# domain enumeration

### Enumerate Current forest, domain, functional level, dc name

```powershell
$ADClass = [System.DirectoryServices.ActiveDirectory.Domain]
$ADClass::GetCurrentDomain()
```

### Tools

Use microsoft AD module and dll in case if powershell has constrained language mode enabled.

* Powerview =>[ https://github.com/ZeroDayLab/PowerSploit/blob/master/Recon/PowerView.ps1](https://github.com/ZeroDayLab/PowerSploit/blob/master/Recon/PowerView.ps1)
* SharpView
* ActiveDirectory powershell module => <https://github.com/samratashok/ADModule>
* Microsoft signed DLL => <https://github.com/samratashok/ADModule>

### Find shares on hosts in current domain (Needs defense bypass modification)

<https://github.com/darkoperator/Veil-PowerView/blob/master/PowerView/functions/Invoke-ShareFinder.ps1>

```
Invoke-ShareFinder -Verbose
```

### Find sensative files on computers in the domain (Needs defense bypass modification)

<https://github.com/gryhathack/PowerSploit_Sensitive_Info_Hunter/blob/25cf4f3d755fef1bf08e766a11e29b03a7d2d4b9/Invoke-FileFinder.ps1#L2>

```
Invoke-FileFinder -Verbose
```

### Find all file servers of the domain (Needs defense bypass modification)

<https://github.com/zloeber/PSAD/blob/fcf2936b79b5e49c99f09cea96fbafd26e6ecbf2/src/inprogress/Get-NetFileServer.ps1#L2>

```
Get-NetFileServer
```
