Domain Groups Discovery

Adversaries may find domain-level groups and permission settings to identify which groups exist, which users belong to them, and which users have elevated permissions. Enumeration methods include native group commands, directory queries, and platform directory services. The procedures below are independent platform-specific alternatives, not a required sequence. The ldapsearch variant can be used off-network only when an LDAPS endpoint is explicitly exposed and reachable from the Internet and an authorized domain bind is available; Microsoft Entra Domain Services documents this as an opt-in configuration allowing external TCP 636 access.