This room moves from unauthenticated discovery into authenticated AD enumeration. Once you have a valid domain credential pair, you can enumerate the domain through Windows-native tools, PowerShell, RSAT snap-ins, and BloodHound to uncover attack paths, privilege escalation opportunities, and lateral movement routes.
Core idea: once you get even low-privileged AD credentials, the environment becomes far more observable. Authenticated enumeration often reveals the exact relationships you need for the next compromise step.
The room emphasizes that AD attacks are iterative.
This repeat loop is how red team operations and internal AD assessments usually progress.
After receiving a valid credential pair, the first practical problem is using it on a system you control.
Important habit: if AD tooling behaves strangely, check DNS first. In these environments, it really is often DNS.
The room highlights runas.exe /netonly as a key Windows-native technique when you have domain credentials but are not on a domain-joined system.
runas.exe /netonly /user:domain\username cmd.exe injects credentials for network authentication.This is especially useful for launching tools like MMC, SQL clients, or browsers against NTLM/Kerberos-backed resources.
The room uses SYSVOL access as a reliable test of whether the injected credentials are valid.
dir \\za.tryhackme.com\SYSVOL\ forces a network authentication attempt.This distinction matters because authentication protocol choice can affect both functionality and detection.
The GUI-based method in this room uses Microsoft Management Console with the Active Directory RSAT snap-ins.
Launching MMC from the runas /netonly shell allows these snap-ins to authenticate to the target domain even from a non-domain-joined system.
Main value: MMC gives a fast visual understanding of OUs, users, computers, and group relationships, which is very useful early in an engagement.
The room points out specific strengths of GUI enumeration:
Its weakness is that it is not ideal for broad, domain-wide bulk extraction of attributes.
For quick authenticated checks, Command Prompt still works well through the net command family.
net user /domain lists domain users.net user username /domain gives details about a specific user.net group /domain lists domain groups.net group "Group Name" /domain lists members of a target group.net accounts /domain reveals password policy information.This is especially useful when you need quick results, when PowerShell may be watched closely, or when operating through a constrained shell or RAT.
The room also frames PowerShell RSAT cmdlets and BloodHound as major authenticated-enumeration methods.
These tools become more important as the environment gets larger and the relationships get more complex.
This room is really about making low-privileged credentials count.
runas.exe /netonly is the key trick for using domain credentials from a non-domain-joined Windows host.net user, net group, and net accounts /domain are strong for quick command-line checks.