> For the complete documentation index, see [llms.txt](https://notes.nomanaziz.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.nomanaziz.me/cybersecurity/penetration-testing/tryhackme/main-methodology/4.-post-exploitation/windows-active-directory/enumeration-with-powerview.md).

# Enumeration with Powerview

### Introduction

Powerview is a powerful powershell script from powershell empire that can be used for enumerating a domain after you have already gained a shell in the system.

***

### How to start up and get users and groups from PowerView.

1. Start Powershell - `powershell -ep bypass -ep` bypasses the execution policy of powershell allowing you to easily run scripts 
   \*

   ```
   <figure><img src="/files/LA6a29ujWd7eI8JJ0aeI" alt=""><figcaption></figcaption></figure>
   ```
2. Start PowerView - `. .\PowerView.ps1`
3. Enumerate the domain users - `Get-NetUser | select cn`
   \*

   ```
   <figure><img src="/files/poNDnn0eLujYn6pMHpUN" alt=""><figcaption></figcaption></figure>
   ```
4. Enumerate the domain groups - `Get-NetGroup -GroupName *admin*`
   \*

   ```
   <figure><img src="/files/E22U08WVzJkVBOtLbDRN" alt=""><figcaption></figcaption></figure>
   ```

***

### List Shared Folders

```
Invoke-ShareFinder
```

***

### Get list of Running OSs

```
Get-NetComputer -fulldata | select operatingsystem
```

***

### [Cheatsheet](https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993)

***