🛡️ Methodology Checklist

  • Use built-in tools only — avoid dropping binaries
  • WMI enum: Get-WmiObject -Class Win32_Service | select Name,StartName
  • AD RSAT: Get-ADUser -Filter * -Properties *
  • dsquery: dsquery user -limit 0
  • PowerShell ActiveDirectory module (if available)
  • net commands: net user /domain, net group "Domain Admins" /domain
  • LDAP queries via .NET: [System.DirectoryServices.DirectorySearcher]
  • Avoid Mimikatz/SharpHound if EDR is present — use LOTL alternatives

🎯 Operational Context

Use when: PowerShell is blocked, binaries are monitored by AV/AppLocker, and you need to enumerate AD using only built-in Windows commands. Think Dumber First: net user /domain, net group "Domain Admins" /domain, nltest /dclist:[DOMAIN] — these are built-in, always present, rarely alerted on. Master them before reaching for PowerView. Skip when: Full PowerShell and tooling available — LOL techniques are slower and return less data.

⚡ Tactical Cheatsheet

CommandTactical Outcome
systeminfoOS version, patch level, domain membership
Get-MpComputerStatusDefender real-time protection status
netsh advfirewall show allprofilesFirewall rules across all profiles
qwinstaCheck active sessions — who else is logged into this host
powershell.exe -version 2Downgrade to PS v2 — bypasses Script Block Logging
Get-hostConfirm current PowerShell version
arp -aARP cache — other hosts this machine has talked to
route printRouting table — identify additional subnets
wmic ntdomain get Caption,Description,DnsForestName,DomainName,DomainControllerAddressWMI domain info
net group /domainList all domain groups
net user [USER] /domainDetailed info for a domain user
net localgroup administratorsLocal admins on current host
net1 user /domainSame as net user /domain — bypasses string-match AV on net.exe
dsquery userLDAP query for all user objects
dsquery computerLDAP query for all computer objects
dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -attr distinguishedName userAccountControlFind accounts with “Password Not Required” UAC flag (value 32)
dsquery * -filter "(userAccountControl:1.2.840.113556.1.4.803:=8192)" -limit 5 -attr sAMAccountNameFind Domain Controllers (UAC flag 8192)

🔬 Deep Dive & Workflow

Tooling Note

Living-off-the-land is the opposite of the other AD pages: there is nothing to install or load. Every command here uses binaries already present on a domain-joined Windows host (net, dsquery, wmic, nltest, setspn, PowerShell/Get-ADObject). That is the whole point — no transfer, no AMSI/AppLocker trigger, no download cradle. When external tooling is viable (PowerView, SharpHound, Rubeus, etc.), the equivalents and their setup live in AD_Tools_Reference.

When to Use LOTL

Modern EDR, Windows Defender, and network IDS catch external tools instantly. LOTL uses built-in Windows administration binaries to enumerate the domain without triggering standard malware detection. Use when:

  • External tooling is blocked by AppLocker/AV
  • A low-noise approach is required
  • Operating from a host with limited transfer capabilities

Recon Sequence

# 1. Host baseline
systeminfo
Get-MpComputerStatus                    # Defender status
netsh advfirewall show allprofiles      # Firewall posture
 
# 2. OpSec check — other admins on this host?
qwinsta
 
# 3. Bypass PS logging (if needed)
Get-host                                # confirm version 5.x
powershell.exe -version 2              # downgrade
Get-host                                # confirm v2.0
 
# 4. Network reconnaissance
arp -a           # adjacent hosts
route print      # pivot subnets
 
# 5. Domain enumeration
wmic ntdomain get Caption,Description,DnsForestName,DomainName,DomainControllerAddress
net group /domain
net user [USER] /domain
net localgroup administrators

dsquery — Native LDAP Queries

dsquery invokes the dsquery.dll available on modern Windows — no external tools needed:

dsquery user                    # all user objects
dsquery computer                # all computer objects
 
# UAC bitwise filter — accounts with "Password Not Required" (bit 32)
dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -attr distinguishedName userAccountControl
 
# Find all Domain Controllers (UAC bit 8192)
dsquery * -filter "(userAccountControl:1.2.840.113556.1.4.803:=8192)" -limit 5 -attr sAMAccountName

LDAP OID reference:

  • 1.2.840.113556.1.4.803 — bit must match exactly (AND)
  • 1.2.840.113556.1.4.804 — any bit in the chain matches (OR)

Common UAC bit values:

ValueMeaning
32PASSWD_NOTREQD — Password not required
512NORMAL_ACCOUNT
8192SERVER_TRUST_ACCOUNT — Domain Controller
65536DONT_EXPIRE_PASSWORD

Key LOTL Caveats

  • net1 instead of net bypasses basic string-matching AV rules targeting net.exe
  • PS v2 downgrade hides subsequent commands from Script Block Logging, but the downgrade command itself is recorded in Event Viewer — aware defenders will spot it
  • qwinsta before noisy commands — running heavy enumeration while a DA is actively logged on increases detection risk

🛠️ Troubleshooting & Edge Cases

ProblemCauseFix
net commands return ‘System error 5’Not domain joined or no networkVerify domain join: echo %USERDOMAIN%; check network connectivity to DC
dsquery returns ‘object not found’Wrong LDAP base DNUse dsquery * -scope base -attr dnsHostName to find correct base DN first
wmic /node:[DC] commands failWMI port 135 filteredUse nltest and net alternatives that use SMB port 445
PowerShell ADSI queries blockedLanguage mode restrictedTry [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() — bypasses some restrictions
nltest /dsgetdc returns wrong DCUsing cached resultForce rediscovery: nltest /dsgetdc:[DOMAIN] /force /kdc

📝 Reporting Trigger

Finding Title: Active Directory Enumeration via Native Windows Commands Impact: Built-in Windows commands used for AD enumeration generate minimal alerts and evade most EDR signatures, enabling full domain reconnaissance without deploying any external tools. Root Cause: No alerting on bulk net command usage or LDAP queries from native Windows tools. LOL enumeration indistinguishable from legitimate admin activity. Recommendation: Enable Command Line Auditing (Event ID 4688) and PowerShell Script Block Logging. Alert on abnormal frequency of net user, net group, nltest from non-admin accounts. Deploy Microsoft Defender for Identity behavioral analytics.

🔗 Related Nodes