Documentation Index
Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt
Use this file to discover all available pages before exploring further.
get-netcomputer queries Active Directory via LDAP to enumerate computer accounts registered in the domain. By default it returns only the dnsHostName of each computer, keeping output concise; use --full-data or --attributes to retrieve richer object properties. A broad range of filters — operating system, service principal name, unconstrained delegation, LAPS password readability, and raw LDAP expressions — lets you scope results precisely, making this command the primary starting point for computer-centric AD reconnaissance from Linux.
Global Flags
IP address of the Domain Controller to target.
Name of the domain used for authentication (e.g.
contoso.com).Username to authenticate with against the Domain Controller.
Password associated with the specified username.
NTLM hashes for pass-the-hash authentication. Format:
[LMHASH:]NTHASH.Use Kerberos authentication. Credentials are read from the
KRB5CCNAME ccache file; falls back to command-line credentials if no valid ticket is found.Force a TLS-encrypted connection to the Domain Controller.
Path to the certificate file to use for authentication.
Path to the private key file associated with the certificate.
Force SIMPLE LDAP authentication instead of the default SASL/NTLM binding.
Logging verbosity. Choices:
CRITICAL (default), WARNING, DEBUG, ULTRA.Print results in JSON format instead of the default tabular output.
Command Flags
Filter results to a specific computer name (matches against
dnsHostName).Return only computers matching this operating system string. Wildcards are accepted (e.g.
Windows Server*).Return only computers matching this service pack string. Wildcards are accepted.
Return only computers that have a matching service principal name registered. Wildcards are accepted.
Domain to query. Defaults to the domain supplied by
-w if omitted.Additional ADS (Active Directory Service) path to narrow the LDAP search base.
Query only printer objects (
objectCategory=printQueue) rather than regular computer accounts.Return only computers configured with unconstrained Kerberos delegation (
userAccountControl flag 524288). Useful for identifying high-value lateral movement targets.Return only computers where the authenticated user can read the LAPS managed local administrator password (
ms-mcs-AdmPwd attribute is visible). The LAPS password itself is included in the output.Return computers potentially vulnerable to the pre-created computer account attack by filtering on the relevant
userAccountControl bitmask (4128).Ping each discovered computer and omit hosts that do not respond. Only live hosts are returned.
Return all available LDAP attributes for each computer object instead of just
dnsHostName and samaccountname.Append a raw LDAP filter expression to the search query, enabling arbitrary attribute-level filtering beyond the built-in options.
Explicit list of LDAP attributes to include in the output. Overrides the default attribute set (unless
--full-data is also set).