Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt

Use this file to discover all available pages before exploring further.

get-netdomaincontroller enumerates every domain controller in a given domain by issuing an LDAP query filtered on the userAccountControl Server Trust Account flag (0x2000). It is implemented as a thin wrapper around get-netcomputer with --full-data enabled, so each result includes the complete computer object rather than just a hostname. This makes it straightforward to identify all DCs at the start of an assessment, verify their names before targeting, or pivot into a trusted child domain to enumerate its controllers from a single entry point.

Global Flags

-t, --dc-ip
string
required
IP address of the Domain Controller to target.
-w, --workgroup
string
required
Name of the domain used for authentication (e.g. contoso.com).
-u, --user
string
Username to authenticate with against the Domain Controller.
-p, --password
string
Password associated with the specified username.
--hashes
string
NTLM hashes for pass-the-hash authentication. Format: [LMHASH:]NTHASH.
-k
boolean
Use Kerberos authentication. Credentials are read from the KRB5CCNAME ccache file; falls back to command-line credentials if no valid ticket is found.
--tls
boolean
Force a TLS-encrypted connection to the Domain Controller.
--cert
string
Path to the certificate file to use for authentication.
--key
string
Path to the private key file associated with the certificate.
--simple-auth
boolean
Force SIMPLE LDAP authentication instead of the default SASL/NTLM binding.
-l, --logging-level
string
Logging verbosity. Choices: CRITICAL (default), WARNING, DEBUG, ULTRA.
--json
boolean
Print results in JSON format instead of the default tabular output.

Command Flags

-d, --domain
string
Domain to enumerate domain controllers for. Defaults to the domain supplied by -w if omitted. Set this to a trusted domain name to enumerate its controllers through the initially targeted DC.

Examples

# List all DCs in the current domain
pywerview get-netdomaincontroller -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com

# List DCs in a trusted child domain
pywerview get-netdomaincontroller -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com -d child.contoso.com

# Authenticate with NTLM hash (pass-the-hash)
pywerview get-netdomaincontroller -t dc.contoso.com -u alice --hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -w contoso.com

# Use Kerberos ticket from ccache
pywerview get-netdomaincontroller -t dc.contoso.com -k -w contoso.com

# JSON output for downstream processing
pywerview get-netdomaincontroller -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com --json

Build docs developers (and LLMs) love