SID to Name translation
[adsi]LDAP://<SID=$sid>
GUID to object
[adsi]LDAP://<GUID=$guid>
Sid to Name translation (works with trusts)
string sid="S-1-5-21-789336058-507921405-854245398-9938";
string account = new System.Security.Principal.SecurityIdentifier(sid).Translate(typeof(System.Security.Principal.NTAccount)).ToString();
$objSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-21-1111111111-2222222222-3333333333-44444")
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
Name to SID translation
// set up domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain);
// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");
NTAccount f = new NTAccount("username");
SecurityIdentifier s = (SecurityIdentifier) f.Translate(typeof(SecurityIdentifier));
$user=New-Object System.Security.Principal.NTAccount("DOMAIN\Username")
$user.Translate([System.Security.Principal.SecurityIdentifier]).Value
LDAP
AD Searching
#https://blog.stealthbits.com/discovering-service-accounts-without-using-privileges/
$ldapFilter = "(&(objectclass=user)(objectcategory=user)(servicePrincipalName=*))"
$domain = New-Object System.DirectoryServices.DirectoryEntry
$search = New-Object System.DirectoryServices.DirectorySearcher
$search.Searchroot = $domain
$search.PageSize = 1000
$search.Filter = $ldapFilter
$search.SearchScope = "Subtree"
$props = "distinguishedname","name","samaccountname","title","department","directreports",
"whencreated","whenchanged","givenname","sn","userprincipalname","adspath","servicePrincipalName"
foreach ($item in $props) {
$search.PropertiesToLoad.Add($item) | out-null
}
$results = $search.FindAll()
$results | % {}$GroupName="Domain Admins"
$domain = New-Object System.DirectoryServices.DirectoryEntry
$ldapFilter ="(&(objectCategory=group)(name="+$GroupName+"))"
$search=New-Object directoryservices.DirectorySearcher($domain,$ldapFilter)
$search.SearchScope = "Subtree"
$result=$search.FindAll()
$result | % {(New-Object System.DirectoryServices.DirectoryEntry($_.Path)).Member}
Checking property IsSettable
Get-ADUser "<username>" -Properties * | ForEach-Object {$_.psobject.properties} | Select-Object -Property Name,IsSettable,IsGettable
Common filters
"(&(objectclass=user)(objectcategory=user)(servicePrincipalName=*))" # User accounts with SPN
"(&(objectclass=user)(objectcategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))" # User accounts with SPN
"(&(objectclass=organisationalUnit)(|(name=*service*)(name=*svc*)))" # User accounts with SPNUAC – Smart Card Login Enforced on The User
(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=262144) )
UAC – PWD Never Expires
(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))
UAC – CAC Enabled Accounts (no disabled accounts or password never expires)
(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=65536)(userAccountControl:1.2.840.113556.1.4.803:=262144)(userPrincipalName=1*@mil))
UAC – Not CAC Enabled (no disabled accounts or password never expires)
(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=65536)(!userPrincipalName=1*@mil))
UAC – Users with CAC enabled attributes but not enforced, exclude resource mailboxes (SN=*).
(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=65536)(!userPrincipalName=1*@mil)(sn=*))
Kerberos Preauthentication Disabled
(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=4194304))