Manual Enumeration

Get Domains

$searcher = New-Object System.DirectoryServices.DirectorySearcher
$searcher.SearchRoot = [ADSI]"LDAP://DC=example,DC=com"
$searcher.Filter = "(objectClass=domain)"
$searcher.FindAll() | ForEach-Object {
    if ($_.Properties["name"] -ne $null) {
        $_.Properties["name"][0]
    }
}

Get Computers

$searcher = [adsisearcher]"(objectClass=computer)"; $searcher.PageSize = 100000; $searcher.FindAll() | ForEach-Object { $_.Properties.name } | tee-object -append computers.txt
get-content .\computers.txt | foreach-object {if (test-connection -computername $_ -count 1 -quiet) {$_}} | tee-object -append livehosts.txt

Get Computers different domain

$searcher = [adsisearcher]"(&(objectClass=computer)(objectCategory=computer)(dNSHostName=*example.com))"
$searcher.PageSize = 100000
$searcher.FindAll() | ForEach-Object { $_.Properties.name } | tee-object -append computers.txt

Get Users

$searcher = [adsisearcher]"(objectClass=user)"; $searcher.PageSize = 10000; $searcher.FindAll() | out-file users.txt

Get Sessions

$searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(logonCount>=1))"; $searcher.PageSize = 100000; $searcher.FindAll() | out-file sessions.txt

Get sessions and computers

$searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(logonCount>=1))"
$searcher.PageSize = 100000
$results = $searcher.FindAll()
$results | foreach { $session = $_; ([adsisearcher]"(&(objectCategory=computer)(objectClass=computer)(dnshostname=$($session.Properties.logonserver)[0]))").FindOne().Properties.name + ": " + $_.Properties.samaccountname } | out-file sessions-hosts.txt

Get Groups

$searcher = [adsisearcher]"(objectClass=group)"; $searcher.PageSize = 100000; $searcher.FindAll() | out-file groups.txt

Check shares:

get-content .\livehosts.txt | foreach-object {net view \\$_; sleep 15}