AD: Authenticated Enumeration TryHackMe

Overview

This room focuses on what changes once you have a valid AD account. It covers authenticated enumeration with built-in Windows tools, PowerShell AD modules, PowerView, BloodHound, and a practical AS-REP Roasting workflow for accounts that do not require Kerberos preauthentication.

Core idea: the jump from unauthenticated to authenticated AD access is significant. Even low-privileged credentials can expose users, groups, privileges, password policy, and attack paths that were invisible before.

1) Why Authenticated Enumeration Matters

This room builds directly on unauthenticated recon. Once you can log in, you can query the domain much more effectively and with more precision.

Enumerate users, groups, policies, and privileges.
Identify misconfigurations and weak targets.
Discover escalation and lateral movement paths.
Map the domain more accurately with graph-based tools.

2) AS-REP Roasting

AS-REP Roasting targets user accounts that have Kerberos preauthentication disabled.

These accounts do not need to be service accounts.
If UF_DONT_REQUIRE_PREAUTH is set, the KDC can return an AS-REP blob without verifying the user first.
The returned material can be cracked offline to recover the user’s password.

Difference from Kerberoasting: Kerberoasting targets service tickets; AS-REP Roasting targets users with preauth disabled.

3) Enumerating AS-REP Roastable Users

The room presents two common approaches:

Rubeus: good on Windows environments.
Impacket GetNPUsers.py: good on Linux or AttackBox.

Using GetNPUsers.py, you can provide a list of usernames and request AS-REP material for any vulnerable accounts without supplying a password.

4) Cracking AS-REP Hashes

Once the AS-REP material is collected, the next step is offline cracking.

Hashcat mode 18200 is used for AS-REP hashes.
A common workflow is hashcat -m 18200 hashes.txt wordlist.txt.
Success depends heavily on password strength and user hygiene.

This is a low-noise attack because the expensive password guessing happens offline after the material is collected.

5) Manual Enumeration with Native Commands

The room also emphasizes living-off-the-land enumeration from a shell on a Windows host.

whoami confirms user and domain context.
whoami /all reveals SIDs, group memberships, and privileges.
hostname, systeminfo, and set expose host, OS, and domain context.

Important privileges: the room specifically calls out SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, SeBackupPrivilege, SeRestorePrivilege, and SeDebugPrivilege as especially valuable.

6) NET Commands for Domain Enumeration

Classic CMD tooling still gives a lot of value in AD environments.

net user /domain lists domain users.
net user username /domain gives account details and some group info.
net group /domain lists domain groups.
net group "Group Name" /domain lists group membership.
net accounts /domain helps reveal password policy.

This is one of the cleanest ways to perform fast authenticated enumeration without introducing extra tooling.

7) PowerShell AD Modules and PowerView

The room also frames PowerShell-based enumeration as a major step up in flexibility.

ActiveDirectory module: structured querying of users, groups, computers, and policies.
PowerView: PowerSploit-based AD enumeration focused on offensive discovery.

These approaches are stronger for bulk collection, filtering, and targeted hunting than the simpler net commands.

8) BloodHound

BloodHound remains one of the most useful authenticated AD tools because it maps relationships rather than just listing objects.

Useful for finding hidden privilege escalation paths.
Highlights group nesting, delegation, local admin rights, and attack chains.
Turns large, complex domains into something much easier to reason about.

9) Practical Authenticated Enumeration Mindset

This room is about using a legitimate foothold to transition from “we have a user” to “we understand the domain.”

Check who you are and what privileges you already have.
Enumerate users, groups, and policies quietly.
Test for roastable accounts and weak passwords.
Use PowerShell and BloodHound when you need scale and relationship mapping.
Feed everything you learn back into privilege escalation and lateral movement planning.

Exam Notes (PT1)

AS-REP Roasting targets accounts with Kerberos preauthentication disabled and can be performed without knowing the password.
GetNPUsers.py and Hashcat mode 18200 are the key tools to remember for that workflow.
whoami /all is one of the fastest ways to assess privilege-bearing group memberships and dangerous token privileges.
net user, net group, and net accounts /domain remain useful low-friction AD enumeration commands.
PowerView, the ActiveDirectory PowerShell module, and BloodHound provide broader authenticated domain visibility than native CMD alone.