getadusers.py

Enumerate all Active Directory users and their attributes

$ GetADUsers.py -all -dc-ip [domain_controller_ip] [domain]/[username]:[password]

$ GetADUsers.py -user [user] -dc-ip [domain_controller_ip] [domain]/[username]:[password]

$ GetADUsers.py -all -dc-ip [domain_controller_ip] -hashes [LM_Hash]:[NT_Hash] [domain]/[username]

$ GetADUsers.py -all -dc-ip [domain_controller_ip] [domain]/[username]:[password] > [path/to/output.txt]

GetADUsers.py [domain/username[:password]@dc-ip] [--options]

--all
    Enable all output columns and details.

--attributes ATTRS
    Comma-separated list of LDAP attributes to retrieve (e.g., samAccountName,pwdLastSet).

--dc-ip IP
    Domain Controller IP address.

--dc-host HOST
    Domain Controller hostname.

--hashes LMHASH:NTHASH
    NTLM hash authentication.

--no-pass
    Don't prompt for password (use hash or ticket).

--k
    Use Kerberos authentication.

--aesKey HEXKEY
    AES key for Kerberos.

--debug
    Turn on verbose debugging output.

--filter FILTER
    Custom LDAP search filter (e.g., (userAccountControl:1.2.840.113556.1.4.803:=512)).

-h, --help
    Show help message and exit.

GetADUsers.py is a Python script from the Impacket suite, designed for enumerating user accounts in Microsoft Active Directory environments from Linux or Unix-like systems. It performs LDAP queries against a domain controller to retrieve detailed information about users, such as samAccountName, pwdLastSet, userAccountControl, service principal names, and more. The tool supports authentication via NTLM hashes, passwords, Kerberos tickets, or AES keys, making it versatile for penetration testing, security assessments, and administrative tasks.

By default, it lists basic user attributes but can be customized with filters, specific attributes, and output formats. It's particularly useful for identifying privileged accounts, service accounts, or users matching custom LDAP filters. The script handles multiple credential sets and supports targeting specific domain controllers by IP or hostname. Output is formatted in a tabular view for easy parsing, aiding in reconnaissance phases of security audits.

Impacket's implementation leverages low-level SMB/LDAP libraries, ensuring compatibility with modern Windows domains while avoiding common pitfalls like Kerberos pre-auth restrictions.

Requires Impacket library installed; needs valid credentials and network access to DC. May trigger security alerts in monitored environments. Use ethically for authorized testing only.

pip3 install impacket
Or clone from GitHub: git clone https://github.com/fortra/impacket

GetADUsers.py 'domain/user:pass@10.0.0.1' --all
GetADUsers.py 'domain/user@dc.contoso.com' -hashes :nthash --filter '(servicePrincipalName=*)'

Part of Impacket toolkit, originally developed by Fox-IT (2010s), maintained by SecureAuth Corporation (now Fortra). Evolved with SMB/LDAP protocol support for modern Windows versions.

ldapsearch(1), wbinfo(1), samba(7)