```sh ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ <# Get-NetLoggedOn This function will execute the NetWkstaUserEnum Win32API call to query a given host for actively logged on users. #> - Get-NetComputer | Get-NetLoggedon <# Get-NetUser Return all users or specific user objects in AD To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all user objects for the current domain are returned. #> - Get-NetUser -UserName student107 <# Get-NetComputer Return all computers or specific computer objects in AD. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all computer objects for the current domain are returned. #> - Get-NetComputer - Get-NetComputer -Unconstrained <# Get-DomainShare Searches for computer shares on the domain. If -CheckShareAccess is passed, then only shares the current user has read access to are returned. #> - Find-DomainShare -CheckShareAccess -Domain svcorp.com -DomainController 10.11.1.20 <# Get-DomainOU Search for all organization units (OUs) or specific OU objects in AD. #> Get-DomainOU -Properties Name | sort -Property Name #Get Kerberoastable SPNs Get-NetUser -SPN | select serviceprincipalname Request-SPNTicket -SPN "MSSQLSvc/DC.access.offsec" -Format Hashcat #Get the count of all the Domain Admins in the domain Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Get-NetComputer | select operatingsystem,dnshostname # Find-LocalAdminAccess ```