Perquisites

• Microsoft Active Directory Management DLL
• PowerShell Active Directory module ActiveDirectory.psd1
• ActiveDirectory.Format.ps1xml file from

<aside> 💡 No Admin Privileges needed to import the DLL or use it. Domain enumeration can be done with unprivileged user

</aside>

Import Modules

Import Microsoft Active Directory Management DLL

**Import-Module C:\\Active-Directory-Module\\Microsoft.ActiveDirectory.Management.dll**

Import PowerShell Active Directory module ActiveDirectory.psd1

**Import-Module  C:\\Active-Directory-Module\\ActiveDirectory\\ActiveDirectory.psd1**

<aside> 💡 Why using PowerShell Active Directory Module is better than PowerView?

There are couple reasons you might consider when enumerating Active Directory environment, depending on the type of the assessment whether an internal pentesting with some level of noise or stealth of a red teaming:

• PowerShell AD Commandlets don’t trigger malicious alters right off the bat, because they are built-in Microsoft (MS) signed commands.
• Even if the administrators have turned on the constrained language mode, these command would still run with no issues. </aside>

Enumerating Organizational Units [OU]

The command returns all of the available organizational units

**Get-ADOrganizationalUnit -Filter * -Properties ***

Sites

**GET-ADReplicationSite -filter * | select Name, Description**

Subnet

**Get-ADReplicationSubnet -Filter * | select name, site**