Covers step 3 of OSCP AD Set - Assumed Breach Methodology. Fallback when BloodHound Collection isn't available, or to cross-check its output.

Commands

# General dump
ldapdomaindump -u '<domain>\<user>' -p <pass> <DC-IP>

# rpcclient
rpcclient -U '<user>%<pass>' <DC-IP>
> enumdomusers
> enumdomgroups
> querygroupmem <rid>

# net (via impacket or Windows box)
net rpc group members "Domain Admins" -U <user>%<pass> -S <DC-IP>

# netexec module: grabs description fields
nxc ldap <DC-IP> -u <user> -p <pass> -M get-desc-users

Look For

• Nested group memberships that inherit interesting rights
• Description fields on user objects (people paste passwords here, a common OSCP trap)
• OU structure: Tier 0 objects, service accounts, disabled-but-still-privileged accounts

Next

Cheatsheets/Active Directory/Grabbing Credsbuse]], depending on findings.