rpcclient enumeration

Overview of Relative Identifiers (RID) and Security Identifiers (SID)

Windows uses security identifiers (SIDs) to identify security principals. For domain accounts, the final subauthority is the relative identifier (RID) allocated within that domain.^[1]

A domain has a domain SID.
Appending an account’s RID to that domain SID forms the account SID.

For instance, a user named pepe might have a unique identifier combining the domain’s SID with his specific RID, represented in both hexadecimal (0x457) and decimal (1111) formats. This results in a complete and unique identifier for pepe within the domain like: S-1-5-21-1074507654-1937615267-42093643874-1111.

Enumeration with rpcclient

Samba’s rpcclient interacts with RPC interfaces over SMB named pipes. The commands below target SAMR, LSARPC, and related interfaces after an SMB session is established; anonymous availability depends on server policy.^[2]

Authentication, transport and command batching

Use -c with semicolon-separated commands to reuse one authenticated session. Current Samba clients can use a password, an NT hash, or a Kerberos credential cache; Kerberos requires the service hostname rather than only an IP. -I is useful when DNS must be retained for the SPN but the address must be pinned. --client-protection=sign|encrypt can explicitly request SMB signing or encryption.^[2]

# Null session
rpcclient -N -U '' <target> -c 'srvinfo;enumdomains;lsaquery'

# NTLM (omit %password to be prompted) or pass-the-hash
rpcclient -U 'DOMAIN/user' <target>
rpcclient --pw-nt-hash -U 'DOMAIN/user%<NT_HASH>' <target>

# Kerberos ccache; keep the FQDN for the SPN and optionally pin its IP
rpcclient --use-krb5-ccache="$KRB5CCNAME" -I <target_ip> dc.example.com -c 'enumdomusers;enumdomgroups'

Avoid placing cleartext passwords directly in the command line. Prompt for them or use -A <auth-file> with restrictive permissions; the authentication-file format accepts username, password, and domain entries.^[2]

Server Information

To obtain Server Information: srvinfo command is used.
To confirm the identity associated with the session: getusername.^[2]
To query the server’s time: netremotetod.^[2]

Enumeration of Users

Users can be listed using: querydispinfo and enumdomusers.
Details of a user by: queryuser <0xrid>.
Groups of a user with: queryusergroups <0xrid>.
A user’s SID is retrieved through: lookupnames <username>.
Aliases of users by: queryuseraliases builtin|domain <sid1> [sid2 ...].

querydispinfo is especially useful because its output can include the account name, full name and description, while queryuser exposes timestamps and account-control information for a specific RID. Review descriptions for operational notes or accidentally stored secrets.^[2]

# Users' RIDs-forced (one SAMR query per RID)
for i in $(seq 500 1100); do
    rpcclient -N -U "" [IP_ADDRESS] -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";
done

# samrdump.py can also serve this purpose

Password policy and per-account password data

getdompwinfo <DOMAIN> returns the minimum password length and password-property flags exposed by SAMR. getusrdompwinfo <0xRID> queries password information associated with one user handle. These calls do not necessarily expose the complete effective domain policy, and access can differ between Windows and Samba targets.^[2]

rpcclient -U 'DOMAIN/user' <target> -c 'getdompwinfo DOMAIN;getusrdompwinfo 0x1f4'

Before password guessing, obtain the effective lockout policy through the broader SMB/LDAP enumeration workflow; SAMR guessing can still lock accounts. See Password Spraying.

Enumeration of Groups

Groups by: enumdomgroups.
Details of a group with: querygroup <0xrid>.
Members of a group through: querygroupmem <0xrid>.
Resolve several returned member RIDs in one request with: samlookuprids domain <rid1> <rid2> ....^[2]

rpcclient -U 'DOMAIN/user' <target> -c 'querygroupmem 0x200;samlookuprids domain 0x1f4 0x44f'

Enumeration of Alias Groups

Alias groups by: enumalsgroups <builtin|domain>.
Members of an alias group with: queryaliasmem builtin|domain <0xrid>.
Alias details with: queryaliasinfo builtin|domain <0xrid>.^[2]

Enumeration of Domains and Trusts

Domains using: enumdomains.
A domain’s SID is retrieved through: lsaquery.
Domain information is obtained by: querydominfo.
Trust relationships can be queried with enumtrust and, on AD targets, dsenumdomtrusts.^[2]

Enumeration of Shares and Active Use

All available shares by: netshareenumall.
Information about a specific share is fetched with: netsharegetinfo <share>.
Sessions, open files and connections can be requested with netsessenum, netfileenum, and netconnenum; these commonly require more privilege than share listing.^[2]

Additional Operations with SIDs

SIDs by name using: lookupnames <name1> <name2> ....
More SIDs through: lsaenumsid.
RID cycling to check more SIDs is performed by: lookupsids <sid1> <sid2> ....

SAMR enumeration and LSARPC SID translation have separate access checks. Therefore, if enumdomusers is denied, test whether a known principal can still reveal a base SID with lookupnames, then submit multiple candidate SIDs to lookupsids. Batching avoids reconnecting for every RID and is substantially faster than the queryuser loop above. enum4linux-ng implements this approach; RID cycling is opt-in with -R, accepts a batch size, and allows explicit ranges with -r.^[2][4]

# Direct LSARPC batch after obtaining the account-domain SID
rpcclient -N -U '' <target> -c 'lookupsids S-1-5-21-...-500 S-1-5-21-...-501 S-1-5-21-...-1000'

# Automated batched RID cycling (null credentials by default)
enum4linux-ng -R 100 -r 500-550,1000-2000 <target>

On a domain member, distinguish the machine/account-domain SID from the AD domain SID. Validate the prefix by resolving a known local account and a known domain account before cycling it.^[2][4]

Privileges and account rights

With sufficient policy access, enumprivs lists known privileges, while lsaenumacctrights <SID> and lsaenumprivsaccount <SID> reveal rights assigned to a principal. This can identify service-logon assignments and other interesting local-policy grants without changing them.^[2]

Extra commands

The following command/interface mapping follows the current rpcclient command inventory.^[2]

Command	Interface	Description
`queryuser`	SAMR	Retrieve user information
`querygroup`	SAMR	Retrieve group information
`querydominfo`	SAMR	Retrieve domain information
`enumdomusers`	SAMR	Enumerate domain users
`enumdomgroups`	SAMR	Enumerate domain groups
`samlookuprids domain <rids...>`	SAMR	Resolve several domain RIDs in one request
`getdompwinfo <domain>`	SAMR	Retrieve exposed domain password information
`getusrdompwinfo <rid>`	SAMR	Retrieve password information for a user handle
`createdomuser`	SAMR	Create a domain user (requires permission)
`deletedomuser`	SAMR	Delete a domain user (requires permission)
`lookupnames`	LSARPC	Resolve names to SID values
`lookupsids`	LSARPC	Resolve SIDs to names; useful for batched RID cycling
`lsaenumacctrights`	LSARPC	Enumerate rights assigned to an SID
`lsaaddacctrights`	LSARPC	Add account rights (requires permission)
`lsaremoveacctrights`	LSARPC	Remove rights from an account (requires permission)
`netsessenum`	SRVSVC	Enumerate SMB sessions (often privileged)
`netfileenum`	SRVSVC	Enumerate remotely open files (often privileged)
`dsroledominfo`	LSARPC-DS	Get primary-domain information
`dsenumdomtrusts`	LSARPC-DS	Enumerate trusted domains in an AD forest

Commands such as createdomuser, deletedomuser, lsaaddacctrights, and lsaremoveacctrights mutate the target and are not enumeration primitives; use them only when explicitly authorized.^[2]

For related samrdump and rpcdump workflows, see Pentesting MSRPC; the broader assessment reference also contextualizes RID cycling and null-session enumeration.^[3]

Detection note

Modern Defender for Identity/Defender XDR exposes an Anomalous SAMR activity detection mapped to account and permission-group discovery (MITRE ATT&CK T1087 and T1069). Operationally, large RID ranges and repeated SAMR/LSARPC queries should be treated as detectable reconnaissance, even when the server permits them.^[5]