13 — Rsat

RSAT (Remote Server Administration Tools) allows administrators to remotely manage Windows Server roles and features, including Active Directory, DNS, DHCP, and Group Policy from a Windows workstation (Pro/Enterprise editions only).

RSAT includes:

• Active Directory Users and Computers
• ADSI Edit
• Group Policy Tools
• DNS/DHCP Management
• PowerShell AD Module
• MMC Snap-ins

🔍 Check Installed RSAT Tools

Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property Name, State

📦 Install RSAT Tools

https://gist.github.com/dually8/558fcfa9156f59504ab36615dfc4856a

https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools

Install All RSAT Tools

Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability –Online

Install a Specific Tool (e.g., AD Tools)

Add-WindowsCapability -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 –Online

👤 Use Alternate User Credentials with runas

Start PowerShell as a Domain User

runas /netonly /user:DOMAIN\USERNAME powershell

Start MMC as a Domain User

runas /netonly /user:DOMAIN\USERNAME mmc

After MMC opens:

1. Add RSAT Snap-ins (e.g., Active Directory Users and Computers).

2. Right-click the snap-in → Change Domain → Enter domain name (e.g., corp.local).

🛡️ Credential-Based Enumeration

Use Rubeus to Request a TGT with NTLM Hash

rubeus.exe asktgt /user:USERNAME /domain:peach.local /dc:DC_IP /rc4:NTLM_HASH

Use Mimikatz for Pass-the-Hash

mimikatz.exe sekurlsa::pth /domain:corp.local /user:USERNAME /rc4:NTLM_HASH