Documentation Index
Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt
Use this file to discover all available pages before exploring further.
get-netpso queries the domain controller via LDAP to enumerate Password Settings Objects (PSOs), which implement Active Directory’s fine-grained password policy feature. Fine-grained policies allow different password requirements — minimum length, complexity, lockout thresholds, and lockout durations — to be applied to specific users or groups rather than the entire domain. From a security perspective, identifying PSOs is valuable because privileged accounts are sometimes placed under more permissive password policies, or because service accounts may have weaker requirements that make them easier to attack. Results include the policy precedence, all password constraints, and the linked user or group principals.
Flags
IP address of the domain controller to target.
Name of the domain to authenticate with (e.g.
contoso.com).Username used to connect to the domain controller.
Password associated with the specified username.
NTLM hashes for pass-the-hash authentication. Format:
[LMHASH:]NTHASH. The LM portion can be omitted or zeroed out.Use Kerberos authentication. Reads credentials from the ccache file pointed to by
KRB5CCNAME. Falls back to the provided username and password if no valid ticket is found.Force a TLS (LDAPS) connection to the domain controller.
Path to a certificate file for certificate-based authentication.
Path to the private key file associated with
--cert.Force SIMPLE LDAP authentication instead of the default SASL/NTLM binding.
Logging verbosity sent to stderr. Choices:
CRITICAL (default), WARNING, DEBUG, ULTRA.Print results as JSON instead of the default human-readable format.
PSO name to query. Wildcards are accepted (e.g.
Admin*). Defaults to *, which returns all PSOs.Display name to filter by. Wildcards are accepted. When specified alongside
--psoname, both filters are applied.Domain to query. Defaults to the domain inferred from the credentials or the target DC.
Additional ADS path to restrict the LDAP search base.