Active Directory Enumeration - RPC Client

“Originally, the developers designed rpcclient to perform debugging and troubleshooting tasks on a Windows Samba configuration. During that time, the designers might have been clueless about the importance of this tool as a penetration testing weapon.”

The misconception is that mapping a domain requires malware. It requires a question the domain controller is configured to answer. On a default install, a low-privileged account — sometimes an anonymous session — can list every user, every group, and the password policy, because directory services exist to hand that information out. Active Directory Enumeration: RPCClient shows how attackers turn Microsoft’s own administrative protocols into a reconnaissance channel, using native Remote Procedure Calls to read a domain’s topology without dropping a single binary on it.

The Power of SMB and RPC

RPC is the inter-process communication backbone for Windows, and much of the interesting surface rides over SMB on port 445. The manual is built entirely around rpcclient — a Linux utility that shipped as a Samba troubleshooting tool and turned out to be one of the cleaner ways to interrogate a domain controller. That heritage matters operationally: because it is administrative tooling doing administrative things, the traffic looks like management, not attack.

The guide skips theory and goes to the command line. It establishes a session (rpcclient -U) and starts firing queries. Worth stating plainly, since the book largely assumes it: how far you get depends entirely on whether the DC still allows the null or authenticated session these queries ride on — hardened 2019 and 2022 environments restrict a good deal of it, and the same command returns rich output on one domain and NT_STATUS_ACCESS_DENIED on the next.

Tactical Extraction

The real value is the catalogue of specific, actionable commands. It shows how an unprivileged foothold becomes a map toward Domain Admin:

• querydominfo & srvinfo: OS versions, domain names, and — importantly — the account lockout threshold, which tells you exactly how many passwords you can spray before locking people out and lighting up the SOC.
• enumdomusers: The full user roster with Relative Identifiers, the input for building SIDs and for the target list every later attack depends on.
• enumdomgroups: The group hierarchy. The interesting targets are rarely Domain Admins directly — they are Server Operators, Backup Operators, and the custom groups whose membership nobody audits, which is where the path of least resistance usually hides.
• LSA Querying: Using the Local Security Authority to resolve SIDs to names and surface privilege mappings, including RID cycling to enumerate accounts even where enumdomusers is blocked.

Who Is This Guide REALLY For?

• Red Teamers & Penetration Testers: Land on a Linux box in a Windows shop and rpcclient is among the quietest tools you have. This is effectively its cheat sheet.
• Blue Teamers / Threat Hunters: The detection angle is real but harder than it looks — enumdomusers is a burst of SAMR queries over 445, and separating it from legitimate management traffic means baselining which hosts normally ask, not just alerting on the query itself.
• Network Administrators: A sobering look at what a low-privileged — sometimes anonymous — session can ask the domain controller for, and a prompt to check whether RestrictAnonymous and the relevant SAMR restrictions are actually set.

The Bottom Line

This is not a zero-day book. It is a study of living off the land: intended functionality, administrative channels, and a domain that answers honestly. Its point lands — the most dangerous phase of an AD breach is not the exploit, it is the silent, methodical enumeration that decides where the exploit goes.