ad-enumeration

Enumerate Active Directory domain topology and delegation risks with read-only queries.

Updated Jul 30, 2026

Search Tags:#reconnaissance #pentesting #enumeration #security assessment #ldap #active directory

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill ad-enumeration

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ad-enumeration
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/ad-enumeration
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill ad-enumeration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the risk of uncoordinated or overly intrusive Active Directory reconnaissance by providing a structured, read-only, and policy-gated framework for security assessments.

Core Features & Use Cases

Policy-Gated Recon: Ensures all AD queries are authorized, scope-bound, and follow strict read-only protocols to prevent accidental credential capture or service disruption.
Security Posture Analysis: Automates the identification of common misconfigurations such as unconstrained delegation, risky ACLs, and weak GPO settings.
Use Case: During a red-team engagement, use this skill to safely map domain trusts and identify privileged group hygiene issues without triggering alerts or violating engagement rules.

Quick Start

Use the ad-enumeration skill to perform a baseline domain topology review on the target domain controller after loading the approved scope configuration.

Frequently Asked Questions about ad-enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform read-only Active Directory enumeration safely?▼

Read-only Active Directory enumeration is performed through authorized, policy-gated queries to identify domain topology and configuration weaknesses without triggering alerts or capturing credentials. It enforces strict scope boundaries and rate limits during security assessments.

What is policy-gated reconnaissance in Active Directory security assessments?▼

Policy-gated reconnaissance ensures all Active Directory queries are authorized, scope-bound, and follow strict read-only protocols. This framework prevents accidental credential capture and service disruption while mapping domain trusts and identifying privileged group hygiene issues.

Can I identify unconstrained delegation risks during an AD security assessment?▼

Yes, you can identify unconstrained delegation risks during an AD security assessment. The process automates the identification of common misconfigurations, including risky ACLs and weak GPO settings, to provide evidence-based reporting on domain security posture.

Does Active Directory enumeration require an approved scope configuration?▼

Yes, Active Directory enumeration requires an approved scope configuration. Mandatory authorization gates ensure all LDAP queries adhere to strict read-only protocols, preventing intrusive data collection and maintaining compliance with engagement rules.

What are the limitations of non-intrusive Active Directory reconnaissance?▼

Non-intrusive Active Directory reconnaissance is limited to read-only data collection and strictly prohibits credential material exposure. It prevents service disruption but relies entirely on authorized, scope-bound queries to map domain topology without active exploitation.