Impacket GetADUsers.py

Back to the Category Index / Back to the Command Index

Overview

Retrieves users’ email addresses, password change times, last logon times, and other details from LDAP. By default, it targets active users.

Item	Details
Implementation	`examples/GetADUsers.py`
Category	Active Directory / LDAP / Account Management
Size	195 lines
Distribution	Installed as a script through `scripts=examples/*.py` in `setup.py`

CLI and Inputs

Check python examples/GetADUsers.py -h for the current option definitions.

Argument	Description
`target`	`domain[/username[:password]]`
`-user`	Request data for a specific user.
`-all`	Return all users, including those without email addresses and disabled accounts. With `-user`, return that user even if the account is disabled.
`-ts`	Add timestamps to log output.
`-debug`	Enable debug logging.
`-hashes`	NTLM hashes in `LMHASH:NTHASH` format.
`-no-pass`	Skip the password prompt (useful with `-k`).
`-k`	Use Kerberos authentication. Read credentials from the ccache (`KRB5CCNAME`) based on the target; fall back to command-line credentials if none are valid.
`-aesKey`	128- or 256-bit AES key for Kerberos authentication.
`-dc-ip`	Domain controller IP address. Defaults to the domain (FQDN) in `target`.
`-dc-host`	Domain controller hostname. Defaults to the domain (FQDN) in the account parameter.
`-ldaps / -use-ldaps`	Use LDAPS instead of LDAP.

Detailed Processing Flow

The command resolves the identity and authentication method, binds to LDAP, searches for users, converts the records, and prints a table. processRecord() handles FILETIME values and account-control flags.

How It Works

This command is an LDAP reader that lists user objects; it does not read the SAM database directly. run() applies a user filter to the domain naming context. -user selects one sAMAccountName; without -all, the results are limited mainly to active accounts in regular use. Where the LDAP server’s size limit is exceeded, library search/paging behavior also affects the result count.

processRecord() converts raw LDAP attributes into table rows. For example, pwdLastSet and lastLogon are FILETIME values, userAccountControl is a bit field, and mail or description may have multiple values. A missing value is not the same as an empty string. When adding optional schema attributes, account for absent, NULL, and multivalued cases.

The displayed lastLogon value belongs to the queried DC and may differ from the replicated lastLogonTimestamp. Do not interpret this output as the exact last logon across the entire domain. When developing the command, keep the search filter’s meaning aligned with the AD attribute named by each display label.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
`GetADUsers`	38	`__init__()`, `getUnixTime()`, `processRecord()`, `run()`

Dependencies

Internal Impacket Modules

Module	Main Names Used
`impacket`	`version`
`impacket.dcerpc.v5.samr`	`UF_ACCOUNTDISABLE`
`impacket.examples`	`logger`
`impacket.examples.utils`	`ldap_login`, `parse_identity`
`impacket.ldap`	`ldap`, `ldapasn1`

Output, Side Effects, and Required Privileges

Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.

Failure Paths and Cleanup

On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command uses impacket.ldap.ldap / ldapasn1, examples.utils.parse_identity / ldap_login, and SAMR constants. If you add retrieved attributes, also test for missing values in anonymous or restricted-permission environments.

Verification

Syntax: python -m py_compile examples/GetADUsers.py
CLI: python examples/GetADUsers.py -h
Related test: tests/SMB_RPC/test_ldap.py
Related test: tests/dcerpc/test_samr.py