> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/user-enumeration-exploit/user-listing-with-getadusers-and-ldapsearch.md).

# User listing with GetADUsers and ldapsearch

When you get credentials of an account in active directory, the first thing to do is getting the full list of users.

```
GetADUsers.py -all north.newyork.local/claudio.ortiz:babyboy
```

With ldap on north.newyork.local

```
ldapsearch -H ldap://192.168.56.11 -D "claudio.ortiz@north.newyork.local" -w babyboy -b 'DC=north,DC=newyork,DC=local' "(&(objectCategory=person)(objectClass=user))" |grep 'distinguishedName:'
```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FQl58QAM4APJMgYikYX9f%2Fimage.png?alt=media&amp;token=4b273582-ea95-4dc0-b15b-d2474bc1dd9c" alt=""><figcaption></figcaption></figure>

With ldap query we can request users of the others domain because a trust is present.

On maryland.local

```
ldapsearch -H ldap://192.168.56.12 -D "claudio.ortiz@north.newyork.local" -w babyboy -b 'DC=maryland,DC=local' "(&(objectCategory=person)(objectClass=user))"

```

On newyork.local

```
ldapsearch -H ldap://192.168.56.10 -D "claudio.ortiz@north.newyork.local" -w babyboy -b 'DC=newyork,DC=local' "(&(objectCategory=person)(objectClass=user))" |grep 'distinguishedName:'
ldapsearch -H ldap://192.168.56.10 -D "claudio.ortiz@north.newyork.local" -w babyboy -b 'DC=newyork,DC=local' "(&(objectCategory=person)(objectClass=user))"

```