Active Directory / LDAP / Account Management

Back to the Command Index

This category covers accounts, delegation, and security descriptors through LDAP (389/636/3268) and SAMR / LSA RPC.

LDAP and AD Security Descriptors — bind, CBT, SD, ACE, GUID
DCE/RPC and NDR — SAMR, LSAT, LSAD
Kerberos — -k, tickets after S4U / RBCD
DPAPI / SAM / LSA / NTDS — LAPS / GKDI

There are two LDAP client families. Enumeration commands use impacket.ldap.LDAPConnection; dacledit / rbcd / owneredit / badsuccessor use ldap3. impacket.acl handles file ACLs, so it is not used for AD DACLs.

Command Index

Command	Summary
CheckLDAPStatus.py	Checks whether a domain controller requires LDAP signing and LDAPS channel binding.
GetADComputers.py	Retrieves computer accounts’ OS and last logon times from LDAP. Optionally fills in IP addresses through DNS.
GetADUsers.py	Retrieves users’ email addresses, password change dates, and last logon times from LDAP. By default, targets enabled users.
GetLAPSPassword.py	Reads legacy LAPS and Windows LAPS attributes from LDAP. Fetches a GKDI key to decrypt encrypted Windows LAPS passwords.
findDelegation.py	Searches LDAP and lists unconstrained delegation, constrained delegation, and RBCD settings in the domain.
addcomputer.py	Creates, deletes, and checks domain computer accounts. Supports SAMR, LDAPS, LDAP attribute setup after SAMR creation, and LDAP attribute setup on existing accounts.
badsuccessor.py	Creates, modifies, and deletes delegated Managed Service Accounts (dMSAs), and examines related AD attributes.
dacledit.py	Reads LDAP object DACLs and adds, removes, or restores ACEs. Targets can be specified by name, SID, or DN.
owneredit.py	Reads the owner from an LDAP object’s security descriptor and changes it to a specified SID.
rbcd.py	Reads a computer account’s `msDS-AllowedToActOnBehalfOfOtherIdentity` and adds or removes delegate accounts.
net.py	Uses SAMR to query and modify users and groups, similarly to Windows `net user` and `net group`.
netview.py	Finds hosts in the domain, checks SMB sessions and logged-on users, and locates the hosts to which a specified user is connected.
lookupsid.py	Queries LSA for SIDs by RID and enumerates mappings between domain SIDs and account names.
samrdump.py	Retrieves users and account details from a target host or domain through SAMR, and outputs a table or CSV.
machine_role.py	Determines whether a target Windows machine is standalone, a domain member, or a domain controller, and displays domain and forest details.
changepasswd.py	Changes a user’s own password or performs an administrator reset through Kerberos kpasswd, SAMR, or LDAP.