Saucepan

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== Enumerate Domain Data ======
See if endpoint is joined to domain (run as Administrator)
<code>dsregcmd /status</code>
List all domain controllers
<code>nltest /dclist:</code>
Display a Global Catalog Server
<code>nltest /dsgetdc:</code>
Display all users in the domain
<code>net users /domain > domain-users.txt</code>
Display all groups in the domain
<code>net group/domain > domain-groups.txt</code>
Display members of a group (does not show groups within this group)
<code>net group "domain admins" /domain</code>
Show data on a users
<code>net user "jblogs" /domain</code>
Show domain account settings
<code>net accounts /domain</code>

To Show List of Domain Controller IP addresses
<code>nslookup gc._msdcs.yourdomain.com</code>

===== Local Data =====
Show groups that exist on the local machine
<code>net localgroup</code>
Show local workstation data
<code>net config workstation</code>
Show list of local Kerberos tokens on device you are on
<code>klist</code>
Show local stored credentials
<code>cmdkey /list</code>