Impacket GetADComputers.py

Back to the Category Index / Back to the Command Index

Overview

Retrieves computer accounts’ operating systems, last logon times, and other details from LDAP. It can also look up IP addresses through DNS.

Item	Details
Implementation	examples/GetADComputers.py
Category	Active Directory / LDAP / Account Management
Size	234 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/GetADComputers.py -h for the current option definitions.

Argument	Description
target	domain[/username[:password]]
-user	Request data for a specific user.
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-resolveIP	Resolve computer objects’ IP addresses through DNS lookups using the DC.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller IP address. Defaults to the domain (FQDN) in target.
-dc-host	Domain controller hostname. Defaults to the domain (FQDN) in the account parameter.
-ldaps / -use-ldaps	Use LDAPS instead of LDAP.

Detailed Processing Flow

The command parses the identity, binds to LDAP or LDAPS, and searches for computer objects. processRecord() converts LDAP attributes and Windows timestamps for display. With -resolveIP, it queries DNS. -user restricts the search to a specific account.

How It Works

The search targets LDAP computer objects. run() builds the base DN from the domain and, if a user is specified, filters by sAMAccountName. Otherwise, it retrieves computer accounts in bulk. Because returned attributes are not always present, processRecord() handles OS details, DNS hostnames, UAC, and time attributes separately, leaving missing values blank.

Active Directory time attributes use Windows FILETIME, which starts in 1601, rather than Unix timestamps. Conversion also prevents zero or unset values from appearing as ordinary dates. Disabled accounts are identified using userAccountControl bit flags, not strings. When adding attributes, normalize types and special values instead of passing LDAP byte/string values directly to the display layer.

-resolveIP is an additional step that resolves the LDAP dNSHostName to an A record using the configured DC resolver. A successful LDAP lookup does not guarantee DNS resolution, so computers without DNS records must remain in the results. Keep search filters, attribute conversion, and DNS enrichment separate.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
GetADComputers	42	__init__(), getUnixTime(), processRecord(), run()

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.dcerpc.v5.samr	UF_ACCOUNTDISABLE
impacket.examples	logger
impacket.examples.utils	ldap_login, parse_identity
impacket.ldap	ldap, ldapasn1

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
dns	dnspython	Imported directly; not declared as a direct dependency

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on impacket.ldap.ldap / ldapasn1, SAMR’s UF_ACCOUNTDISABLE, examples.utils.ldap_login, and dns.resolver. If you change search filters or attributes, update both run() and processRecord() and allow for missing attributes.

Verification

• Syntax: python -m py_compile examples/GetADComputers.py
• CLI: python examples/GetADComputers.py -h
• Related test: tests/SMB_RPC/test_ldap.py
• Related test: tests/dcerpc/test_samr.py