaption></figcaption></figure>

Install:

<figure><img src="/files/E7jlSfYTWMLealh0nEP1" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/GpsRKAa5ZZtiLtjhXrbp" alt=""><figcaption></figcaption></figure>

The server has been promoted to a Domain Controller, and the authentication is now based in domain.

## Users

### Configure users, groups, machines...

```
Run from the start menu: Active Directory Users and Computers
```

### Get-ADUser (search users)

```powershell
Get-ADUser -Filter 'Name -like "*Paul*"'
Get-ADUser -Filter "Name -like '*Orion*'" -Properties *
```

```powershell
Get-ADUser -Filter 'Name -like "*Mike*"' | Format-Table Name,SamAccountName

Name           SamAccountName
----           --------------
Mike Andrews   Jectle1984
Mike Rocha     Trequievery
Mike Rosa      Mans1990
Mike Blackmon  Stemodgme01
Joshua Mikels  Wifen1938
Mike Goodwin   Lovicher
Mike Dukes     Imosed
Mike Bynum     Barve1947
Mike Pritchard Pludenis
Mike O'Hare    mohare
```

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps>" %}

### New-ADUser (add user)

Using the `Active Directory Users and Computers` from the start-menu and inside a folder or using PowerShell commands:

```powershell
New-ADUser -Name "Orion Starchaser" -DisplayName 'Orion Starchaser' -SamAccountName 'o.starchaser' -UserPrincipalName 'orion.starchaser@inlanefreight.local' -AccountPassword (Read-Host -AsSecureString 'Enter a password') -Enabled $true -ChangePasswordAtLogon $true -OtherAttributes @{'title'='analyst';'mail'='o.starchaser@inlanefreight.local'}
```

```powershell
Get-ADUser -Identity o.starchaser
```

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-aduser?view=windowsserver2022-ps>" %}

### Set-ADUser (update user info)

```powershell
Set-ADUser -Identity 'Artemis Callisto' -DisplayName 'Artemis Callisto'
```

```powershell
Get-ADUser -Filter "Name -like 'Andromeda Cepheus'" -Properties *

[...]
DistinguishedName : CN=Andromeda Cepheus,OU=Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL
Enabled           : True
GivenName         : Andromeda
Name              : Andromeda Cepheus
ObjectClass       : user
ObjectGUID        : 300c377e-db3d-4da4-aabd-7235d69693ff
SamAccountName    : a.cepheus
SID               : S-1-5-21-3842939050-3880317879-2865463114-7604
Surname           : Cepheus
UserPrincipalName : a.cepheus@INLANEFREIGHT.LOCAL
[...]
EmailAddress      :
[...]
mail              :
[...]
```

Let's update the Email:

```powershell
Set-ADUser -Identity 'a.cepheus' -EmailAddress 'a.cepheus@inlanefreight.local'
```

<pre class="language-powershell"><code class="lang-powershell"><strong>Get-ADUser -Filter "Name -like 'Andromeda Cepheus'" -Properties *
</strong>
[...]
EmailAddress      : a.cepheus@inlanefreight.local
[...]
mail              : a.cepheus@inlanefreight.local
[...]
</code></pre>

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/set-aduser?view=windowsserver2022-ps>" %}

### Remove-ADUser (remove user)

```powershell
Get-ADUser -Filter "Name -like '*Orion*'" | Format-Table Name,SamAccountName
```

```
Name             SamAccountName
----             --------------
Orion Starchaser Orion Starchaser
```

```powershell
Remove-ADUser -Identity 'Orion Starchaser'
```

<figure><img src="/files/Q6el7pKrOm0AsfkyQMXA" alt=""><figcaption></figcaption></figure>

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/remove-aduser?view=windowsserver2022-ps>" %}

### Unlock-ADAccount (unlock user)

```powershell
Get-ADUser -Filter 'Name -like "*Masters*"'

DistinguishedName : CN=Adam Masters,OU=Interns,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL
Enabled           : True
GivenName         : Adam
Name              : Adam Masters
ObjectClass       : user
ObjectGUID        : 56d0f2af-e8a0-4d12-a910-c55257c702a2
SamAccountName    : amasters
SID               : S-1-5-21-3842939050-3880317879-2865463114-6108
Surname           : Masters
UserPrincipalName : amasters@INLANEFREIGHT.LOCAL
```

```powershell
Unlock-ADAccount -Identity 'amasters'
Set-ADAccountPassword amasters -Reset -NewPassword (Read-Host -AsSecureString -Prompt 'New Password')
Set-ADUser -ChangePasswordAtLogon $true -Identity amasters
```

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/search-adaccount?view=windowsserver2022-ps>" %}

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/unlock-adaccount?view=windowsserver2022-ps>" %}

### Update credentials

```powershell
Set-ADAccountPassword username -Reset -NewPassword (Read-Host -AsSecureString -Prompt 'New Password') -Verbose
Set-ADUser -ChangePasswordAtLogon $true -Identity username -Verbose
```

### Change DoesNotRequirePreAuth Right

This permission is used in Kerberos and is related to ASREP-Roast attack.

**GUI**:

Enable "Do not require Kerberos preauthentication":

<figure><img src="/files/xjJU8EohCsmEV5KGcWT7" alt=""><figcaption></figcaption></figure>

**CLI**:

We have a list of valid users:

<figure><img src="/files/ILUaHe38QQOvmWKXp3MW" alt=""><figcaption></figcaption></figure>

Does anyone have the DoesNotRequirePreAuth right?

```bash
python3 GetNPUsers.py -no-pass -usersfile users.txt -dc-ip 10.10.10.10 -format john -outputfile dc-freed-om-corp-asreproastable-users.txt 'lanz.com/'
```

<figure><img src="/files/yH8ljaK5rkx55N13N3OH" alt=""><figcaption></figcaption></figure>

Nop.

Let's activate it...

```powershell
Get-ADUser -Identity paolo.suarez -Properties * | Format-Table Name,DoesNotRequierePreAuth
Get-ADUser -Identity paolo.suarez | Set-ADAccountControl -DoesNotRequirePreAuth $true
```

<figure><img src="/files/62sITiRmviC1mXZQHBMV" alt=""><figcaption></figcaption></figure>

Again, does anyone have the DoesNotRequirePreAuth right?

<figure><img src="/files/YCDDbVbbwobGOEphSkTm" alt=""><figcaption></figcaption></figure>

Yeah, there is one!

## Computers

### Add-Computer (add a computer to a domain)

In the new computer we are going to execute:

```powershell
Add-Computer -DomainName INLANEFREIGHT.LOCAL -Credential INLANEFREIGHT.LOCAL\htb-student_adm -Restart
```

Or remotely:

```powershell
Add-Computer -ComputerName ACADEMY-IAD-W10 -LocalCredential ACADEMY-IAD-W10\image -DomainName INLANEFREIGHT.LOCAL -Credential INLANEFREIGHT\htb-student_adm -Restart
```

It will generate a pop-up to input credentials of a Domain Admin (or if the user is already created in the Domain, we can set the user credentials instead of Administrator).

<figure><img src="/files/85asGoM3i02z4TnN00oH" alt=""><figcaption></figcaption></figure>

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/add-computer?view=powershell-5.1>" %}

### Move a computer to an OU

```powershell
Get-ADComputer -Identity 'ACADEMY-IAD-W10' | Move-ADObject -TargetPath 'OU=Security Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL'
```

### Remove-Computer

```powershell
Remove-Computer -ComputerName 'ACADEMY-IAD-W10' -UnjoinDomainCredential 'INLANEFREIGHT.LOCAL\htb-student_adm' -PassThru -Restart -Verbose
```

If doesn't work, do it manually in the local computer:

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/remove-computer?view=powershell-5.1>" %}

{% embed url="<https://learn.microsoft.com/en-us/answers/questions/1387592/remove-computer-from-domain-using-powershell>" %}

## Group Policy Object (GPO)

### Configure Group Policy Object with GUI

```
Run from the start menu: Group Policy Management
```

### Force any particular computer to sync its GPOs

```powershell
gpupdate /force
```

### Copy-GPO (copy/duplicate a GPO)

```powershell
Get-GPO -All | FT Displayname
```

```powershell
Copy-GPO -SourceName 'Logon Banner' -TargetName 'Security Analysts Control'
```

<figure><img src="/files/Ov7rlfCMHUVWz13DRROd" alt=""><figcaption></figcaption></figure>

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/grouppolicy/copy-gpo?view=windowsserver2022-ps>" %}

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/grouppolicy/new-gplink?view=windowsserver2022-ps>" %}

{% embed url="<https://community.spiceworks.com/t/mass-link-gpos-using-powershell/1012467>" %}

### New-GPLink (link a GPO to an OU)

```powershell
New-GPLink -Name 'Security Analysts Control' -Target 'OU=Security Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL' -LinkEnabled Yes
```

```powershell
Get-GPO -Name 'Security Analysts Control' | New-GPLink -Target 'OU=Security Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL' -LinkEnabled Yes
```

<figure><img src="/files/01YPc3DWiC0Oje5KoGdn" alt=""><figcaption></figcaption></figure>

## Organization Unit (OU)

### Get-ADOrganizationUnit (obtain OUs)

```powershell
Get-ADOrganizationalUnit -Filter 'Name -like "*"'
```

```powershell
Get-ADOrganizationalUnit -Filter 'Name -like "*HelpDesk*"'

City                     :
Country                  :
DistinguishedName        : OU=HelpDesk,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL
LinkedGroupPolicyObjects : {}
ManagedBy                :
Name                     : HelpDesk
ObjectClass              : organizationalUnit
ObjectGUID               : 2ad47f9e-4550-44c6-bb99-104bc3ac2105
PostalCode               :
State                    :
StreetAddress            :
```

```powershell
Get-ADOrganizationalUnit -Identity 'OU=HelpDesk,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL'

City                     :
Country                  :
DistinguishedName        : OU=HelpDesk,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL
LinkedGroupPolicyObjects : {}
ManagedBy                :
Name                     : HelpDesk
ObjectClass              : organizationalUnit
ObjectGUID               : 2ad47f9e-4550-44c6-bb99-104bc3ac2105
PostalCode               :
State                    :
StreetAddress            :
```

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adorganizationalunit?view=windowsserver2022-ps>" %}

### Get members of an OU

```powershell
Get-ADuser -Filter * -SearchBase "OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL" | select name,DistinguishedName

[...]
Andromeda Cepheus  CN=Andromeda Cepheus,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL
Artemis Callisto   CN=Artemis Callisto,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL
Orion Starchaser   CN=Orion Starchaser,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL
```

{% embed url="<https://activedirectorypro.com/how-to-list-ad-users-from-a-specific-ou/>" %}

### New-ADOrganizationUnit (create an OU)

```powershell
New-ADOrganizationalUnit -Name 'Security Analysts' -Path 'OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL'
```

<figure><img src="/files/WEMgbQSpgGNNzA1gRyE7" alt=""><figcaption></figcaption></figure>

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-adorganizationalunit?view=windowsserver2022-ps>" %}

### Remove-ADOrganizationUnit (remove an OU)

```powershell
Get-ADOrganizationalUnit -Identity 'OU=Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL' | Set-ADObject -ProtectedFromAccidentalDeletion:$false -PassThru | Remove-ADOrganizationalUnit -Confirm:$false
```

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/remove-adorganizationalunit?view=windowsserver2022-ps>" %}

{% embed url="<https://www.itprotoday.com/powershell/delete-a-protected-ou-using-powershell>" %}

### Move-ADObject (to move an object (user, group, etc) to another OU)

```powershell
Move-ADObject -Identity "CN=Artemis Callisto,CN=Users,DC=INLANEFREIGHT,DC=LOCAL" -TargetPath "OU=Security Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL"
```

```powershell
Get-ADUser -Identity a.callisto | Move-ADObject -TargetPath 'OU=Security Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL'
```

{% embed url="<https://stackoverflow.com/questions/12712852/how-can-i-use-powershell-to-move-a-user-in-ad>" %}

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/move-adobject?view=windowsserver2022-ps>" %}

## Groups

### New-ADGroup (create a security group)

```powershell
New-ADGroup -Name "Security Analysts" -SamAccountName Analysts -GroupCategory Security -GroupScope Global -DisplayName "Security Analysts" -Path "OU=Security Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL" -Description "Members of this group are Security Analysts under the IT OU"
```

* **Security groups**: Use to assign permissions to shared resources.
* **Distribution groups**: Use to create email distribution lists.

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-adgroup?view=windowsserver2022-ps>" %}

{% embed url="<https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups>" %}

### Set-ADGroup (update group info)

```powershell
Set-ADGroup -Identity 'Analysts' -SamAccountName 'Security Analysts'
```

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/set-adgroup?view=windowsserver2022-ps>" %}

### Get-ADGroupMember (get members of a group)

```powershell
Get-ADGroupMember -Identity 'Security Analysts'
```

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adgroupmember?view=windowsserver2022-ps>" %}

### Add-ADGroupMember (add members to a group)

```powershell
Add-ADGroupMember -Identity 'Security Analysts' -Members a.cepheus
Add-ADGroupMember -Identity 'Security Analysts' -Members 'Orion Starchaser','Artemis Callisto'
```

<figure><img src="/files/TfgsSvusAbrhmhoy51KS" alt=""><figcaption></figcaption></figure>

{% embed url="<https://learn.microsoft.com/en-us/powershell/module/activedirectory/add-adgroupmember?view=windowsserver2022-ps>" %}

## Shared Folders

### Create a shared folder

**GUI**:

<figure><img src="/files/cM9Zq2ciQFZ8FbU9zsyB" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/f3BNJjSVPPYWHOLUfXv0" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/zrt8rX5O7h2pkZIYPv6J" alt=""><figcaption></figcaption></figure>

Check "Type a custom path", and create a folder.

<figure><img src="/files/2DaFJ8IyvPjMlkALhznN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/rrYfUy5ZNODWoR9gNgHK" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/QFDMlH3J3ATpel6qgK9n" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/irAvIeq2VLN6pp8ftM4h" alt=""><figcaption></figcaption></figure>

* Click on "Customize permissions"
* And set a user  with full access (for test) over that folder

<figure><img src="/files/LR6LReIfkrjEOvzWYaJ9" alt=""><figcaption></figcaption></figure>

Create and we done:

<figure><img src="/files/RHYkJmgUNjSKx1lq5lVT" alt=""><figcaption></figcaption></figure>

**CLI**:

```powershell
New-SmbShare -Name "Pagos" -Path "C:\Pagos" -FullAccess "lanz.com\jose.lopez"
```

<figure><img src="/files/qLOnm1AHbiNFgXdtutcm" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/LMEMSjQWCgjdYyPqeUsT" alt=""><figcaption></figcaption></figure>

And checking:

```bash
smbmap -H 10.10.10.10 -d lanz.com -u 'jose.lopez' -p 'Jose123!'
```

<figure><img src="/files/GcbrPCENiqQ6iF5ZEUvu" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://lanzt.gitbook.io/cheatsheet-pentest/windows-things/active-directory-methodology/commands-to-create-ad-environment.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.