Impacket addcomputer.py

Back to the Category Index / Back to the Command Index

Overview

Creates, deletes, and checks domain computer accounts. In addition to SAMR and LDAPS, it can set LDAP attributes on accounts created through SAMR or on existing accounts.

Item	Details
Implementation	examples/addcomputer.py
Category	Active Directory / LDAP / Account Management
Size	498 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/addcomputer.py -h for the current option definitions.

Argument	Description
-domain-netbios	The domain’s NetBIOS name. Specify it if the DC handles multiple domains.
-computer-name	Name of the computer account to add. Generated randomly if omitted.
-computer-pass	Password to set. Generated randomly if omitted.
-no-add	Set only the password of an existing computer account, without creating a new one.
-delete	Delete an existing computer account.
-ts	Add timestamps to logs.
-debug	Enable debug logging.
-method	Operation method. SAMR_LDAP sets LDAP attributes after SAMR creation; LDAP_FINALIZE sets attributes on an existing account. Choices: SAMR, SAMR_LDAP, LDAPS, LDAP_FINALIZE. Default: SAMR.
-port	Connection port: 139, 445, or 636. Defaults are 445 for SAMR and 636 for LDAPS.
-baseDN	LDAP base DN. Derived from the specified account’s domain if omitted.
-computer-group	Destination for the computer account. Defaults to CN=Computers.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the interactive password prompt.
-k	Use Kerberos authentication. If the ccache has no credentials, use the command-line values.
-aesKey	A 128- or 256-bit AES key for Kerberos authentication.
-dc-host	Hostname of the domain controller to connect to. Derived from the account’s domain if omitted.
-dc-ip	IP address of the domain controller to connect to.
account	Account used for authentication, in [domain/]username[:password] format.

Detailed Processing Flow

The arguments determine the account, DC, computer name, and password. -method then selects run_samr(), run_ldaps(), or LDAPFinalizeComputerAccount(). SAMR_LDAP sets LDAP attributes after run_samr() creates the account. If no name is given, it generates a random one.

How It Works

Computer account creation has two paths: SAMR and LDAPS. The SAMR path opens a domain handle over RPC and sets the account type and initial password for a machine account. The LDAPS path adds a directory object and sets attributes such as sAMAccountName, userAccountControl, and DNS hostname. Although both paths add an account, they encounter different server-side authorization checks and require different ports. After creation, SAMR_LDAP calls LDAPFinalizeComputerAccount() to set the DNS hostname, SPN, and other attributes. LDAP_FINALIZE applies only those settings to an existing computer account.

run() first chooses the action (add, delete, or existence check) and -method, then passes them to the selected backend. If no computer name is given, it generates a random name ending in $, and it also generates a password if none is supplied. Because later steps need these generated values, avoid exposing them in logs. Return only the values associated with the successfully created object to the user.

The target DN and -computer-group matter for LDAP; the domain NetBIOS name and RID/domain handle matter for SAMR. The methods can set different attributes, so check the attributes after creation, behavior for an existing name, and any object left behind if LDAP setup fails after SAMR creation.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
ADDCOMPUTER	46	__init__(), run_samr(), run_ldaps(), LDAPFinalizeComputerAccount(), LDAPComputerExists(), LDAPGetComputer(), generateComputerName(), doSAMRAdd(), run()

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.examples	logger
impacket.examples.utils	init_ldap_session, ldap3_kerberos_login, parse_identity
impacket.dcerpc.v5	epm, samr, transport
impacket.spnego	SPNEGO_NegTokenInit, TypesMech

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
ldap3	ldap3	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

• Some operations change the target’s state. Confirm the target name, SID, and path before making changes.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on dcerpc.v5.samr / transport / epm, ldap3, and examples.utils.init_ldap_session. ADDCOMPUTER owns the operation branches. Keep the default container, NetBIOS domain, and LDAP base DN semantics consistent between the two paths.

Verification

• Syntax: python -m py_compile examples/addcomputer.py
• CLI: python examples/addcomputer.py -h
• Related test: tests/SMB_RPC/test_spnego.py
• Related test: tests/misc/test_dcerpc_v5_ndr.py