Documentation Index
Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt
Use this file to discover all available pages before exploring further.
get-netlocalgroup queries a target Windows host to enumerate the members of a specific local group, defaulting to the built-in Administrators group. It can also list all local groups present on the machine. Members may be local accounts, domain accounts, or domain groups. When domain SID resolution is needed — for example, to translate a domain group SID into a readable name — you can supply a domain controller IP via -t. The --recurse flag will further expand any domain groups found in the local group to enumerate their full membership. Local credentials are accepted and sufficient for basic enumeration, but domain credentials are required for SID resolution.
Domain SID resolution requires supplying a domain controller IP address via
-t/--dc-ip. Without this, domain SIDs in the local group membership will appear as raw SID strings.Flags
IP address or hostname of the target Windows host to enumerate local groups on.
Name of the domain to authenticate with. Can be omitted when using local credentials.
Username for authentication. Accepts both domain and local accounts.
Password associated with the specified username.
NTLM hashes for pass-the-hash authentication. Format:
[LMHASH:]NTHASH. The LM portion can be omitted or replaced with the empty LM hash.Use Kerberos authentication. Reads credentials from the ccache file pointed to by
KRB5CCNAME. Falls back to the provided username and password if no valid ticket is found.Name of the local group to list members of. Defaults to the local
Administrators group when not specified.If set, returns a list of all local groups on the target instead of enumerating members of a specific group.
IP address of a domain controller, used to resolve domain SIDs found in local group membership to human-readable names.
Force a TLS connection to the domain controller when resolving SIDs.
If a member of the local group is itself a domain group, recursively resolve its members as well.
Logging verbosity sent to stderr. Choices:
CRITICAL (default), WARNING, DEBUG, ULTRA.Print results as JSON instead of the default human-readable format.