oscp/Windows/Active Directory for OSCP/Enumeration/PowerView Enumeration.md

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<# Get-NetLoggedOn 
		This function will execute the NetWkstaUserEnum Win32API call to query
		a given host for actively logged on users.
#>
- Get-NetComputer | Get-NetLoggedon

<# Get-NetUser
Return all users or specific user objects in AD

		To only return specific properties, use
"-Properties samaccountname,usnchanged,...". By default, all user objects for
the current domain are returned.
#>
- Get-NetUser -UserName student107

<# Get-NetComputer
	Return all computers or specific computer objects in AD.
		To only return specific properties, use
"-Properties samaccountname,usnchanged,...". By default, all computer objects for
the current domain are returned.
#>
- Get-NetComputer
- Get-NetComputer -Unconstrained

<# Get-DomainShare
	Searches for computer shares on the domain. If -CheckShareAccess is passed,
	then only shares the current user has read access to are returned.
#>
-	Find-DomainShare -CheckShareAccess -Domain svcorp.com -DomainController 10.11.1.20


<# Get-DomainOU
	Search for all organization units (OUs) or specific OU objects in AD.
#>

Get-DomainOU -Properties Name | sort -Property Name

#Get Kerberoastable SPNs
Get-NetUser -SPN | select serviceprincipalname

Request-SPNTicket -SPN "MSSQLSvc/DC.access.offsec" -Format Hashcat

#Get the count of all the Domain Admins in the domain
Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#
Get-NetComputer | select operatingsystem,dnshostname

#
Find-LocalAdminAccess