Remote

Multi-Protocol

enum4linux -a <IP>

SMB

nxc smb <IP> -u '' -p '' --users

RPC

rpcclient -U "" -N <IP>
enumdomusers

ldap

ldapsearch -x -b "DC=HTB,DC=LOCAL" -s sub "(&(objectclass=user))" -H ldap://<IP> | grep -i samaccountname: | cut -f 2 -d " "

nxc ldap <IP> -u '' -p '' --users

Brute force usernames

kerbrute userenum -d EGOTISTICAL-BANK.LOCAL /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --dc 10.10.10.175

kerberute userenum -d <DOMAIN> users.txt

remote

💡

Add a known negative user to make sure the server is properly validating.