8.2 Windows User & Group Enumeration via SMB & RPC

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

8.2 Windows User & Group Enumeration via SMB & RPC

Key Takeaways Explain This Topic AI

SMB historically operated over NetBIOS over TCP/IP (NBT) using ports 137 (Name Service), 138 (Datagram), and 139 (Session), but modern Windows environments standardise on direct-hosted SMB over TCP port 445.

SMB protocol versions have evolved from vulnerable SMBv1 (susceptible to dialect negotiation flaws and MS17-010 EternalBlue) to SMBv2 and modern SMBv3, which incorporates mandatory AES-CCM/AES-GCM encryption and pre-authentication integrity verification.

An SMB Null Session (unauthenticated connection to the IPC$ share with empty username and password) permits reconnaissance of password policies, shares, and domain SIDs unless hardened via the RestrictAnonymous registry key.

Relative Identifier (RID) cycling systematically interrogates individual sequential SIDs (500 for Administrator, 501 for Guest, 512 for Domain Admins, and 1000+ for custom accounts) via MSRPC to harvest valid usernames even when bulk user listing is administratively restricted.

Last updated: September 2026

8.2 Windows User & Group Enumeration via SMB & RPC

During an internal infrastructure assessment, Server Message Block (SMB) and Microsoft Remote Procedure Call (MSRPC) represent primary attack surfaces for network enumeration. Before attempting credential attacks or vulnerability exploitation, a penetration tester must enumerate domain and local user accounts, group memberships, file shares, and password policies. Understanding the network transport layers, session establishment mechanics, and RPC interface architectures allows practitioners to extract actionable intelligence from misconfigured or legacy Windows systems.

Server Message Block (SMB) & NetBIOS Architecture

Server Message Block is a client-server application-layer protocol used for sharing files, printers, serial ports, and inter-process communication (named pipes) across a local network. +-----------------------------------------------------------------------------+

• | SMB NETWORK TRANSPORT LAYERS |
• +-----------------------------------------------------------------------------+
• | 1. Legacy NetBIOS over TCP/IP (NBT) Transport Architecture: |
• | [UDP 137: NetBIOS Name Service (NBNS) - Name Registration / Resolution] |
• | [UDP 138: NetBIOS Datagram Service - Mailslots / Browser Broadcasts] |
• | [TCP 139: NetBIOS Session Service - SMB Transport over NetBIOS] |
• | |
• | 2. Modern Direct-Hosted SMB Transport Architecture (Windows 2000+): |
• | [TCP 445: Direct-Hosted SMB over TCP/IP (Bypasses NetBIOS Entirely)] |
• +-----------------------------------------------------------------------------+
• 1. NetBIOS over TCP/IP (NBT)

In early Windows networking (Windows NT, Windows for Workgroups), SMB could not operate directly over raw IP sockets; it required the NetBIOS (Network Basic Input/Output System) framing layer defined in RFC 1001 and RFC 1002. NetBIOS over TCP/IP divides network operations into three specific ports:

UDP Port 137 (NetBIOS Name Service / NBNS): Resolves 16-character NetBIOS computer and workgroup names to IP addresses. The 16th byte indicates the service type (e.g., <00> for Workstation Service, <20> for File Server, <1B> for Domain Master Browser).

UDP Port 138 (NetBIOS Datagram Service): Connectionless messaging service used for network browser elections and broadcast announcements.

TCP Port 139 (NetBIOS Session Service): Connection-oriented transport that provides reliable session handling. Legacy SMB frames were encapsulated inside NetBIOS Session Service packets.

2. Direct-Hosted SMB (TCP Port 445)

Introduced with Windows 2000, direct-hosted SMB operates natively over TCP port 445 without the intermediate NetBIOS session layer. Direct-hosted SMB offers significant security and operational benefits:

Eliminates the chatty broadcast traffic inherent to NetBIOS name resolution.

Bypasses NetBIOS limitations on computer name lengths.

Simplifies firewall traversal and network routing.

3. SMB Protocol Dialect Evolution & Security Features

SMB Dialect Introduced In Security & Protocol Features Known Vulnerabilities / Risks

SMBv1 (CIFS) Windows NT 3.1 / 95 Plaintext negotiation, chatty command structure, raw file access Inherently insecure; dialect downgrade attacks; buffer overflows (MS08-067, MS17-010 EternalBlue)

SMBv2.0 / 2.1 Windows Vista / 7 Command pipelining (reduced from 100+ to 19 commands), larger buffers, HMAC-SHA256 signing Dialect downgrade; relayable if signing not required

SMBv3.0 / 3.02 Windows 8 / Server 2012 End-to-end AES-128-CCM encryption, multi-channel support, SMB Direct (RDMA) Relayable if signing disabled and encryption not enforced

SMBv3.1.1 Windows 10 / Server 2016 AES-128-GCM / AES-256-GCM encryption, Pre-Authentication Integrity (SHA-512 hashes) Resilient against man-in-the-middle downgrade attacks

Key Concept: Pre-Authentication Integrity Introduced in SMB 3.1.1, pre-authentication integrity utilizes SHA-512 cryptographic hashing to verify the integrity of early negotiation and session setup messages before authentication occurs. This prevents an inline adversary from executing a man-in-the-middle attack to tamper with the dialect negotiation and force the endpoints to downgrade to an insecure SMB dialect.

SMB Null Sessions ( IPC$ ) & Anonymous Enumeration

What is an SMB Null Session?

An SMB Null Session is an unauthenticated session established to a target Windows system by supplying an empty username ( '' ) and an empty password ( '' ). Null sessions connect specifically to the hidden IPC$ (Inter-Process Communication) share. The IPC$ share does not provide access to the filesystem; rather, it provides a network transport pipeline for named pipes, allowing remote clients to communicate directly with Windows MSRPC services. # Establishing an SMB Null Session using Windows command prompt

net use \\192.168.1.50\IPC$ '' /u:''

• # Establishing a Null Session using Linux smbclient
• smbclient -N -L //192.168.1.50 CLIENT SERVER
• | |
• |--- SMB Negotiate Protocol Request (SMB dialects) ->|
• |<-- SMB Negotiate Protocol Response (Dialect chosen)-|
• | |
• |--- Session Setup Request: User='', Pass='' ------->|
• |<-- Session Setup Response: Success (Guest/Null) ---| (Session Created)
• | |
• |--- Tree Connect Request: Share='\\target\IPC$' --->|
• |<-- Tree Connect Response: Success (Tree ID) -------| (IPC$ Accessible)
• Registry Hardening: RestrictAnonymous

The capability of an anonymous or null session to query directory information is governed by the Windows registry key located at: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous

RestrictAnonymous = 0 (Permissive): Unrestricted anonymous enumeration. Any client connected via a null session can enumerate local/domain user accounts, security groups, and shares. This was the default setting in Windows NT 4.0 and early Windows 2000 installations.

RestrictAnonymous = 1 (Standard Restriction): Restricts the enumeration of SAM accounts and shares. A null session can still bind to the IPC$ share and query general system information, but high-level user and group enumeration via SAMR is blocked.

RestrictAnonymous = 2 (Strict Lockdown): Complete restriction of anonymous access. The target operating system refuses any null session connection to the IPC$ share unless explicitly authorized. This is the default setting on modern Windows Server systems and Domain Controllers.

Information Disclosed via Accessible Null Sessions

When a target host permits null session access, a security analyst can extract critical intelligence:

Domain Password Policy: Minimum password length, password history length, account lockout threshold (failed attempts before lockout), lockout duration, and observation window.

Network Shares: Built-in administrative shares ( ADMIN$ , C$ , IPC$ ) and custom enterprise file shares, including access permissions.

Domain SIDs: The fundamental Security Identifier of the target domain, which is required for RID cycling attacks.

User & Group Inventories: Valid usernames, service accounts, and group memberships.

Microsoft Remote Procedure Call (MSRPC) Architecture

MSRPC is Microsoft's implementation of the Distributed Computing Environment / Remote Procedure Call (DCE/RPC) standard. It allows program subroutines to execute transparently on remote systems across the network. +-----------------------------------------------------------------------------+

• | MSRPC SERVICE DISCOVERY |
• +-----------------------------------------------------------------------------+
• | 1. Client connects to RPC Endpoint Mapper on TCP Port 135 |
• | 2. Client queries for Interface UUID (e.g., SAMR, LSARPC, SRVSVC) |
• | 3. Endpoint Mapper replies with binding: Named Pipe or Dynamic Port |
• | 4. Client communicates directly with the service interface: |
• | |
• | [Over SMB Port 445 via Named Pipe] OR [Over Dynamic TCP Port (49152+)] |
• | \pipe\samr Direct RPC High Port Socket |
• +-----------------------------------------------------------------------------+
• The RPC Endpoint Mapper (TCP Port 135)

The RPC Endpoint Mapper (EPMAP) acts as a directory service for RPC applications on a Windows host. Because many RPC server interfaces bind to dynamic, ephemeral high ports (traditionally TCP 1024-5000, and TCP 49152-65535 in Windows Server 2008 and later), clients cannot know which port is hosting a service in advance.

The client connects to the Endpoint Mapper on TCP port 135 .

The client presents the Universally Unique Identifier (UUID) and version number of the desired interface.

The Endpoint Mapper looks up its internal registry and returns the dynamic TCP port or the SMB named pipe where the interface is currently listening.

Tools such as Impacket's rpcdump.py interrogate port 135 to enumerate all registered RPC endpoints, exposing installed software, hypervisors, management agents, and database listeners.

Core Windows RPC Interfaces

Several critical Windows administrative interfaces are accessed via MSRPC over named pipes across SMB:

SAMR (Security Account Manager Remote):

UUID: 12345778-1234-ABCD-EF00-0123456789AC (Named pipe: \pipe\samr )

Used for managing and querying the local SAM database and Active Directory domain accounts. Facilitates user, group, and alias enumeration.

LSARPC (Local Security Authority RPC):

UUID: 12345778-1234-ABCD-EF00-0123456789AB (Named pipe: \pipe\lsarpc )

Provides access to security policy interrogation, user rights assignments, domain trust queries, and bidirectional name-to-SID translations.

SRVSVC (Server Service):

UUID: 4B324FC8-1670-01D3-1278-5A47BF6EE188 (Named pipe: \pipe\srvsvc )

Manages network file shares and active client sessions ( NetShareEnum , NetSessionEnum ).

Netlogon:

UUID: 12345678-1234-ABCD-EF00-01234567CFFB (Named pipe: \pipe\netlogon )

Maintains the secure channel between Domain Controllers and domain workstations, handling logon requests and password synchronization.

• MSRPC Enumeration Workflows & Tools
• 1. Interactive Enumeration with rpcclient

rpcclient is a command-line tool from the Samba suite that allows security analysts to bind to MSRPC interfaces and execute native administrative queries. # Connect to target via SMB Null Session

rpcclient -U '' -N 192.168.1.50

• # Or connect using valid low-privileged user credentials
• rpcclient -U 'corp.internal\jdoe%Password123' 192.168.1.50

High-Value rpcclient Commands:

getdompwinfo : Interrogates the domain password policy (returns min password length, password history, and password properties).

enumdomusers : Enumerates all domain users and their associated Relative Identifiers (RIDs).

enumdomgroups : Enumerates all domain security groups and their RIDs.

queryuser <RID> : Queries detailed account metadata for a specific user RID (returns bad password count, logon count, account flags, password last set timestamp, home directory, and user comment/description).

querygroup <RID> / querygroupmem <RID> : Inspects security group properties and returns the RIDs of all member accounts.

lookupnames <username> : Resolves an ASCII username to its unique Security Identifier (SID).

• lookupsids <SID> : Resolves a SID to its corresponding domain and account name. rpcclient $> getdompwinfo
• min_password_len: 12
• password_properties: 0x00000001 (DOMAIN_PASSWORD_COMPLEX)

• rpcclient $> queryuser 0x1f4
• User Name : Administrator
• Full Name : Built-in account for administering the computer/domain

Home Drive :

Logon Script:

Profile Path:

• Account Flags: [ACB_NORMAL]
• Logon Hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
• Bad Pwd Count: 0
• Logon Count : 42
• 2. Automated Enumeration Suites

enum4linux / enum4linux-ng : Automates the complete enumeration workflow (null session verification, share listing, password policy dumping, user harvesting via SAMR, and RID cycling).

NetExec ( nxc , formerly CrackMapExec): Rapidly probes SMB endpoints for null session access, user enumeration, and share permissions: # Test for anonymous share and user enumeration

• nxc smb 192.168.1.0/24 -u '' -p '' --shares --users --pass-pol
• Relative Identifier (RID) Cycling Mechanics

When a Windows system is hardened with RestrictAnonymous = 1 , broad listing commands like enumdomusers fail because the operating system denies bulk queries through the SAMR interface. However, security analysts can circumvent this restriction using Relative Identifier (RID) Cycling . +-----------------------------------------------------------------------------+

• | STRUCTURE OF A WINDOWS SID |
• +-----------------------------------------------------------------------------+
• | S - 1 - 5 - 21 - 3623811015 - 3361044348 - 30300820 - 500 |
• | | | | | |---------------------------------| | |
• | | | | | Sub-Authorities | |
• | | | | | (Unique to this Domain) | |
• | | | | +-- Domain Identifier | |
• | | | +------ NT Authority Identifier | |
• | | +---------- Revision Level | |
• | +-------------- SID Prefix +-- RID (500 = Admin)|
• +-----------------------------------------------------------------------------+
• Well-Known Relative Identifiers (RIDs)

Every Windows account, group, and computer object is assigned a Security Identifier (SID). The final numerical segment of the SID is the Relative Identifier (RID) . Microsoft assigns fixed, deterministic RIDs to standard built-in accounts:

• Relative Identifier (RID) Target Account / Group Name Role & Significance
• 500 Administrator Built-in local or domain administrative account (Cannot be locked out)
• 501 Guest Built-in guest account (disabled by default in modern Windows)
• 502 krbtgt Key Distribution Center service account (signs Kerberos TGTs)
• 512 Domain Admins Highly privileged administrative group in Active Directory
• 513 Domain Users Default group containing all standard domain accounts
• 514 Domain Guests Default group for domain guest accounts
• 519 Enterprise Admins Forest-wide administrative authority (Forest Root Domain)
• 1000+ Custom Accounts User accounts and custom security groups created by administrators
• The RID Cycling Methodology

Acquire Base Domain SID: The analyst extracts the domain's base SID (e.g., S-1-5-21-3623811015-3361044348-30300820 ) via a null session, an unauthenticated LSARPC query, or an authenticated lookup of any single known account.

Sequential Probing: Rather than requesting a full user list, the testing tool constructs individual SIDs by appending sequential RID numbers to the base SID ( BaseSID + 500 , BaseSID + 501 , BaseSID + 1000 , BaseSID + 1001 , ...).

MSRPC Query Execution: The tool submits single-SID lookup requests to the LSARPC function LsarLookupSids or SAMR function SamrOpenUser .

Bypass Advantage: Windows access control checks for individual SID-to-name translations are significantly more permissive than bulk listing queries. Even when user lists are blocked, the server responds to each valid query with the corresponding account name.

Renamed Administrator Discovery: Renaming the built-in Administrator account (e.g., to SuperUser or LocalAdmin ) is a common hardening measure. However, renaming an account does not alter its RID . By querying RID 500 , RID cycling immediately discovers the new, renamed administrator account.