DSQUERY
Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.
Active Directory Query Commands. Query AD for users, computers, groups, and other objects. Requires RSAT (Remote Server Admin Tools) on workstations.
DSQUERY USER#
dsquery user # All users dsquery user -name *admin* # Name contains admin dsquery user -samid jsmith # By SAM account name dsquery user -inactive 4 # Inactive 4+ weeks dsquery user -stalepwd 30 # Password unchanged 30+ days dsquery user -disabled # Disabled accounts dsquery user -limit 0 # No limit (default 100) # Common options -o dn # Output DN (default) -o rdn # Relative DN -o samid # SAM account name # Examples dsquery user -name "John*" -o samid dsquery user "OU=Users,DC=domain,DC=com" dsquery user -disabled -limit 0
DSQUERY COMPUTER#
dsquery computer # All computers dsquery computer -name *srv* # Name contains srv dsquery computer -inactive 8 # Inactive 8+ weeks dsquery computer -stalepwd 90 # Password unchanged 90+ days dsquery computer -disabled # Disabled accounts dsquery computer -o samid # Output SAM names dsquery computer "OU=Servers,DC=domain,DC=com"
DSQUERY GROUP#
dsquery group # All groups dsquery group -name *admin* # Name contains admin dsquery group -samid "Domain Admins" dsquery group "OU=Groups,DC=domain,DC=com"
DSQUERY OU#
dsquery ou # All OUs dsquery ou -name *sales* # Name contains sales dsquery ou "DC=domain,DC=com" # OUs in domain
DSQUERY SERVER#
dsquery server # All domain controllers dsquery server -forest # All DCs in forest dsquery server -domain domain.com # DCs in specific domain dsquery server -isgc # Global Catalog servers
DSQUERY SITE#
dsquery site # All sites dsquery site -name "Default*"
DSQUERY CONTACT#
dsquery contact # All contacts dsquery contact -name "*vendor*"
DSQUERY QUOTA#
dsquery quota # All quota specs dsquery quota -acct "DOMAIN\user"
DSQUERY PARTITION#
dsquery partition # All partitions
DSQUERY STAR (LDAP)#
# Custom LDAP queries dsquery * -filter "(objectClass=user)" dsquery * -filter "(objectCategory=computer)" dsquery * -filter "(&(objectClass=user)(department=IT))" dsquery * -filter "(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com)" # With attributes dsquery * -filter "(objectClass=user)" -attr samaccountname mail # Search scope dsquery * "DC=domain,DC=com" -scope subtree -filter "(objectClass=user)"
PIPING TO OTHER COMMANDS#
DSGET (Get Properties)#
dsquery user -name "John*" | dsget user -samid -email -dept dsquery computer -inactive 8 | dsget computer -samid -loc dsquery group -name "IT*" | dsget group -members
DSMOD (Modify)#
dsquery user -disabled | dsmod user -disabled no dsquery user -inactive 26 | dsmod user -disabled yes dsquery computer -stalepwd 90 | dsmod computer -disabled yes
DSRM (Remove)#
dsquery user -disabled | dsrm -noprompt dsquery computer -inactive 52 | dsrm -noprompt
DSMOVE (Move)#
dsquery user -inactive 26 | dsmove -newparent "OU=Disabled,DC=domain,DC=com" dsquery computer -disabled | dsmove -newparent "OU=Disabled,DC=domain,DC=com"
SECURITY ANALYSIS#
# Find privileged accounts dsquery group -samid "Domain Admins" | dsget group -members -expand dsquery group -samid "Enterprise Admins" | dsget group -members -expand dsquery group -samid "Schema Admins" | dsget group -members -expand # Find service accounts dsquery user -name "*svc*" -o samid dsquery user -name "*service*" -o samid # Find admin accounts dsquery user -name "*admin*" -o samid # Inactive accounts (potential compromise indicators) dsquery user -inactive 13 -limit 0 # Accounts with non-expiring passwords dsquery * -filter "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))" -attr samaccountname # Find computers by OS dsquery * -filter "(&(objectClass=computer)(operatingSystem=*Server*))" -attr name operatingSystem
USEFUL EXAMPLES#
# Export all users to file dsquery user -limit 0 -o samid > all_users.txt # Find users in specific OU dsquery user "OU=IT,OU=Users,DC=domain,DC=com" -o samid # Find all domain controllers dsquery server -o rdn # Find disabled users dsquery user -disabled -o samid -limit 0 # Find locked out users dsquery * -filter "(&(objectClass=user)(lockoutTime>=1))" -attr samaccountname # Find users with specific manager dsquery * -filter "(&(objectClass=user)(manager=CN=John Smith,OU=Users,DC=domain,DC=com))" # Find empty groups dsquery * -filter "(&(objectClass=group)(!(member=*)))" -attr name
DSGET COMMANDS#
# Get user details dsget user "CN=John Smith,OU=Users,DC=domain,DC=com" -samid -email -dept -mgr # Get computer details dsget computer "CN=WORKSTATION1,OU=Computers,DC=domain,DC=com" -loc -desc # Get group members dsget group "CN=IT Staff,OU=Groups,DC=domain,DC=com" -members # Get group membership of user dsget user "CN=John Smith,OU=Users,DC=domain,DC=com" -memberof
LDAP FILTER SYNTAX#
= # Equal ~= # Approximate >= # Greater or equal <= # Less or equal =* # Present (has value) ! # NOT & # AND | # OR # Examples (samaccountname=jsmith) (samaccountname=*admin*) (&(objectClass=user)(department=IT)) (|(department=IT)(department=HR)) (&(objectClass=user)(!(disabled=TRUE)))
QUICK REFERENCE#
# Query commands dsquery user # Users dsquery computer # Computers dsquery group # Groups dsquery ou # OUs dsquery server # Domain controllers dsquery * -filter "..." # Custom LDAP # Common options -name "pattern" # Name filter -samid "name" # SAM account name -inactive N # Inactive weeks -disabled # Disabled only -limit 0 # No limit -o samid # Output format # Piping dsquery user | dsget user -samid dsquery user -disabled | dsmod user -disabled no dsquery computer -inactive 52 | dsrm # Custom LDAP dsquery * -filter "(objectClass=user)" -attr samaccountname mail