Groups Enumeration

Domain Enumeration - Groups

PowerView

#Get all the groups in the current domain
Get-NetGroup
Get-NetGroup –Domain <targetdomain>
Get-NetGroup –FullData


#Get all groups containing the word "admin" in group name
Get-NetGroup *admin*


#Get all the members of the Domain Admins group
Get-NetGroupMember -GroupName "Domain Admins" -Recurse
Get-NetGroupMember -GroupName "Domain Admins"
Get-NetGroupMember -GroupName "Enterprise Admins" -Domain moneycorp.local



#Get the group membership for a user:
Get-NetGroup –UserName "student1"


#List all the local groups on a machine (needs administrator privs on nondc machines
Get-NetLocalGroup -ComputerName dcorpdc.dollarcorp.moneycorp.local -ListGroups


#Get members of all the local groups on a machine (needs administrator
privs on non-dc machines)
Get-NetLocalGroup -ComputerName dcorpdc.dollarcorp.moneycorp.local -Recurse


#Get actively logged users on a computer (needs local admin rights on
the target)
Get-NetLoggedon –ComputerName <servername>



#Get locally logged users on a computer (needs remote registry on the
target - started by-default on server OS)
Get-LoggedonLocal -ComputerName dcorpdc.dollarcorp.moneycorp.local



#Get the last logged user on a computer (needs administrative rights and
remote registry on the target)
Get-LastLoggedOn –ComputerName <servername>

The ActiveDirectoryPowerShell module

#Get all the groups in the current domain
Get-ADGroup -Filter * | select Name
Get-ADGroup -Filter * -Properties *


#Get all groups containing the word "admin" in group name
Get-ADGroup -Filter 'Name -like "*admin*"' | select Name 


#Get all the members of the Domain Admins group
Get-ADGroupMember -Identity "Domain Admins" -Recursive


#Get the group membership for a user:
Get-ADPrincipalGroupMembership -Identity student1