Active Directory Enumeration with PowerView & SharpView

PowerView is part of the PowerSploit framework and gives you a clean PowerShell interface over AD enumeration. SharpView is the C# port of PowerView : same functions, compiled binary, useful when PowerShell execution is restricted or heavily logged.

Both tools speak directly to LDAP and don't rely on the AD module being installed.

Quick Reference

Users

# All users
Get-DomainUser

# Find users with descriptions set , passwords are often stored here
Get-DomainUser -Properties samaccountname,description | Where-Object {$_.description -ne $null}

# Count all domain users
(Get-DomainUser).count

# Find Kerberoastable users (have SPNs)
Get-DomainUser -SPN | select SamAccountName, ServicePrincipalName

# Find ASREPRoastable users
Get-DomainUser -KerberosPreauthNotRequired | select SamAccountName

# Find users with constrained delegation set
Get-DomainUser -TrustedToAuth | select SamAccountName, msds-allowedtodelegateto

# UAC values for a specific user
Get-DomainUser harry.jones | ConvertFrom-UACValue -showall

# SID conversions
Convert-NameToSid username
Convert-SidToName S-1-5-21-2974783224-3764228556-2640795941-1724

# SharpView equivalents
.\SharpView.exe Get-DomainUser -SPN
.\SharpView.exe Get-DomainUser -KerberosPreauthNotRequired
.\SharpView.exe ConvertTo-SID -Name username
.\SharpView.exe Convert-ADName -ObjectName S-1-5-21-...-1724

Groups

# All groups
Get-DomainGroup -Properties Name

# Members of a specific group
Get-DomainGroupMember -Identity "Domain Admins"
Get-DomainGroupMember -Identity "Domain Admins" -Recurse

# Protected/admin groups (adminCount=1)
Get-DomainGroup -AdminCount | select Name

# Group details , who manages it
Get-DomainGroup -Properties * -Identity 'Citrix Admins' | select cn, managedby

# Managed security groups
Find-ManagedSecurityGroups

# Foreign group membership : users from other domains in local groups
Find-ForeignGroup

# Local groups on a remote host
Get-NetLocalGroup -ComputerName WS01
Get-NetLocalGroupMember -ComputerName WS01

# SharpView equivalents
.\SharpView.exe Get-DomainGroupMember -Identity 'Help Desk'
.\SharpView.exe Get-DomainGroup -AdminCount
.\SharpView.exe Find-ManagedSecurityGroups
.\SharpView.exe Get-NetLocalGroupMember -ComputerName WS01

Computers

# All domain computers
Get-DomainComputer

# Detailed info on a specific computer
Get-DomainComputer -Identity WS01 -Properties *

# Count domain computers
(Get-DomainComputer).count

# Check description fields on computers : sometimes contains useful info
Get-DomainComputer -Properties description | Where-Object { $_.description -match '\w' }

# Unconstrained delegation : any user that authenticates to these machines has their TGT cached
Get-DomainComputer -Unconstrained | select Name

# Constrained delegation
Get-DomainComputer -TrustedToAuth | select Name, msds-allowedtodelegateto

# SharpView equivalents
.\SharpView.exe Get-DomainComputer -Unconstrained

GPOs

# All GPOs
Get-DomainGPO

# List GPO display names only
Get-DomainGPO | select displayname

# GPOs applied to a specific computer
Get-DomainGPO -ComputerIdentity WS01

# Find a GPO by name
Get-DomainGPO -Identity "Default Domain Policy"

# GPO applied to a host (from the host itself)
gpresult /r /S WS01

# GPO permissions : who can modify GPOs
Get-DomainGPO | Get-ObjectAcl

# SharpView
.\SharpView.exe Get-DomainGPO | findstr displayname
.\SharpView.exe Get-DomainOU

ACLs & Permissions

ACL enumeration is where PowerView really shines. These are the queries that surface paths BloodHound visualizes.

# Enumerate ACLs on a specific object
Get-DomainObjectAcl -Identity username -ResolveGUIDs

# Find all interesting ACLs across the domain : things like WriteDACL, GenericAll, etc.
Find-InterestingDomainAcl -ResolveGUIDs

# Filter for a specific user's outbound rights
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object { $_.IdentityReference -match "username" }

# ACLs on a file share path
Get-PathAcl "\\SQL01\DB_backups"

# Find users with GenericAll over a specific object
(Get-ACL "AD:$((Get-ADUser username).distinguishedname)").Access | 
    Where-Object { $_.ActiveDirectoryRights -match "GenericAll" }

# Find accounts with DCSync rights (GetChanges + GetChangesAll)
$dcsync = Get-ObjectACL "DC=corp,DC=local" -ResolveGUIDs | 
    Where-Object { 
        ($_.ActiveDirectoryRights -match 'GenericAll') -or 
        ($_.ObjectAceType -match 'Replication-Get')
    } | 
    Select-Object -ExpandProperty SecurityIdentifier | 
    Select-Object -ExpandProperty value
Convert-SidToName $dcsync

Shares

# Enumerate shares on a remote host
Get-NetShare -ComputerName SQL01

# Find non-default shares (filter out ADMIN$, C$, IPC$)
Get-NetShare -ComputerName SQL01 | Where-Object { $_.Name -notmatch "^(ADMIN\$|C\$|IPC\$)$" }

# Find accessible shares across the domain
Find-DomainShare -CheckShareAccess

# Hunt for interesting files in shares
Find-InterestingDomainShareFile -Include *.txt,*.xlsx,*.kdbx,*.config,*.xml

# SharpView
.\SharpView.exe Get-NetShare -ComputerName SQL01

Trusts

# List domain trusts
Get-DomainTrust

# Map all reachable trusts : useful in multi-domain forests
Get-DomainTrustMapping

Domain Policy

# Full domain policy object
Get-DomainPolicy

# Password policy only
(Get-DomainPolicy)."SystemAccess"

# Kerberos policy
(Get-DomainPolicy)."KerberosPolicy"

Finding User Sessions

# Find where domain users are currently logged in : needs admin on remote hosts for full results
Find-DomainUserLocation

# Find where a specific user is logged in
Find-DomainUserLocation -UserName targetuser

# Find where domain admins are logged in
Find-DomainUserLocation -GroupName "Domain Admins"

Local Admin Access

# Test local admin access on a remote host
Test-AdminAccess -ComputerName SQL01

# Find all machines in the domain where you have local admin
Find-LocalAdminAccess

SharpView

SharpView mirrors PowerView's functions as a compiled C# binary. Use it when:

• PowerShell execution policy is locked down
• Script block logging is enabled and you want to reduce PS exposure
• AMSI is blocking PowerView from loading

# Get help for any function
.\SharpView.exe Get-DomainUser -Help

# Most PowerView functions map 1:1
.\SharpView.exe Get-Domain
.\SharpView.exe Get-DomainOU
.\SharpView.exe Get-DomainUser -SPN
.\SharpView.exe Get-DomainGroupMember -Identity "Domain Admins"
.\SharpView.exe Get-DomainComputer -Unconstrained
.\SharpView.exe Get-NetShare -ComputerName SQL01
.\SharpView.exe Get-NetLocalGroupMember -ComputerName WS01

High Value Queries to Always Run

# Descriptions with content : check for stored passwords
Get-DomainUser -Properties samaccountname,description | 
    Where-Object {$_.description -ne $null} | 
    select SamAccountName, Description

# Kerberoastable accounts
Get-DomainUser -SPN | select SamAccountName, ServicePrincipalName

# ASREPRoastable accounts
Get-DomainUser -KerberosPreauthNotRequired | select SamAccountName

# Computers with unconstrained delegation : high value targets
Get-DomainComputer -Unconstrained | select Name

# Where are domain admins logged in right now
Find-DomainUserLocation -GroupName "Domain Admins"

# What can your current user do across the domain
Find-InterestingDomainAcl -ResolveGUIDs | 
    Where-Object { $_.IdentityReference -match $env:USERNAME }

# Who has DCSync rights
$dcsync = Get-ObjectACL "DC=corp,DC=local" -ResolveGUIDs | 
    Where-Object { 
        ($_.ActiveDirectoryRights -match 'GenericAll') -or 
        ($_.ObjectAceType -match 'Replication-Get')
    } | 
    Select-Object -ExpandProperty SecurityIdentifier | 
    Select-Object -ExpandProperty value
Convert-SidToName $dcsync