Active Directory Enumeration via LDAP

Every domain-joined host can read most of Active Directory with unauthenticated (or null-session) LDAP queries. This chapter covers direct LDAP queries from C — finding domain controllers, enumerating users with adminCount=1, finding Kerberoastable service accounts, pulling DACL ACEs to find GenericAll paths, and querying ACLs on AD objects — without SharpHound, BloodHound, or any third-party binary.

LDAP Primer for AD Querying

Full LDAP User Enumeration Function

#include "windows.h"
#include "winldap.h"
#include "stdio.h"
#pragma comment(lib, "wldap32.lib")

typedef struct {
    const char* dc;       // DC hostname
    const char* baseDN;   // e.g. "DC=corp,DC=local"
    const char* filter;   // LDAP filter string
    char**      attrs;    // requested attributes (NULL-terminated)
} LDAPQueryArgs;

BOOL LdapQuery(LDAPQueryArgs* q,
                void (*callback)(LDAP* ld, LDAPMessage* entry)) {
    LDAP* ld = ldap_init((PSTR)q->dc, LDAP_PORT);
    if (!ld) { printf("[-] ldap_init failed\n"); return FALSE; }

    // Bind using current process security context (Kerberos/NTLM via SSPI)
    ULONG err = ldap_bind_s(ld, NULL, NULL, LDAP_AUTH_NEGOTIATE);
    if (err != LDAP_SUCCESS) {
        printf("[-] ldap_bind_s: %s\n", ldap_err2string(err));
        ldap_unbind(ld);
        return FALSE;
    }
    LDAPMessage* result = NULL;
    err = ldap_search_s(ld, (PSTR)q->baseDN, LDAP_SCOPE_SUBTREE,
                        (PSTR)q->filter, q->attrs, 0, &result);
    if (err != LDAP_SUCCESS) {
        printf("[-] ldap_search_s: %s\n", ldap_err2string(err));
        ldap_unbind(ld);
        return FALSE;
    }
    LDAPMessage* entry = ldap_first_entry(ld, result);
    while (entry) {
        callback(ld, entry);
        entry = ldap_next_entry(ld, entry);
    }
    ldap_msgfree(result);
    ldap_unbind(ld);
    return TRUE;
}

// Helper: print sAMAccountName from an entry
void PrintSamAccountName(LDAP* ld, LDAPMessage* entry) {
    PCHAR* vals = ldap_get_values(ld, entry, "sAMAccountName");
    if (vals && vals[0]) printf("  [*] %s\n", vals[0]);
    ldap_value_free(vals);
}

AdminCount=1 and Domain Admin Hunt

void EnumAdminAccounts(const char* dc, const char* baseDN) {
    printf("[*] Accounts with adminCount=1 (SDProp elevated):\n");
    char* attrs[] = { "sAMAccountName", "userAccountControl", "memberOf", NULL };
    LDAPQueryArgs q = { dc, baseDN,
                        "(&(objectClass=user)(adminCount=1))",
                        attrs };
    LdapQuery(&q, PrintSamAccountName);
}

// More detailed callback: print name + memberOf
void PrintUserWithGroups(LDAP* ld, LDAPMessage* entry) {
    PCHAR* name = ldap_get_values(ld, entry, "sAMAccountName");
    PCHAR* groups = ldap_get_values(ld, entry, "memberOf");
    if (name && name[0]) {
        printf("  [USER] %s\n", name[0]);
        if (groups) {
            for (int i = 0; groups[i]; i++)
                printf("          memberOf: %s\n", groups[i]);
        }
    }
    ldap_value_free(name);
    ldap_value_free(groups);
}

Kerberoastable SPN Discovery

void EnumKerberoastTargets(const char* dc, const char* baseDN) {
    printf("[*] Kerberoastable service accounts (SPN set, user object):\n");
    char* attrs[] = { "sAMAccountName", "servicePrincipalName",
                       "pwdLastSet", "userAccountControl", NULL };
    LDAPQueryArgs q = { dc, baseDN,
        "(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))",
        attrs };
    LdapQuery(&q, PrintSpnEntry);
}

void PrintSpnEntry(LDAP* ld, LDAPMessage* entry) {
    PCHAR* name = ldap_get_values(ld, entry, "sAMAccountName");
    PCHAR* spns = ldap_get_values(ld, entry, "servicePrincipalName");
    PCHAR* uac  = ldap_get_values(ld, entry, "userAccountControl");
    if (name && name[0]) {
        DWORD uacVal = uac && uac[0] ? (DWORD)atol(uac[0]) : 0;
        printf("  [SPN] %-30s UAC=0x%X%s\n",
               name[0], uacVal,
               (uacVal & 0x10000) ? " [DONT_EXPIRE_PASSWD]" : "");
        if (spns) {
            for (int i = 0; spns[i]; i++)
                printf("          SPN: %s\n", spns[i]);
        }
    }
    ldap_value_free(name);
    ldap_value_free(spns);
    ldap_value_free(uac);
}

void EnumAsrepRoastTargets(const char* dc, const char* baseDN) {
    printf("[*] AS-REP roastable (DONT_REQUIRE_PREAUTH set):\n");
    char* attrs[] = { "sAMAccountName", NULL };
    LDAPQueryArgs q = { dc, baseDN,
        "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))",
        attrs };
    LdapQuery(&q, PrintSamAccountName);
}

ACL / DACL Enumeration

// Query nTSecurityDescriptor on a specific AD object to extract ACEs.
// GenericAll or WriteDACL over a privileged group = path to DA.
// Requires LDAP control to include security descriptor in results.

void PrintDaclAces(LDAP* ld, LDAPMessage* entry) {
    // nTSecurityDescriptor is a binary blob — BerVal
    struct berval** bvals = ldap_get_values_len(ld, entry, "nTSecurityDescriptor");
    if (!bvals || !bvals[0]) return;

    PSECURITY_DESCRIPTOR pSD = (PSECURITY_DESCRIPTOR)bvals[0]->bv_val;
    PACL pDacl = NULL; BOOL present, defaulted;
    GetSecurityDescriptorDacl(pSD, &present, &pDacl, &defaulted);
    if (!present || !pDacl) { ldap_value_free_len(bvals); return; }

    ACL_SIZE_INFORMATION aclInfo = {0};
    GetAclInformation(pDacl, &aclInfo, sizeof(aclInfo), AclSizeInformation);

    for (DWORD i = 0; i < aclInfo.AceCount; i++) {
        ACE_HEADER* ace;
        GetAce(pDacl, i, (void**)&ace);
        if (ace->AceType != ACCESS_ALLOWED_ACE_TYPE) continue;

        ACCESS_ALLOWED_ACE* allow = (ACCESS_ALLOWED_ACE*)ace;
        // Check for GenericAll (0x10000000) or WriteDACL (0x00040000)
        if (allow->Mask & (0x10000000 | 0x00040000)) {
            char sidStr[256]; DWORD sz = sizeof(sidStr);
            char domBuf[256]; DWORD dz = sizeof(domBuf);
            SID_NAME_USE use;
            LookupAccountSidA(NULL, &allow->SidStart, sidStr, &sz, domBuf, &dz, &use);
            printf("  [ACE] %s\\%s  MASK=0x%08X%s%s\n",
                   domBuf, sidStr, allow->Mask,
                   (allow->Mask & 0x10000000) ? " [GenericAll]" : "",
                   (allow->Mask & 0x00040000) ? " [WriteDACL]" : "");
        }
    }
    ldap_value_free_len(bvals);
}

Detection Engineering

-- AD LDAP recon is the most common pre-Kerberoast activity.
-- Key detection: volume and specificity of LDAP queries from workstations.

title: LDAP Query for adminCount=1 from Non-Server Host
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType: '%{bf967aba-0de6-11d0-a285-00aa003049e2}'  # user class
    Properties: 'adminCount'
  filter_server:
    SubjectUserName|endswith: '$'   # machine accounts
  condition: selection AND NOT filter_server
level: medium

title: Kerberoastable Account Enumeration (SPN LDAP Query)
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4661    # object access (can be noisy — tune to DC only)
    ObjectName|contains: 'servicePrincipalName'
  condition: selection
level: medium

-- MDE KQL: LDAP queries for high-value filters from workstations
DeviceEvents
| where ActionType == "LdapSearch"
| where AdditionalFields has_any (
    "adminCount", "servicePrincipalName", "DONT_REQUIRE_PREAUTH",
    "TRUSTED_FOR_DELEGATION", "nTSecurityDescriptor")
| where DeviceType == "Workstation"
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessAccountName, AdditionalFields
| order by Timestamp desc

Q&A