LDAP Enumeration

Enumerate Active Directory domain user accounts and selected readable attributes through LDAP. ldapdomaindump can export domain users and related group, computer, policy, and trust reports; ldapsearch and NetExec can issue narrower user queries. Returned data is limited by the bind principal's directory permissions. This account-discovery procedure maps to MITRE ATT&CK T1087.002; it does not establish that an account is privileged or that credentials are valid.