# Powerview

| **Command**                                                                                 | **Description**                                                               |
| ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| `xfreerdp /v:<target IP address> /u:htb-student /p:<password>`                              | RDP to lab target                                                             |
| `Get-DomainPolicy`                                                                          | View the domain password policy                                               |
| `.\SharpView.exe ConvertTo-SID -Name sally.jones`                                           | Convert a username to a SID                                                   |
| `.\SharpView.exe Convert-ADName -ObjectName S-1-5-21-2974783224-3764228556-2640795941-1724` | Convert a SID to a username                                                   |
| `Get-DomainUser harry.jones \| ConvertFrom-UACValue -showall`                               | List all UAC values                                                           |
| `.\SharpView.exe Get-Domain`                                                                | View information about the current domain                                     |
| `.\SharpView.exe Get-DomainOU`                                                              | List all OUs                                                                  |
| `.\SharpView.exe Get-DomainUser -KerberosPreauthNotRequired`                                | Find ASREPRoastable users                                                     |
| `Get-DomainComputer`                                                                        | Get a listing of domain computers                                             |
| `.\SharpView.exe Get-DomainGPO \| findstr displayname`                                      | List all GPO names                                                            |
| `Get-DomainGPO -ComputerIdentity WS01`                                                      | List GPOs on a specific host                                                  |
| `Test-AdminAccess -ComputerName SQL01`                                                      | Test local admin access on a remote host                                      |
| `.\SharpView.exe Get-NetShare -ComputerName SQL01`                                          | Enumerate open shares on a remote computer                                    |
| `Find-DomainUserLocation`                                                                   | Find machines where domain users are logged in                                |
| `Get-DomainTrust`                                                                           | View a list of domain trusts                                                  |
| `(Get-DomainUser).count`                                                                    | Count all domain users                                                        |
| `.\SharpView.exe Get-DomainUser -Help`                                                      | Get help about a SharpView function                                           |
| `Get-DomainUser -Properties samaccountname,description \| Where {$_.description -ne $null}` | Find non-blank user description fields                                        |
| `.\SharpView.exe Get-DomainUser -SPN`                                                       | Find users with SPNs set                                                      |
| `Find-ForeignGroup`                                                                         | Find foreign domain users                                                     |
| `Get-DomainGroup -Properties Name`                                                          | List domain groups                                                            |
| `.\SharpView.exe Get-DomainGroupMember -Identity 'Help Desk'`                               | Get members of a domain group                                                 |
| `.\SharpView.exe Get-DomainGroup -AdminCount`                                               | List protected groups                                                         |
| `.\SharpView.exe Find-ManagedSecurityGroups`                                                | List managed security groups                                                  |
| `Get-NetLocalGroup -ComputerName WS01`                                                      | Get local groups on a host                                                    |
| `.\SharpView.exe Get-NetLocalGroupMember -ComputerName WS01`                                | Get members of a local group                                                  |
| `.\SharpView.exe Get-DomainComputer -Unconstrained`                                         | Find computers that allow unconstrained delegation                            |
| `Get-DomainComputer -TrustedToAuth`                                                         | Find computers set with constrained delegation                                |
| `Get-DomainObjectAcl -Identity harry.jones`                                                 | Enumerate ACLs on a user                                                      |
| `Find-InterestingDomainAcl`                                                                 | Find objects in the domain with modification rights over non built-in objects |
| `Get-PathAcl "\\SQL01\DB_backups"`                                                          | Find the ACLs set on a directory                                              |
| `gpresult /r /S WS01`                                                                       | Get a report of all GPOs applied to a host                                    |
| `Get-DomainGPO \| Get-ObjectAcl`                                                            | Find GPO permissions                                                          |
| `Get-DomainTrustMapping`                                                                    | Enumerate trusts for our domain/reachable domains                             |
