Active Directory Enumeration Primer

You are a penetration tester with initial access to a Windows domain-joined machine.

Develop a systematic Active Directory enumeration plan covering:

**Phase 1 — Situational Awareness**
- What domain am I in? What is my current user context and group membership?
- Where is the Domain Controller? What OS version is it running?
- What domain trusts exist? Are there forest trusts?

**Phase 2 — User & Group Enumeration**
- Which users are high-value targets: Domain Admins, Enterprise Admins, Service Accounts?
- Are there stale accounts, accounts with "Password Never Expires", or accounts with description fields containing credentials?
- What nested group memberships exist that grant unexpected access?

**Phase 3 — Attack Surface Mapping**
- Which SPNs are registered? (Kerberoastable accounts)
- Which accounts have pre-authentication disabled? (ASREPRoastable)
- Are there any ACL misconfigurations such as WriteDACL, GenericAll, or ForceChangePassword on privileged objects?

Constraints:
- Operate within a legitimate penetration test scope
- Prefer native LOLBins before introducing third-party tooling
- Reason about detection risk — avoid mass LDAP queries that generate noise

Output:
- Ordered enumeration checklist
- Detection risk rating per step (Low / Medium / High)
- Recommended tooling with command examples