Active Directory Enumeration Mindmap: A Must-Have Red Team Roadmap

Why AD Enumeration Is Critical

After compromising a domain machine, attackers must fully map AD data; missing information can cause missed privileged entry points. AD stores users, computers, GPOs, trusts, etc., making it the “neural center” of a Windows domain. Speed and completeness of enumeration determine penetration success.

Core Mindmap Content

2.1 User and Identity Enumeration

Key tools: SMB anonymous sessions, RPC queries, LDAP anonymous bind. Commands such as enum4linux, rpcclient, and net user /domain can harvest usernames, email addresses, password policies, and other sensitive data. The results drive subsequent password‑spraying or credential‑replay strategies.

2.2 Computer and SMB Enumeration

Key tools: NetExec (successor to CrackMapExec), smbclient, SMB NULL sessions.

SMB is the primary Windows domain communication protocol; lateral movement relies on port 445. Enumeration reveals open shares (DFS, SYSVOL, NETLOGON), machines recently accessed by domain admins, and SMB services with weak passwords or known vulnerabilities.

2.3 Kerberos Enumeration

Key tools: Kerbrute, impacket, enum4linux.

Kerberos is the core AD authentication protocol. Enumeration can discover valid domain users (Kerbrute brute‑force), enable Kerberoasting (offline cracking of service‑account tickets), and perform AS‑REP roasting (offline cracking without pre‑authentication).

2.4 BloodHound Collection

Key tools: SharpHound (.NET collector), BloodHound (graph analysis UI).

BloodHound builds attack‑path graphs using collected data such as group memberships, ACL chains, login session relationships, and GPO links, highlighting the shortest route from the foothold to domain administrators.

Additional Enumeration Dimensions

DNS enumeration: Queries reveal internal servers, site topology, and hidden domain names.

LDAP enumeration: Retrieves all object attributes, including certificate templates, trust relationships, and SPNs.

Group & OU enumeration: Shows permission structures and GPO application paths, helping locate high‑privilege groups like Domain Admins.

Forest enumeration: Detects cross‑domain trusts in multi‑domain environments.

RPC & WinRM enumeration: Uses RPC and WinRM to gather remote system information for lateral movement.

Recommended Toolchain

BloodHound + SharpHound – AD attack‑path graph analysis (essential)

NetExec (CrackMapExec) – multi‑protocol enumeration for SMB/LDAP/WinRM (essential)

PowerView – PowerShell‑based AD enumeration (common)

Kerbrute – Kerberos username enumeration (common)

impacket – Full suite for RPC/LDAP/SMB protocols (essential)

Red‑Team Perspective

From an attacker’s view, the mindmap provides a systematic workflow: obtain a foothold → enumerate AD comprehensively → draw attack‑path graph → follow the graph to compromise domain administrators. BloodHound tells “where to strike”; the mindmap tells “where to start”. Together they form a complete AD penetration methodology.

Resources

The high‑resolution mindmap is hosted on GitHub and freely downloadable:

Project URL: https://github.com/Ignitetechnologies/Mindmap

AD Enumeration branch: AD Enumeration directory

File formats: PNG (HD/UHD), PDF

Direct download: https://github.com/Ignitetechnologies/Mindmap/blob/main/AD%20Enumeration/AD%20Enumeration%20HD.png