Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt

Use this file to discover all available pages before exploring further.

PywerView gets you from zero to enumerating Active Directory objects in under five minutes. All you need is a reachable Domain Controller, a set of valid domain credentials (password or NTLM hash), and Python 3.6 or later on your Linux machine. This guide walks you through installation, verifying the CLI, and running three of the most commonly used enumeration commands — get-netcomputer, get-netuser, and get-netgroupmember — against a real domain.

​
Prerequisites

Before you begin, make sure you have the following:
  • PywerView installed — see Installation if you haven’t done this yet.
  • Domain credentials — a valid username and either a plaintext password or an NTLM hash ([LMHASH:]NTHASH).
  • DC IP or hostname — the IP address or fully qualified hostname of a Domain Controller you can reach on the network.
  • Domain name in UPN format — e.g., contoso.com. Do not use the legacy NetBIOS short name (e.g., CONTOSO); PywerView requires the post-Win2k UPN form.
Always use the UPN domain format (e.g., contoso.com) for the -w flag. Supplying the Windows 2000 NetBIOS name (e.g., CONTOSO) will cause authentication or query failures.

​
Steps

1

Install PywerView

If you haven’t installed PywerView yet, the quickest path is a single pip command. Create a virtual environment first to keep dependencies isolated:
python3 -m venv pywerview-env
source pywerview-env/bin/activate
pip install pywerview
Need Kerberos ccache support? Add the optional extra instead:
pip install pywerview[kerberos]
See the full Installation guide for source builds, system dependencies, and Docker options.
2

Verify the installation

Confirm that the pywerview CLI entry-point is on your PATH and is responsive:
pywerview --help
You should see the main help page listing all available subcommands:
usage: pywerview [-h]
                 {get-adobject,get-objectowner,get-netpki,get-netcerttmpl,
                  get-netgmsa,get-netsmsa,get-objectacl,get-netuser,
                  get-netgroup,get-netcomputer,get-netdomaincontroller,
                  get-netfileserver,get-dfsshare,get-netou,get-netsite,
                  get-netsubnet,get-netdomaintrust,get-netgpo,get-netpso,
                  get-domainpolicy,get-gpttmpl,get-netgpogroup,
                  find-gpocomputeradmin,find-gpolocation,get-netgroupmember,
                  get-netsession,get-localdisks,get-netdomain,get-netshare,
                  get-netloggedon,get-netlocalgroup,
                  invoke-checklocaladminaccess,get-netprocess,get-userevent,
                  invoke-userhunter,invoke-processhunter,invoke-eventhunter}
                 ...

Rewriting of some PowerView's functionalities in Python
If pywerview is not found, ensure your virtual environment is activated (source pywerview-env/bin/activate) and retry.
3

Enumerate domain computers

get-netcomputer queries the DC over LDAP and returns the DNS hostname of every computer object in the domain. By default it prints only the dnshostname attribute — pass --full-data if you want the complete object.
pywerview get-netcomputer -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com
Flag reference:
FlagDescription
-t / --dc-ipIP address or hostname of the Domain Controller
-u / --userUsername to authenticate with
-p / --passwordPassword for the user account
-w / --workgroupDomain name in UPN format (e.g., contoso.com)
Example output:
dnshostname: centos.contoso.com

dnshostname: debian.contoso.com

dnshostname: Windows7.contoso.com

dnshostname: Windows10.contoso.com

dnshostname: SRV-MAIL.contoso.com

dnshostname: SRV-AD.contoso.com
Filter by operating system with -os to quickly find legacy hosts:
pywerview get-netcomputer -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  -os "Windows 7*"
4

Enumerate domain users

get-netuser queries all user accounts in the domain. Without additional filters it returns every user object. You can scope it to a specific account with --username.
pywerview get-netuser -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com
To look up a specific user:
pywerview get-netuser -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  --username bob
To list only users with non-null Service Principal Names (useful for Kerberoasting target identification):
pywerview get-netuser -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  --spn
If you have an NTLM hash instead of a plaintext password, swap -p for --hashes:
pywerview get-netuser -t dc.contoso.com -u alice --hashes aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4 \
  -w contoso.com
5

Find Domain Admins group members

get-netgroupmember resolves the membership of any domain group. Querying Domain Admins is a natural first step to understand the high-privilege attack surface.
pywerview get-netgroupmember -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  --groupname "Domain Admins"
To recursively expand any nested groups within Domain Admins, add -r:
pywerview get-netgroupmember -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  --groupname "Domain Admins" -r
If --groupname is omitted, get-netgroupmember defaults to querying the Domain Admins group automatically.
You can also output results as JSON for downstream processing or piping into jq:
pywerview get-netgroupmember -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  --groupname "Domain Admins" --json

​
Global Flags at a Glance

Every PywerView subcommand that targets a Domain Controller accepts the following global flags:
FlagLong formDescription
-t--dc-ipIP address or hostname of the target Domain Controller
-u--userUsername for authentication
-p--passwordPlaintext password
-w--workgroupDomain name in UPN format (e.g., contoso.com)
--hashesNTLM hashes: [LMHASH:]NTHASH (Pass-the-Hash)
-kUse Kerberos authentication from KRB5CCNAME ccache file
--certPath to a PEM certificate file (SChannel auth)
--keyPath to the private key file (SChannel auth)
--tlsForce TLS / LDAPS connection
-l--logging-levelVerbosity: CRITICAL (default), WARNING, DEBUG, ULTRA
--jsonOutput results as JSON

​
Next Steps

Authentication & Credentials

Learn how to authenticate with Kerberos tickets, NTLM hashes, and certificates.

get-netuser Reference

Explore every flag available for user enumeration, including SPN, delegation, and custom LDAP filters.

Build docs developers (and LLMs) love

Get started for freeTalk to us