CATEGORY -ACTIVE DIRECTORYactive-directory-enumeration-referenceActive Directory Domain Services Architecture

Active Directory LDAP & Domain Enumeration

LDAP search filters, BloodHound collection syntax, and read-only domain enumeration queries for auditing Active Directory objects.

Core Purpose & Operating Context

Auditing domain objects, high-privilege groups, and Service Principal Names (SPNs) using LDAP queries.

01.

Useful LDAP Search Filters

Filter strings for querying directory services via ldapsearch or PowerShell.

Enumerate all user accounts with configured Service Principal Names (Kerberoastable accounts)

$(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))

Find accounts with 'Do not require Kerberos preauthentication' set (AS-REP Roasting target)

$(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))

Find all users and groups protected by AdminSDHolder (Domain Admins, Enterprise Admins, etc.)

$(adminCount=1)

•

Unconstrained delegation allows a compromised server to impersonate any user who authenticates to it against any domain service.

•

Regularly audit userAccountControl bit 4194304 (DONT_REQ_PREAUTH) to ensure sensitive accounts enforce Kerberos pre-authentication.