Active Directory User Enumeration: 16 Techniques and Defenses

Summary

A hands-on guide demonstrates 16 ways to enumerate Active Directory users through LDAP, SAMR, RPC, LSARPC and Windows APIs, then outlines monitoring and hardening measures including LDAP auditing, RPC monitoring, honey accounts and privilege tiering.

Key points

• Demonstrates 16 enumeration tools and techniques against an Active Directory lab using a low-privileged account.
• The tools retrieve usernames and may expose RIDs, timestamps, account descriptions, group memberships, service principal names and organizational structure.
• Examples cover LDAP, SAMR, RPC, LSARPC, BloodHound and native Windows APIs.
• BloodHound provides a graph view of relationships and potential paths to privileged accounts.
• The guide warns that sensitive role or weakness clues in account descriptions can aid attackers.
• Defensive recommendations include auditing LDAP queries, monitoring SAMR and LSARPC traffic, using honey-token accounts and restricting privileged-account logons.

MITRE ATT&CK

Products

Tools

Related Articles

• Sophos Details AI-Assisted Aur0ra Ransomware Operationssophos.comImpacket · Microsoft Active Directory · NetExec
• Researchers Tie Network-Edge Campaign to More Than 70,000 Exposed Credentialsthehackernews.comImpacket · NetExec
• ESET H1 2026 Threat Report Finds Rising ClickFix, QR Phishing and Malicious AI Skillsgithub.com/jacobdjwilsonBloodHound · Impacket
• Sophos 2026 Active Adversary Report: Identity Failures Dominate Initial Accessgithub.com/jacobdjwilsonImpacket · Microsoft Active Directory
• Kaspersky 2026 Report Highlights Exploited Applications, Trusted Access and SOC Detection Gapsgithub.com/jacobdjwilsonImpacket · Microsoft Active Directory