PowerView is a powerful PowerShell tool designed for network reconnaissance and situational awareness within Windows Active Directory (AD) environments. It’s widely used in penetration testing and red team operations, but it can also be valuable for system administrators who want to audit and understand their domain infrastructure.

🛠️ What PowerView Does

PowerView is part of the PowerSploit framework and offers a suite of cmdlets and functions that interact with AD using native PowerShell and Win32 API calls. Here’s what it can do:

• Enumerate AD Objects:

  • Users, groups, computers, organizational units (OUs)
  • Domain controllers and trusts
  • Group Policy Objects (GPOs)

• Discover Privileges and Access:

  • Find where users have local admin rights
  • Identify machines with unconstrained delegation
  • Locate service accounts and SPNs (Service Principal Names)

• Audit and Hunt:

  • Track where specific users are logged in
  • Hunt for privileged accounts
  • Check for misconfigurations or risky permissions

• Perform Reconnaissance:

  • Map out domain relationships and trust boundaries
  • Convert between different AD name formats and SIDs
  • Export findings to CSV for reporting

🔍 Example Use Cases

• Red Teaming: Used to gather intelligence before lateral movement or privilege escalation.
• Blue Teaming: Helps defenders audit domain configurations and detect potential attack paths.
• System Administration: Useful for managing and documenting AD environments.

PowerView offers a rich set of PowerShell commands for Active Directory enumeration and privilege auditing. Here’s a curated list of some of the most commonly used PowerView commands, organized by purpose:

🧭 Domain Enumeration

• Get-NetDomain
  Retrieves information about the current domain.

• Get-NetDomainControllers
  Lists all domain controllers in the current domain.

• Get-NetForest
  Provides details about the forest the domain belongs to.

• Get-NetUser
  Enumerates all users in the domain. You can filter with | select samaccountname.

• Get-NetGroup
  Lists all groups in the domain.

• Get-NetGroupMember -Identity "Domain Admins"
  Shows members of a specific group.

🖥️ Computer & Host Discovery

• Get-NetComputer
  Lists all computers in the domain.

• Get-NetGPO
  Retrieves Group Policy Objects.

• Invoke-ShareFinder
  Finds shared folders across domain machines.

• Get-NetSession
  Shows active sessions on a machine (who’s logged in).

🔐 Privilege & Access Auditing

• Invoke-CheckLocalAdminAccess
  Checks if the current user has local admin rights.

• Find-LocalAdminAccess
  Finds machines where a user has local admin access.

• Find-DomainUserLocation
  Locates where a domain user is logged in.

• Find-InterestingDomainShareFile
  Searches for potentially sensitive files in domain shares.

🧠 Advanced Recon

• Get-DomainPolicy
  Retrieves domain password and lockout policies.

• Get-DomainTrust
  Lists trust relationships between domains.

• Get-DomainObjectAcl
  Audits ACLs on domain objects.

• Get-DomainGroupMember -Identity "Domain Admins" -Recurse
  Recursively lists all members of a group.

🧪 Setup & Execution

Before running PowerView, you typically start with:

powershell -ep bypass
Import-Module .\PowerView.ps1