But for efficiency, we can also use ldapsearch :
Use PowerView (upload via WinRM) or net commands:
Standard Active Directory domain controller ports. Domain name likely htb.local .
diskshadow /s diskshadow.txt
10.10.10.161 OS: Windows Server 2016 (Domain Controller) Domain: htb.local Difficulty: Medium
Result: You see Windows 10 Pro 14393 (build 1607 - old) and SMBv1 enabled. But no anonymous shares? That's fine. We move on.
