NetExec SMB RunAsPPL Check

Check if LSA Protection (RunAsPPL) is enabled on remote hosts

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Enumeration / SMB
Platform: linux
Requires: password
Protocols: SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb '<ip>' -u '<user>' -p '<password>' -M runasppl

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc smb '<ip>' -u '<user>' -H '<hash>' -M runasppl

Kerberos Ticket requires Kerberos ticket

nxc smb '<ip>' -u '<user>' --use-kcache -M runasppl

Examples

nxc smb '192.168.1.0/24' -u 'user' -p 'password' -M runasppl

Tags

nxc smb lsa-protection ppl enumeration credential-guard

Enum4linux-ng SMB Enumeration Next generation enum4linux for SMB enumeration
Impacket lookupsid Brute-force the RID space against SAMR / LSARPC to enumerate domain users, groups, and…
Impacket NetView Enumerate logged-on users and sessions on remote hosts
Impacket SAMRDump Dump user accounts and group information via SAMR protocol
Impacket SMBClient Interactive SMB client written in pure Python. Drops you into a shell with shares, ls,…
NetExec enum_ca Module Discover Active Directory Certificate Services CA hosts on the network and grab basic CA…
NetExec MS17-010 Check (EternalBlue) Detect MS17-010 (EternalBlue) vulnerable hosts via the SMBv1 transaction probe. Safe…
NetExec Password Policy Enumerate Domain Password Policy