> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/reconnaissance/enumerate-users-anonymously-rpc.md).

# Enumerate Users Anonymously - RPC

### rpcclient

RPC stands for Remote Procedure Call. This is a type of protocol that enables one computer or program to remotely communicate with another computer or program. **In the simplest terms, RPCs enable you to connect to a network.**

An RPC must be initiated by the client (or *requester*), which sends a message (or a *request*) to a remote server (or *receiver*). Once the server receives the request, it sends a response to the client, and the client continues with the process it was originally running.

```
rpcclient -U "north.newyork.local\\" 192.168.56.11 -N
enumdomusers
enumdomgroups
```

<figure><img src="/files/UhgLB9UJOVamNkIEl14j" alt=""><figcaption></figcaption></figure>

### Get all domain users:

```
net rpc group members 'Domain Users' -W 'NORTH' -I '192.168.56.11' -U '%'

```

<figure><img src="/files/SpigoPJi3bdMrefxhlPe" alt=""><figcaption></figcaption></figure>

### Save users to users.txt so we can use it later :)