An active directory enumeration cheat sheet lists commands. Passing a timed exam means chaining those commands into a workflow that survives defensive controls. You need a sequence that moves from unauthenticated checks to credentialed mapping without triggering lockouts or burning hours on false positives.
This guide maps the handoffs between NetExec, PowerView, and BloodHound for OSCP, CPTS, and CRTP candidates who already know the basics but lose points on execution order. It prioritizes methodology over syntax memorization, because tool output changes while enumeration logic stays constant.
| Format | Best For | Limitation | Exam Fit |
|---|---|---|---|
| Static Cheat Sheet | Quick flag reference during lab | No context for chaining or failure states | Low |
| AD Walkthrough | Seeing full command handoffs with evidence | Specific to one machine topology | High |
| Exam Dump / Leak | Checking question style or scope | Unverified accuracy; often outdated | Risky |
| Full Bundle | Prep across multiple AD sets | Higher cost; requires self-pacing | High |
Exam-Focused AD Enumeration Order and Decision Table
Start with unauthenticated checks before touching credentialed tools. That order avoids noisy failures during timed exams. Jump straight to BloodHound without validating basic connectivity or user lists, and you usually get empty datasets and a wasted collection cycle.
Prioritizing Enumeration Steps Under Time Pressure
The recommended order for AD enumeration on a timed exam starts with passive network observation and null session testing, before any authenticated scanning. This sequence prevents account lockouts and gives you a baseline of reachable hosts that informs everything credentialed that follows.
Skipping this step is the most common reason candidates don’t finish domain objectives inside the 24-hour window. Rush an aggressive scanner without confirming SMB signing status or LDAP availability first, and you generate traffic that egress filters block or that trips an alert and shuts down your access.
Tool Selection Matrix for OSCP, CPTS, and CRTP
Your choice of tool depends on the specific exam constraints, not personal preference. NetExec is built for rapid host triage and credential validation across large subnets. PowerView gives you the granular object-relationship data needed to find non-standard abuse paths that automated collectors miss.
BloodHound has the best path visualization, but it needs careful collector selection based on AV evasion requirements and allowed protocols. For CRTP and OSEP, where stealth matters more than speed, prioritize native PowerShell cmdlets and manual LDAP queries over loud .NET binaries that get flagged on execution.
Unauthenticated Foothold: Null Sessions and LDAP Binding
Test anonymous access vectors before attempting credentialed enumeration. These probes tell you whether you can harvest usernames for password spraying or need to pivot to phishing or service exploitation instead.
Testing Anonymous Access Safely
Use ldapsearch with specific base DN parameters to extract user objects when RPC and SMB null sessions are disabled by modern hardening baselines. This fallback works in environments where admins have blocked null session access but left LDAP binding open for legacy application compatibility.
ldapsearch -x -H ldap://10.10.10.5 -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName
Failure signals here tell you as much as successful responses. A timeout means network filtering or host unreachability. An “Operations error” usually means anonymous binds are explicitly denied at the directory level.
Extracting User Lists Without Credentials
Harvesting valid usernames through unauthenticated channels gives you targets for initial credential guessing, without burning compromised accounts. Tools like kerbrute or enum4linux-ng automate this, but you still need to understand the protocol interactions to read partial results correctly.
When standard enumeration fails, check for AS-REP roasting opportunities against the discovered users. It’s a dual-purpose check: potential credentials, plus confirmation the account is valid. That matters during the early phase of domain assessment, when every minute on a dead end cuts into time you’ll need for exploitation later.
Credentialed Enumeration with NetExec and PowerView
One NetExec flag combination enumerates local administrators while checking SMB signing status at the same time, which is how you prioritize relay targets in practice. It replaces three separate queries with one command, and produces actionable intelligence about lateral movement straight from initial foothold validation.
NetExec Commands for Rapid Host Triage
NetExec identifies live hosts and local admins efficiently, feeding directly into targeted PowerView queries for group memberships, with no manual transcription. Use structured output formats that pipe cleanly into downstream tools rather than parsing human-readable text that breaks under automation.
nxc smb 10.10.10.0/24 -u svc_backup -p 'P@ssw0rd!' --local-auth --users --signing
This command validates credentials across the subnet while flagging hosts vulnerable to NTLM relay. You see immediately which machines accept the current credentials and which need a different authentication approach.
PowerView for Domain Object Relationships
PowerView reveals relationships between domain objects that automated tools flatten into generic edges. Query attributes like adminCount, servicePrincipalName, or delegation flags, and you expose attack surface that sits outside standard group membership hierarchies.
Chaining output between tools means capturing PowerView results in variables or files that feed straight into exploitation scripts. Rather than copying DNs by hand, structure your queries to return only the fields the next step needs.
Chaining Output Between Tools
Chain NetExec output into PowerView or BloodHound with intermediate files or pipeline-compatible formats that preserve object identifiers. Manual transcription introduces errors and wastes time, so build reliable handoff patterns in practice, before the exam clock is running.
Exporting host lists with validated credentials lets you target BloodHound collection at only the reachable systems. That selective approach keeps noise out of the resulting graph and speeds up path analysis when you’re working against the clock.
BloodHound Collection and Path Analysis for Exams
Veteran candidates consistently report that failing to manually verify BloodHound paths is the main cause of wasted time during OSEP and CRTP assessments. Automated collectors find theoretical paths that runtime protections, missing permissions, or environmental conditions can block, and static analysis won’t catch that.
Collector Selection and Evasion Considerations
Choosing between SharpHound and AzureHound depends on exam rules around allowed tools and detection thresholds. SharpHound’s default collection methods are thorough but noisy. Custom ingestion strategies or older binary versions sometimes get past specific AV signatures still present in legacy lab environments.
Where exams permit it, running collectors from memory rather than disk avoids many endpoint protection blocks. Know which collection flags trigger which detections, and you can balance thoroughness against stealth based on the assessment’s actual constraints.
Interpreting Shortest Paths to Domain Admin
BloodHound’s shortest path algorithm optimizes for edge count, not exploit reliability or operational safety. A five-edge path using only Kerberos delegation can beat a two-edge path requiring NTLM relay, if the target environment enforces SMB signing everywhere.
Filter out known-false-positive edges before analysis. Custom Cypher queries that exclude disabled accounts, protected groups, or unreachable hosts save significant investigation time and focus your attention on relationships that are actually exploitable.
Validating BloodHound Findings Manually
Verify BloodHound attack paths manually, edge by edge, before attempting the full chain. Confirming that WriteDacl actually grants modification rights on the target object saves hours spent building exploitation scripts against permissions that exist in the directory but not in reality.
Manual validation also surfaces timing dependencies and state requirements that automated analysis misses. Some abuse paths only work after specific services restart, or during maintenance windows, and nothing in the collected graph data tells you that.
ACL Abuse Paths and Delegation Checks
Finding misconfigured ACLs that lead to privilege escalation without password cracking takes systematic enumeration of writable permissions on high-value objects. GenericAll, WriteProperty, and Self-Membership rights on privileged groups or user accounts are the most reliable escalation vectors in modern AD environments.
Identifying Writable ACLs and GenericAll Rights
Focus ACL enumeration on objects with adminCount=1 or membership in protected groups first. These yield the highest impact when compromised. Scanning the entire directory for writable ACEs generates noise that buries genuinely dangerous configurations among thousands of benign inherited permissions.
Distinguish between direct and inherited ACLs, because that determines whether an abuse path survives permission inheritance refreshes. Direct assignments persist indefinitely. Inherited permissions can revert during routine Group Policy updates, which makes them unreliable for sustained access across a multi-day assessment.
Constrained vs Unconstrained Delegation Enumeration
Distinguish between delegation types with precise LDAP filters relevant to CRTP and OSEP objectives, and you separate exploitable misconfigurations from intentional design. Unconstrained delegation on non-DC systems is almost always a critical vulnerability. Constrained delegation needs more work: check the allowed services and protocol transition settings.
Query msDS-AllowedToDelegateTo and userAccountControl together. That combination reveals both the delegation type and whether protocol transition is enabled, which determines whether you can get forwardable tickets for arbitrary services or stay limited to specifically listed SPNs.
Pivoting and Re-Enumeration After Compromise
Re-run collectors and update scope immediately after you get new credentials. Each compromised account can reveal relationships, delegated permissions, or group memberships that were invisible from your original vantage point and that expand your attack surface.
Updating Attack Graphs with New Credentials
Updating attack graphs with new credentials means merging fresh collection data with existing findings, not replacing them. BloodHound’s database accumulates edges across multiple collection runs, building a more complete picture of domain trust relationships and permission structures as you go.
Fail to re-enumerate after privilege escalation, and you leave blind spots that may contain the actual path to domain admin. New credentials often grant read access to containers that were restricted before, and that’s where critical misconfigurations hide from lower-privileged enumeration.
Lateral Movement Verification Commands
Lateral movement verification commands confirm a theoretical path actually works before you commit to exploiting it. Test PSRemoting, WMI, or DCOM connectivity separately from credential validation, so you can isolate network blocks from authentication failures.
Keeping momentum during a 24-hour assessment depends on this loop between compromise and re-enumeration. Static planning from your initial recon goes stale within hours, as you find new infrastructure segments and trust boundaries that weren’t visible from outside.
Resource Formats: Walkthroughs vs Cheat Sheets for AD Prep
Our catalog distinguishes static cheat sheets from interactive walkthroughs based on whether the resource includes verified command outputs and evidence screenshots that exam reports require. That distinction matters because reproducing commands without seeing expected output causes confusion the moment a real environment deviates from the documentation.
Static cheat sheets work as quick references during an active engagement, but they can’t teach the decision-making behind tool selection or failure recovery. They list what to type without explaining why that flag matters in context, or what to do when the command returns something unexpected.
Full machine walkthroughs demonstrate a complete enumeration pass with annotated evidence showing what success looks like at each stage. This format builds pattern recognition that transfers across different domain topologies, because you learn structural similarities instead of memorizing specific IPs or hostnames.
Exam dumps and leaks are a different category: insight into question formats or scenario scope, with no guaranteed accuracy or currency. Relying on unverified material for technical prep risks teaching you outdated techniques that fail against current exam infrastructure. Treat them as supplementary familiarization, not primary study.
Frequently Asked Questions
How do I know if a BloodHound path is actually exploitable during an exam?
Manually test each edge in the path independently before attempting the full chain. Verify that the claimed permission actually grants the expected access by executing a harmless write or read operation against the target object. Paths relying on NTLM relay should be validated against SMB signing status first.
What’s the difference between an AD walkthrough and a cheat sheet for exam prep?
Walkthroughs show complete enumeration sequences with verified outputs and evidence documentation standards required for exam reports. Cheat sheets provide isolated command references without context for chaining tools or handling failure states. Choose walkthroughs for learning methodology and cheat sheets for quick flag lookups during practice.
Which NetExec flags give the most useful information in a single pass?
Combine –users, –local-auth, and –signing flags to validate credentials while simultaneously identifying local administrators and SMB signing status. This single command replaces separate queries for host reachability, credential validity, and relay target prioritization. Structured output formats enable direct piping into downstream enumeration tools.
When should I use ldapsearch instead of SMB-based enumeration?
Use ldapsearch when SMB null sessions are disabled or RPC endpoints are filtered by network controls. Anonymous LDAP binds often remain open for legacy application compatibility even when other unauthenticated vectors are closed. This fallback provides username harvesting capability when traditional methods fail.