> For the complete documentation index, see [llms.txt](https://aidenpearce369.gitbook.io/handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aidenpearce369.gitbook.io/handbook/ad-pentesting/ad-enumeration/enumerating-users.md). # Enumerating Users ### PowerView Enumerate all users with all properties in current domain ``` Get-NetUser ``` Enumerate a specific user with all properties in current domain ``` Get-NetUser -UserName ``` Enumerate all users with all properties in another domain ``` Get-NetUser -Domain ``` Enumerate a specific user with all properties in another domain ``` Get-NetUser -UserName -Domain ``` Search for users in current domain that matches with a specific keyword ``` Get-NetUser | ?{$_.Name -match "keyword"} ``` Get username & user principal name of all users in current domain ``` Get-NetUser | Select samaccountname,userprincipalname ``` Get username & user principal name of all users in another domain ``` Get-NetUser -Domain | Select samaccountname,userprincipalname ``` Get username & user principal name of a specific user in current domain ``` Get-NetUser -UserName | Select samaccountname,userprincipalname ``` Get username & user principal name of a specific user in another domain ``` Get-NetUser -UserName -Domain | Select samaccountname,userprincipalname ``` Get username, GUID, SID and LDAP's ADS path of all users in current domain ``` Get-NetUser | Select samaccountname,objectguid,objectsid,adspath | fl ``` Get username, GUID, SID and LDAP's ADS path of all users in another domain ``` Get-NetUser -Domain | Select samaccountname,objectguid,objectsid,adspath | fl ``` Get username, Last logged on, Last log off, Password Last Set and Bad password Time of a specific user in current domain ``` Get-NetUser -UserName | Select samaccountname,lastloggedon,lastlogoff,pwdlastset,badpasswordtime | ft ``` Get username, Last logged on, Last log off, Password last set and Bad password Time of all users in another domain ``` Get-NetUser -Domain | Select samaccountname,lastloggedon,lastlogoff,pwdlastset,badpasswordtime | ft ``` Get users in current domain with group membership ``` Get-NetUser | Select samaccountname,memberof ``` Get users in another domain with group membership ``` Get-NetUser -Domain | Select samaccountname,memberof ``` Get description of all users in current domain ``` Get-NetUser | Select samaccountname,description ``` Get description of all users in another domain ``` Get-NetUser -Domain | Select samaccountname,description ``` ### Active Directory Module Enumerate all users with default properties in current domain using Active Directory Module ``` Get-ADUser -Filter * ``` Enumerate user with default properties in current domain using Active Directory Module ``` Get-ADUser -Identity ``` Enumerate all users with all properties in current domain using Active Directory Module ``` Get-ADUser -Filter * -Properties * ``` Enumerate user with all properties in current domain using Active Directory Module ``` Get-ADUser -Properties * -Identity ```