Computer queries identify hosts, operating systems, server roles, delegation exposure, and machine-account attributes. These results feed SMB, WinRM, MSSQL, RDP, delegation, RBCD, and local-admin follow-up.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Pull every computer with OS, DNS, SPNs, and account flags.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -E pr=1000/noprompt -o ldif-wrap=no -b "$BASE" '(samAccountType=805306369)' sAMAccountName dNSHostName operatingSystem operatingSystemVersion servicePrincipalName userAccountControl lastLogonTimestamp whenCreated
Find Windows Server hosts first.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306369)(operatingSystem=*Server*))' sAMAccountName dNSHostName operatingSystem servicePrincipalName
Find domain controllers through the server trust account flag.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' name dNSHostName operatingSystem userAccountControl
Find computers hosting MSSQL services.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306369)(servicePrincipalName=*MSSQLSvc*))' sAMAccountName dNSHostName servicePrincipalName
Find computers with RBCD already configured.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306369)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))' sAMAccountName dNSHostName msDS-AllowedToActOnBehalfOfOtherIdentity
Find computers trusted for unconstrained delegation.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306369)(userAccountControl:1.2.840.113556.1.4.803:=524288))' sAMAccountName dNSHostName userAccountControl
Fast wrapper enumeration and immediate SMB follow-up with NetExec and windapsearch.
nxc ldap $DC -d OOTW -u $USER -p "$PASS" --computers
nxc smb $DC -d OOTW -u $USER -p "$PASS" --shares
python3 windapsearch.py -d $DOMAIN -u $USER -p "$PASS" --computers
Windows-side equivalent.
Get-ADComputer -LDAPFilter '(samAccountType=805306369)' -Properties dNSHostName,OperatingSystem,ServicePrincipalName,UserAccountControl |
Select-Object Name,dNSHostName,OperatingSystem,ServicePrincipalName