> For the complete documentation index, see [llms.txt](https://www.jdksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.jdksec.com/methodologies/manual-enumeration.md).

# Manual Enumeration

Get Domains

```
$searcher = New-Object System.DirectoryServices.DirectorySearcher
$searcher.SearchRoot = [ADSI]"LDAP://DC=example,DC=com"
$searcher.Filter = "(objectClass=domain)"
$searcher.FindAll() | ForEach-Object {
    if ($_.Properties["name"] -ne $null) {
        $_.Properties["name"][0]
    }
}
```

Get Computers

```
$searcher = [adsisearcher]"(objectClass=computer)"; $searcher.PageSize = 100000; $searcher.FindAll() | ForEach-Object { $_.Properties.name } | tee-object -append computers.txt
get-content .\computers.txt | foreach-object {if (test-connection -computername $_ -count 1 -quiet) {$_}} | tee-object -append livehosts.txt
```

Get Computers different domain

```
$searcher = [adsisearcher]"(&(objectClass=computer)(objectCategory=computer)(dNSHostName=*example.com))"
$searcher.PageSize = 100000
$searcher.FindAll() | ForEach-Object { $_.Properties.name } | tee-object -append computers.txt
```

Get Users

```
$searcher = [adsisearcher]"(objectClass=user)"; $searcher.PageSize = 10000; $searcher.FindAll() | out-file users.txt
```

Get Sessions

```
$searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(logonCount>=1))"; $searcher.PageSize = 100000; $searcher.FindAll() | out-file sessions.txt
```

Get sessions and computers

```
$searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(logonCount>=1))"
$searcher.PageSize = 100000
$results = $searcher.FindAll()
$results | foreach { $session = $_; ([adsisearcher]"(&(objectCategory=computer)(objectClass=computer)(dnshostname=$($session.Properties.logonserver)[0]))").FindOne().Properties.name + ": " + $_.Properties.samaccountname } | out-file sessions-hosts.txt

```

Get Groups

```
$searcher = [adsisearcher]"(objectClass=group)"; $searcher.PageSize = 100000; $searcher.FindAll() | out-file groups.txt
```

Check shares:

```
get-content .\livehosts.txt | foreach-object {net view \\$_; sleep 15}
```