LinuxCommandLibrary
GitHubF-DroidGoogle Play Store

add-computer.py

Add computer accounts to Active Directory domains

TLDR

Add a computer account to Active Directory
$ add-computer.py [domain]/[user]:[password] -computer-name [hostname]
copy
Add with specific attributes
$ add-computer.py [domain]/[user]:[password] -computer-name [hostname] -computer-pass [password]
copy
Use Kerberos authentication
$ add-computer.py -k [domain]/[user] -computer-name [hostname]
copy

SYNOPSIS

add-computer.py [-dc-ip ip] domain/user:password -computer-name name [options]

DESCRIPTION

add-computer.py is an Impacket tool for adding computer accounts to Active Directory domains. It exploits the default AD configuration that allows authenticated users to add up to 10 computer accounts to the domain.This is commonly used in penetration testing for resource-based constrained delegation attacks, as controlling a computer account provides additional attack vectors within an AD environment.

PARAMETERS

-dc-ip ip

Domain controller IP address
-computer-name name
Name for the new computer account
-computer-pass password
Password for the computer account (auto-generated if not specified)
-method method
Method to add computer: SAMR or LDAPS (default SAMR).
-dc-host hostname
Domain controller hostname (FQDN). If omitted, derived from the domain argument.
-baseDN dn
Distinguished name base in LDAP. If omitted, derived from the domain.
-domain-netbios name
Domain NetBIOS name when the forest handles multiple domains.
-no-add
Only change an existing computer account password without adding a new one.
-k
Use Kerberos authentication (requires KRB5CCNAME ccache).
-no-pass
Don't prompt for password (use with -k).
-hashes LMHASH:NTHASH
Use NTLM hash for pass-the-hash authentication.
-aesKey key
AES128 or AES256 hex key for Kerberos pass-the-key authentication.
-debug
Enable verbose debug output.

CAVEATS

This tool is intended for authorized penetration testing only. By default, AD allows users to create up to 10 computer accounts (ms-DS-MachineAccountQuota). This limit may be modified by administrators.

HISTORY

add-computer.py is part of the Impacket library, developed by SecureAuth (formerly Core Security). Impacket has been actively developed since the early 2000s as a collection of Python classes for network protocols.

SEE ALSO

Copied to clipboard
Kai