Using “net”
- author:: Nathan Acks
- date:: 2022-08-24
The Windows net
command is an older (but still useful) CLI multitool.
net users
- enumerate all local usersnet user $USER
- retrieve information about the local user$USER
net users /domain
- enumerate domain usersnet user $USER /domain
- retrieve information about the domain user$USER
net localgroup
- enumerate local groupsnet localgroup $GROUP
- show members of local group$GROUP
(try withadministrators
!)net group /domain
- enumerate domain groupsnet group $GROUP /domain
- show members (users only!) of domain group$GROUP
(try withDomain Admins
!)
Note that Windows allows for duplicate domain and local users; this is why users get prefixed by the domain or local machine name. Comparing the output of whoami
and hostname
will reveal if you’re logged in with a local or domain account.
Remember that net group $GROUP /domain
doesn’t show which domain groups are members of $GROUP
, and thus will miss domain admins whose membership is controlled by a nested group. The only way to retrieve a full list of users in a domain group is to use PowerShell.