> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/active-directory/post-compromise-enumeration.md).

# Post-Compromise Enumeration

## Checklist

```
net user /domain
```

```
net group /domain
```

```
Get-ADDomain
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
```

<pre><code><strong>Import .\PowerView.ps1
</strong><strong>Get-NetComputer | select operatingsystem,dnshostname
</strong>Find-LocalAdminAccess
</code></pre>

* Dump domain information using [ldapdomaindump](/active-directory/post-compromise-enumeration/ldapdomaindump.md)
* For a better view use[ Bloodhound](/active-directory/post-compromise-enumeration/bloodhound.md) and or[ Plumbhound](/active-directory/post-compromise-enumeration/plumhound.md)
* Identify high value targets
  * Domain Administrators
  * Enterprise Administrators
  * Administrators
  * Service Accounts
* **ENUMERATE**