Documentation Index
Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt
Use this file to discover all available pages before exploring further.
get-netgroupmember retrieves the members of a specified domain group and is an essential tool for mapping privilege chains in Active Directory. When no group name is provided, the command falls back to the Domain Admins group by automatically resolving the domain SID. For environments with deeply nested groups, the -r/--recurse flag causes any member that is itself a group to be expanded, ensuring every transitive human or computer account is surfaced. For even faster enumeration of nested membership, --use-matching-rule offloads the recursion entirely to the LDAP server using the LDAP_MATCHING_RULE_IN_CHAIN OID (1.2.840.113556.1.4.1941), which avoids multiple round-trip queries at the cost of cross-domain visibility.
Global Flags
These flags are shared across all PywerView commands that communicate with a Domain Controller.IP address of the Domain Controller to target.
Name of the domain to authenticate with (e.g.
contoso.com).Username used to authenticate to the Domain Controller.
Password associated with the authenticating user.
NTLM hashes for pass-the-hash authentication. Format:
[LMHASH:]NTHASH.Use Kerberos authentication. Reads credentials from the
KRB5CCNAME ccache file; falls back to command-line credentials if none are found.Force a TLS (LDAPS) connection to the Domain Controller.
Path to a certificate file for certificate-based authentication.
Path to the private key associated with the certificate.
Force SIMPLE LDAP authentication instead of the default NTLM/Kerberos binding.
Stderr logging verbosity. Choices:
CRITICAL (default), WARNING, DEBUG, ULTRA.Print results in JSON format instead of the default human-readable output.
Command Flags
Name of the group whose members to retrieve. Wildcards are accepted. When omitted, the command automatically targets the Domain Admins group by resolving the domain’s SID.
SID of the group to query. Used as an alternative to
--groupname when the group name is unknown or ambiguous.The domain to query. Defaults to the domain of the authenticating user.
Additional LDAP ADS path to constrain the search (e.g.
OU=Groups,DC=contoso,DC=com).If a group member is itself a group, recursively resolve its members as well. This ensures all transitive members — human accounts or computer accounts — are included in the output.
Use the
LDAP_MATCHING_RULE_IN_CHAIN OID in the LDAP search query when --recurse is specified. This pushes the recursive resolution to the server side, making it substantially faster than client-side recursion. Has no effect unless --recurse is also set.Return the full LDAP attribute set for each member object. Without this flag, only a minimal summary (group name, member name, domain, and whether the member is a group) is returned.
Append a raw LDAP filter string to the member query. Combined with the existing filters using a logical AND.
Examples
--use-matching-rule uses the LDAP_MATCHING_RULE_IN_CHAIN OID for server-side recursion, which is much faster than the default client-side approach. However, it will not reveal cross-domain group memberships — members whose accounts live in a different trusted domain will be silently omitted from the results. Use client-side recursion (--recurse without --use-matching-rule) when cross-domain completeness matters.