PowerView

powershell-import C:\Tools\PowerView.ps1

Obtener nombre del dominio.

powershell Get-Domain

Obtener nombre del Domain Controller.

powershell Get-DomainController | Select Forest, Name, OSVersion | fl

Enumerar Forest Domains.

powershell Get-ForestDomain

Enumerar Policy Data.

powershell Get-DomainPolicyData | select -ExpandProperty SystemAccess

Enumerar usuarios.

powershell Get-DomainUser -Properties DisplayName, MemberOf | fl
powershell Get-DomainUser -Identity emily -Properties DisplayName, MemberOf | fl

Enumerar sistemas que hay en el dominio.

powershell Get-DomainComputer -Properties DnsHostName | sort -Property DnsHostName

Enumerar Organization Units (OUs).

powershell Get-DomainOU -Properties Name | sort -Property Name

Enumerar Domain Groups.

powershell Get-DomainGroup | where Name -like "*Admins*" | select SamAccountName

Enumerar miembros de un domain group.

powershell Get-DomainGroupMember -Identity "Domain Admins" | select MemberDistinguishedName

Enumerar Group Policy Objects (GPOs).

powershell Get-DomainGPO -Properties DisplayName | sort -Property DisplayName
powershell Get-DomainGPO -ComputerIdentity DC01 -Properties DisplayName | sort -Property DisplayName

Identificar domain users/group quien tiene Local Admin via GPO o Restricted group.

powershell Get-DomainGPOLocalGroup | select GPODisplayNme, GroupName

Enumerar sistemas donde un domain user/group tiene Local Admin.

powershell Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | select ObjectName, GPODisplayName, ContainerName, ComputerName | fl

Enumerar domain machines donde los usuarios iniciaron sesion.

powershell Find-DomainUserLocation  | select Username, SessionFromName

Enumerar sesiones activas.

powershell Get-NetSession -ComputerName DC02 | select CName, UserName

Enumerar todos los Domain Trust.

powershell Get-DomainTrust

SharpView