🛠️ PowerView / SharpView - AD Enumeration Cheat Sheet

🧠 Key Takeaways

• PowerView (PowerShell) and SharpView (.NET/C#) are used for Active Directory enumeration.
• SharpView uses strings (not PowerShell objects), so it doesn’t support piping.
• SharpView is stealthier than PowerView in modern EDR/AV environments.

✅ Command Summary

📜 General Enumeration

Get-DomainPolicy
.\SharpView.exe Get-Domain
.\SharpView.exe Get-DomainOU
Get-DomainUser harry.jones | ConvertFrom-UACValue -showall
.\SharpView.exe Get-DomainUser -KerberosPreauthNotRequired
Get-DomainComputer | select dnshostname, useraccountcontrol

🧩 Misc Functions

Export-PowerViewCSV
Resolve-IPAddress -Hostname <host>
ConvertTo-SID -Name <username>
Convert-ADName -ObjectName <SID>
Invoke-UserImpersonation -Credential $cred
Invoke-RevertToSelf
Get-DomainSPNTicket
Invoke-Kerberoast
Get-PathAcl -Path <path>

🌐 Domain / LDAP Functions

Get-DomainDNSZone
Get-DomainDNSRecord
Get-Domain
Get-DomainController
Get-Forest
Get-ForestDomain
Get-ForestGlobalCatalog
Find-DomainObjectPropertyOutlier
Get-DomainUser
New-DomainUser
Set-DomainUserPassword
Get-DomainUserEvent
Get-DomainComputer
Get-DomainObject
Set-DomainObject
Get-DomainObjectAcl
Add-DomainObjectAcl
Find-InterestingDomainAcl
Get-DomainOU
Get-DomainSite
Get-DomainSubnet
Get-DomainSID
Get-DomainGroup
New-DomainGroup
Get-DomainManagedSecurityGroup
Get-DomainGroupMember
Add-DomainGroupMember
Get-DomainFileServer
Get-DomainDFSShare

🛡️ GPO Enumeration

Get-DomainGPO
Get-DomainGPOLocalGroup
Get-DomainGPOUserLocalGroupMapping
Get-DomainGPOComputerLocalGroupMapping
Get-DomainPolicy
Get-DomainGPO -ComputerIdentity WS01 | select displayname

🖥️ Computer Enumeration

Get-NetLocalGroup -ComputerName <target>
Get-NetLocalGroupMember -ComputerName <target>
Get-NetShare -ComputerName DC01
Get-NetLoggedon -ComputerName <target>
Get-NetSession -ComputerName <target>
Get-RegLoggedOn -ComputerName <target>
Get-NetRDPSession -ComputerName <target>
Test-AdminAccess -ComputerName SQL01
Get-NetComputerSiteName -ComputerName <target>
Get-WMIRegProxy
Get-WMIRegLastLoggedOn
Get-WMIRegCachedRDPConnection
Get-WMIRegMountedDrive
Get-WMIProcess
Find-InterestingFile -Path <searchpath>

🧠 Meta Functions

Find-DomainUserLocation
Find-DomainProcess
Find-DomainUserEvent
Find-DomainShare
Find-InterestingDomainShareFile
Find-LocalAdminAccess
Find-DomainLocalGroupMember

🌐 Domain Trust Functions

Get-DomainTrust
Get-ForestTrust
Get-DomainForeignUser
Get-DomainForeignGroupMember
Get-DomainTrustMapping

🖥️ System Information

net accounts