CEH Enumeration and System Hacking Practice Question
During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?
⚠ Common exam trap
A common mix-up: candidates confuse nbtstat or smbclient as tools for user enumeration because they associate them with Windows networking, but neither can query Active Directory's LDAP directory for user and group objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ldapsearch
ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ldapsearch
Why this is correct
ldapsearch is the correct command-line utility for querying LDAP (Lightweight Directory Access Protocol) directories, which Active Directory heavily utilizes for storing user, group, and computer information. During a penetration test, it allows an attacker to enumerate users, groups, and their attributes by directly querying a domain controller. This tool is indispensable for mapping out an organization's user base and understanding its structure within an Active Directory environment.
- ✗
nbtstat
Why it's wrong here
nbtstat is a command-line tool designed for displaying NetBIOS over TCP/IP protocol statistics, including the local NetBIOS name table and the remote NetBIOS name table cache. While NetBIOS was historically used for name resolution in Windows networks, it does not directly interact with Active Directory's LDAP service to enumerate user objects. Therefore, `nbtstat` is unsuitable for the task of enumerating AD users, as its scope is limited to NetBIOS name services.
- ✗
smbclient
Why it's wrong here
smbclient is a client program that implements the SMB/CIFS protocol, allowing users to access shared resources like files and printers on remote servers, similar to a Windows file explorer. While it can be used to list shared folders or even enumerate some information about a server, it does not provide a mechanism to directly query Active Directory's LDAP database for user accounts. Its primary function is file and print sharing, not directory service enumeration.
- ✗
snmpwalk
Why it's wrong here
snmpwalk is a command-line tool used to query devices that support the Simple Network Management Protocol (SNMP) to retrieve information from their Management Information Bases (MIBs). SNMP is primarily used for network device management, monitoring, and collecting system statistics, such as network interface status or CPU usage. It operates on a completely different protocol and data model than LDAP, making `snmpwalk` ineffective for enumerating Active Directory user accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.