XUTS LABS
Back to Red Team Playbooks
Active DirectoryRed Team Playbook

Active Directory Initial Enumeration

Establish domain, DC, LDAP, SMB, DNS, Kerberos, and trust context before choosing credential or graph collection paths.

ADLDAPSMBKerberosRecon

Purpose

Build a reliable first-pass AD map without assuming credentials, domain names, or privileges that have not been provided.

Inputs

  • - DC_IP
  • - DOMAIN
  • - KALI_IP
  • - username/password or hash if authorized
  • - output directory

Prerequisites

  • - Authorized AD scope
  • - DC IP or hostname
  • - Network route from Kali
  • - Rules for credential handling

Operator Assumptions

  • - Use placeholders until domain and credential context are confirmed.
  • - Prefer low-noise enumeration before credential-audit steps.

Commands

Service inventory

Kali
nmap -sC -sV -oN nmap_initial.txt DC_IP

Why: Identify LDAP, Kerberos, SMB, DNS, WinRM, and web services.

Expected: Open ports such as 53, 88, 135, 389, 445, 464, 593, 636, 3268, or 5985.

LDAP RootDSE

Kali
ldapsearch -x -H ldap://DC_IP -s base -b '' namingContexts defaultNamingContext dnsHostName

Why: Discover the naming context and DC DNS identity without credentials where allowed.

Expected: defaultNamingContext such as DC=example,DC=local.

SMB signing and hostname

Kali
netexec smb DC_IP

Why: Record host identity and SMB signing state.

Expected: Domain, hostname, SMB signing, and OS banner.

Decision Points

  • - If RootDSE is anonymous, derive the base DN before authenticated queries.
  • - If credentials exist, move to LDAP Enumeration and BloodHound Collection.
  • - If no credentials exist, use OSINT/userlist-only AS-REP checks only when authorized.

Follow-On Actions

  • - LDAP Enumeration
  • - AS-REP Roasting
  • - Kerberoasting
  • - BloodHound Collection

Evidence To Capture

  • - Nmap output
  • - RootDSE output
  • - SMB signing state
  • - Confirmed domain name and DC hostname

Common Failures

  • - DNS name does not resolve until /etc/hosts is updated.
  • - LDAP signing or TLS requirements change bind syntax.
  • - Clock skew breaks Kerberos commands.

Operational Cautions

  • - Do not spray passwords from this phase.
  • - Do not infer DCSync viability from open LDAP alone.

Related Content

LDAP EnumerationLabsAsk EXO