902 B
902 B
-
Note; a lot of this info is also contained in the "Windows" and "PowerShell" sections; this is for miscellaneous AD enum
-
Enumerate all nested members of a group or all nested groups of a user with a raw LDAP query using OID
net ads search -k -s ad. local '(CN=Domain Admins)' memberof- Get groups of which "Domain Admins" is a member, without OID
net ads search -k -5 ad. local '(member:1.2.840.113556.1.4.1941:=CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn- Use OID to walk the nested groups and find out that Domain Admins is actually a member of more groups
net ads search -k -s ad. local '(CN=Domain Admins)' member- Find members of Domain Admins group without OID
net ads search -k -5 ad.local '(memberof:1.2.840.113556.1.4.1941: =CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn- Use OID to walk nested groups and get ALL effective members of Domain Admins