impacket-machine_role
determine a remote Windows host's domain role via Impacket
TLDR
SYNOPSIS
impacket-machine_role [options] [[domain/]username[:password]@]target
DESCRIPTION
impacket-machine_role is the packaged entry point for Impacket's machine_role.py. It talks MS-DSSP (`DsRolerGetPrimaryDomainInformation`) over the `lsarpc` named pipe and prints the host's machine role plus primary domain details.Roles reported are standalone workstation, domain-joined workstation, standalone server, domain-joined server, backup domain controller, or primary domain controller. The same call returns the NetBIOS domain name, DNS domain name, forest name, and domain GUID.Use this during reconnaissance when later steps should skip domain controllers, or when you need to confirm whether a host is domain-joined before targeting it.
PARAMETERS
target
Target in Impacket form: `[[domain/]username[:password]@]targetName or address`.-target-ip IP
IP address of the target. Defaults to the host in target. Useful when the name does not resolve.-dc-ip IP
Domain controller IP used for Kerberos. If omitted, the domain from target is used.-port {139,445}
SMB port (default: `445`).-hashes LMHASH:NTHASH
NTLM hashes instead of a password.-no-pass
Do not prompt for a password (use with -k or -hashes).-k
Kerberos authentication. Credentials are taken from `KRB5CCNAME` when possible.-aesKey HEX
AES-128 or AES-256 key for Kerberos (implies -k).-debug
Enable debug output.-ts
Prefix log lines with a timestamp.
CAVEATS
Needs network access to SMB (usually TCP 445) and a bind to `lsarpc`. Credentials must be accepted by the target. Does not apply to non-Windows hosts or Samba in the same way. Intended for authorized security testing only.
HISTORY
Part of the Impacket suite, originally by SecureAuth and now maintained by Fortra. The script was written by Simon Decosse.
SEE ALSO
machine_role.py(1), impacket-getarch(1), impacket-smbclient(1), impacket-getadusers(1), nmap(1)
