Active Directory (AD) is the backbone of identity and access in most corporate networks, which makes it one of the most valuable targets in any security assessment. This article explains what AD enumeration is, why it matters, and how the tool BloodHound helps you map an environment. It is written for learners practicing in authorized labs and for defenders who want to understand how attackers think.
By the end you will understand the core objects in a domain, what BloodHound actually does, and how to run a safe, legal enumeration exercise.
What Is Active Directory Enumeration?
Enumeration is the process of gathering detailed information about a domain: its users, groups, computers, permissions, and the trust relationships between them. The aim is not to break something, it is to build an accurate map of who can do what. Real intrusions rarely rely on a dramatic exploit; far more often, an attacker logs in with valid credentials and then abuses misconfigurations to move sideways and upward.
Why AD Enumeration Matters
Understanding enumeration matters for both sides of security. For authorized penetration testers, it reveals the realistic paths an attacker could take. For defenders, the same information exposes the misconfigurations to fix before someone malicious finds them. Because AD environments grow organically over years, they accumulate excessive permissions and forgotten accounts, exactly the gaps enumeration surfaces.
Core Concepts
Users, Groups, and Sessions
A domain contains user accounts, groups that bundle permissions, and computer accounts. Equally important are sessions, where privileged users are currently logged in. If an admin has an active session on a machine you can control, that is often the start of an attack path.
ACLs and Dangerous Rights
Access Control Lists (ACLs) define who can act on an object. Certain rights are especially powerful and frequently misconfigured, including GenericAll (full control over an object), WriteDACL (the ability to rewrite an object’s permissions), and ForceChangePassword (the ability to reset another account’s password).
Attack Paths
An attack path is a chain of these relationships that leads from a low-privilege foothold to a high-value target like Domain Admin. BloodHound’s core strength is finding these chains automatically.
How BloodHound Works
BloodHound turns raw AD data into a visual graph so you can see relationships instead of reading endless lists.
The SharpHound Collector
SharpHound is the data collector. Run from an authorized, domain-joined context, it gathers group memberships, sessions, and ACLs, then outputs files you import into BloodHound.
The BloodHound Graph
Once data is imported, BloodHound stores it in a graph database and lets you run queries such as Find Shortest Paths to Domain Admins. The result is a diagram of exactly how privilege flows through the environment.
A Safe Lab Walkthrough
Practice only in environments you own or are explicitly authorized to test, such as a home lab or platforms like Hack The Box and TryHackMe. In such a lab, the workflow is: deploy a small AD environment, run the collector to gather data, import it into BloodHound, then explore the pre-built queries to see which accounts can reach Domain Admin and why.
Common Beginner Mistakes
Beginners often run enumeration tools against systems they have no permission to test, which is illegal and the fastest way to end a security career before it starts. Others collect data but never analyze the why behind a path, missing the actual lesson. And many ignore how noisy collectors can be, which matters when you are learning detection as well.
Defensive Best Practices
Defenders should tier administrative accounts so high-privilege credentials never touch low-trust machines, remove unnecessary ACL rights, monitor for unusual LDAP query patterns that resemble mass collection, and limit where privileged accounts can log in. The same map attackers use is a gift to blue teams for closing gaps.
Frequently Asked Questions
Is BloodHound legal to use?
Yes, in environments you own or are authorized to assess. Using it against systems without permission is illegal.
Do I need to be a Domain Admin to run enumeration?
No. The entire point is that a low-privilege account can often map paths to higher privilege. That is what makes it powerful for both attackers and defenders.
Is enumeration the same as exploitation?
No. Enumeration is information gathering; exploitation is acting on what you find. Enumeration comes first.
Conclusion
Active Directory enumeration is the foundation of both AD attacks and AD defense. BloodHound makes the invisible web of permissions visible, turning a confusing environment into a clear map of risk. The logical next step is to go deeper on BloodHound itself and then study how discovered paths translate into privilege escalation, always in authorized, educational settings.
Continue learning: Active Directory security
This guide is part of our Active Directory Security series. Related guides: