windapsearch.py — LDAP User & Group Enumeration

Setup

git clone https://github.com/ropnop/windapsearch
cd windapsearch
pip3 install python-ldap
python3 windapsearch.py --help

It talks plain LDAP (389) by default — use it when ldapsearch with -x -b is clunky and you want quick "give me all users" output.

Core options

Option	Meaning
-d domain.local	Domain (needed for NTLM-style binds + base DN inference)
--dc-ip <ip>	Domain controller IP
-u user / -p pass	Authenticated bind (DOMAIN\user or [email protected])
-U	Dump users (sAMAccountName + DN)
-G	Dump groups
-C	Custom LDAP filter + attributes
--da	Members of Domain Admins
-m <group>	Members of a specific group (-m "Remote Desktop Users")
--members	With -m / -G: list group membership details
--full	Full attributes (all objects)
-s <base>	Override search base DN
--filter <ldapfilter>	Extra AND filter on top of the default objectClass

Methodology (AD user recon)

1. Anonymous first — always try before using creds

# Base info + default naming context
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172

# All users
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 -U

# All groups
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 -G

If anonymous LDAP binds are allowed you get the full user list without any auth — same data rpcclient enumdomusers gives, plus group structure.

2. High-value groups

# Domain Admins
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 --da

# Custom privileged group (the box-specific one)
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 -m "Azure Admins" --members

Why --members matters: a group name alone is useless — you want to see who sits in Domain Admins, Backup Operators, or a custom group like Azure Admins. On Monteverde this exact query shows AAD_987d7f2f57d2, Administrator, mhope — the whole privesc premise in one line.

3. Authenticated enumeration (when anonymous is locked down)

python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 \
  -u 'megabank.local\mhope' -p 'password' -U

4. Custom filters for targeted questions

# Service accounts (description usually gives them away)
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 \
  -C "(&(objectCategory=user)(servicePrincipalName=*))" samaccountname description

# Users with SPNs → kerberoast targets
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 \
  -C "(servicePrincipalName=*)" samaccountname

# Computers
python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 -C "(objectClass=computer)" dn

Tips & gotchas

• Anonymous LDAP on DCs is often disabled (NTFRS/security default) — if you get Operations error / Insufficient access, grab any foothold creds first and rerun authenticated.
• SPN query = kerberoast pipeline: feed samaccountname output to GetUserSPNs.py -usersfile or impacket-GetUserSPNs directly.
• Output is tabular (dn | samaccountname) — easy to grep/awk into wordlists for password sprays:

  python3 windapsearch.py -d megabank.local --dc-ip 10.10.10.172 -U \
    | awk '{print $2}' | tail -n +3 > users.txt

• If only LDAPS (636) is available, fall back to ldapsearch -H ldaps://dc with the same base/filter logic.