> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/active-directory-ad/domain-enumeration.md).

# Domain Enumeration

Once we obtain a foothold in an AD network, we will be moving to the domain enumeration phase. Our objective is to collect the following information within the AD network:

* Users
* Groups
* Computers
* Shares
* GPO
* ACL
* Trust

The most popular tools for domain enumeration are:

* `net user /domain`
* PowerView
* BloodHound