Impacket GetADUsers

Enumerate all Active Directory user accounts

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: impacket-GetADUsers
Category: Enumeration / LDAP
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-GetADUsers -all -dc-ip '<ip>' '<domain>/<user>:<password>'

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

impacket-GetADUsers -all -dc-ip '<ip>' -hashes ':<hash>' '<domain>/<user>'

Kerberos Ticket requires Kerberos ticket

impacket-GetADUsers -all -dc-ip '<ip>' -k -no-pass '<domain>/<user>'

Examples

impacket-GetADUsers -all -dc-ip '192.168.1.100' 'CORP.LOCAL/user:password'

Tags

impacket ldap users enumeration ad

BloodHound AD Collection Collect Active Directory data for BloodHound analysis
Impacket Kerberoast Extract service account hashes via Kerberoasting
bloodyAD get children List the immediate children of a container or OU. Handy for walking the directory tree…
bloodyAD get dnsDump Dump every AD-integrated DNS record from the domain. Authenticated users can read most…
bloodyAD get membership Recursively resolve every group a principal belongs to, including nested groups. Faster…
bloodyAD Get Object Attributes Read all (or specific) LDAP attributes of an AD object. Useful for confirming…
bloodyAD get search Run an arbitrary LDAP filter against the directory and pull selected attributes. The…
bloodyAD get trusts Enumerate domain and forest trust relationships, including direction, type, and trust…