Skip to content

Latest commit

 

History

History
1983 lines (1585 loc) · 66.9 KB

File metadata and controls

1983 lines (1585 loc) · 66.9 KB

Lsa

Commands for interacting with the LSA

Synopsis

Lsa <subcommand>

Subcommands

Command Description
lookupsid Translates one or more SIDs to their account names
lookupname Gets the SID for one or more account names
whoami Gets the name and domain of the connected user
enumaccounts Enumerates accounts
enumprivaccounts Enumerates accounts that have a specific privilege or user right
createaccount Creates an account
getprivs Gets the privileges assigned to an account.
getrights Gets the user rights and privileges granted to an account
getsysaccess Gets the system access rights granted to an account
setsysaccess Sets the system access rights granted to an account
addpriv Adds one or more privileges to an account
rmpriv Removes one or more privileges from an account

For help on a subcommand, use Lsa <subcommand> -h

Lsa addpriv

Adds one or more privileges to an account

Synopsis

Lsa addpriv [options] <ServerName> <Privileges>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with
<Privileges> <String[]> Names or values of the privileges to add
Possible values:
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeMachineAccountPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironment
SeChangeNotifyPrivilege
SeRemoteShutdownPrivilege
SeUndockPrivilege
SeSyncAgentPrivilege
SeEnableDelegationPrivilege
SeManageVolumePrivilege
SeImpersonatePrivilege
SeCreateGlobalPrivilege
SeTrustedCredManAccessPrivilege
SeRelabelPrivilege
SeIncreaseWorkingSetPrivilege
SeTimeZonePrivilege
SeCreateSymbolicLinkPrivilege

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-BySid <SecurityIdentifier> SID of account
-ByName <String> Account name
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Details

Each privilege may be the symbolic name or the value, expressed as a 64-bit integer. If the name is not a predefined privilege, Lsa addpriv resolves the name with the remote LSA.

This command cannot be used to grant a user right.

Note that the LSA tracks accounts separate from the SAM. Even for local accounts, you make need to create the LSA account first.

Examples

Example 1 - Add SeLoadDriverPrivilege and SeTcbPrivilege to Administrators

Lsa addpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators SeLoadDriver SeTcb

Example 2 - Add SeLoadDriverPrivilege and SeTcbPrivilege to S-1-5-32-646

Lsa addpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-646 SeLoadDriver SeTcb

Lsa createaccount

Creates an account

Synopsis

Lsa createaccount [options] <ServerName> <Sid>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with
<Sid> <SecurityIdentifier> SID of account to create

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Examples

Example 1 - Create an account

Lsa createaccount LUMON-FS1 -UserName milchick -Password Br3@kr00m! S-1-5-32-646

Lsa enumaccounts

Enumerates accounts

Synopsis

Lsa enumaccounts [options] <ServerName>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
Sid
AccountName
DomainName
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Details

By default, the output only includes the SIDs of the accounts. Use -OutputFields if you want additional information such as the account or domain name. The additional fields require another RPC call to the server.

Examples

Example 1 - Get account SIDs

Lsa enumaccounts LUMON-FS1 -UserName milchick -Password Br3@kr00m!

Example 2 - Get account SIDs with account name and domain

Lsa enumaccounts LUMON-FS1 -UserName milchick -Password Br3@kr00m! -OutputFields Sid, AccountName, DomainName

Lsa enumprivaccounts

Enumerates accounts that have a specific privilege or user right

Synopsis

Lsa enumprivaccounts [options] -Privilege <String> <ServerName>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with

Options

Name Aliases Value Description
-Privilege <String> Name of privilege or user right to check for
Possible values:
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeMachineAccountPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironment
SeChangeNotifyPrivilege
SeRemoteShutdownPrivilege
SeUndockPrivilege
SeSyncAgentPrivilege
SeEnableDelegationPrivilege
SeManageVolumePrivilege
SeImpersonatePrivilege
SeCreateGlobalPrivilege
SeTrustedCredManAccessPrivilege
SeRelabelPrivilege
SeIncreaseWorkingSetPrivilege
SeTimeZonePrivilege
SeCreateSymbolicLinkPrivilege
None
SeInteractiveLogonRight
SeNetworkLogonRight
SeBatchLogonRight
SeServiceLogonRight
SeDenyInteractiveLogonRight
SeDenyNetworkLogonRight
SeDenyBatchLogonRight
SeDenyServiceLogonRight
SeRemoteInteractiveLogonRight
SeDenyRemoteInteractiveLogonRight
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
Sid
AccountName
DomainName
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Examples

Example 1 - Enumerate accounts with SeInteractiveLogonRight

Lsa enumprivaccounts LUMON-FS1 -UserName milchick -Password Br3@kr00m! -Privilege SeInteractiveLogonRight

Lsa getprivs

Gets the privileges assigned to an account.

Synopsis

Lsa getprivs [options] <ServerName>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
Privilege
Attributes
PrivilegeName
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-BySid <SecurityIdentifier> SID of account
-ByName <String> Account name
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Details

One of -BySid or -ByName is required to specify the account to get the privileges for. The account may be a user or group.

By default, only the names of predefined privileges are resolved. Te get the names of all privileges, use -OutputFields to specify PrivilegeName

Examples

Example 1 - Get privileges for account by SID

Lsa getprivs LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544

Example 2 - Get privileges for account by name

Lsa getprivs LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrator

Example 3 - Get privileges for account by name, look up privilege names

Lsa getprivs LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrator -OutputFields Privilege, PrivilegeName

Lsa getrights

Gets the user rights and privileges granted to an account

Synopsis

Lsa getrights [options] <ServerName>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
Name
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-BySid <SecurityIdentifier> SID of account
-ByName <String> Account name
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Examples

Example 1 - Get privileges and rights by SID

Lsa getrights LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544

Example 2 - Get privileges and rights by name

Lsa getrights LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators

Lsa getsysaccess

Gets the system access rights granted to an account

Synopsis

Lsa getsysaccess [options] <ServerName>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
Value
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-BySid <SecurityIdentifier> SID of account
-ByName <String> Account name
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Examples

Example 1 - Get system access rights by SID

Lsa getsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544

Example 2 - Get system access rights by account name

Lsa getsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators

Lsa lookupname

Gets the SID for one or more account names

Synopsis

Lsa lookupname [options] <ServerName> <AccountNames>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with
<AccountNames> <String[]> Names of accounts to look up

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
AccountName
NameType
DomainName
DomainSid
AccountRid
AccountSid
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Details

The command accepts multiple user names

Examples

Example 1 - Look up multiple names

Lsa lookupname LUMON-FS1 -UserName milchick -Password Br3@kr00m! marks milchick

Lsa lookupsid

Translates one or more SIDs to their account names

Synopsis

Lsa lookupsid [options] <ServerName> <Sids>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with
<Sids> <SecurityIdentifier[]> SIDs to look up

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
AccountName
NameType
DomainName
DomainSid
AccountRid
AccountSid
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Details

The command accepts multiple SIDs

Examples

Example 1 - Look up multiple names

Lsa lookupsid LUMON-FS1 -UserName milchick -Password Br3@kr00m! S-1-5-21-1752138614-393460150-3098146133-1103 S-1-5-21-1752138614-393460150-3098146133-1107

Lsa rmpriv

Removes one or more privileges from an account

Synopsis

Lsa rmpriv [options] <ServerName> <Privileges>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with
<Privileges> <String[]> Names or values of the privileges to add
Possible values:
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeMachineAccountPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironment
SeChangeNotifyPrivilege
SeRemoteShutdownPrivilege
SeUndockPrivilege
SeSyncAgentPrivilege
SeEnableDelegationPrivilege
SeManageVolumePrivilege
SeImpersonatePrivilege
SeCreateGlobalPrivilege
SeTrustedCredManAccessPrivilege
SeRelabelPrivilege
SeIncreaseWorkingSetPrivilege
SeTimeZonePrivilege
SeCreateSymbolicLinkPrivilege

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-BySid <SecurityIdentifier> SID of account
-ByName <String> Account name
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Details

Each privilege may be the symbolic name or the value, expressed as a 64-bit integer. If the name is not a predefined privilege, Lsa rmpriv resolves the name with the remote LSA. For predefined privilege names (those in the help text), you are not required to append Privilege to the name.

To remove all privileges, use *. Note that you may have to escape this depending on which shell you are using.

This command cannot be used to remove a user right.

Note that the LSA tracks accounts separate from the SAM. Even for local accounts, you make need to create the LSA account first.

Examples

Example 1 - Remove SeTcbPrivilege from Administrators

Lsa rmpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators SeTcb

Example 2 - Remove SeTcbPrivilege from S-1-5-32-646

Lsa rmpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-646 SeTcb

Example 3 - Remove all privileges from S-1-5-32-646

Lsa rmpriv LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-646 *

Lsa setsysaccess

Sets the system access rights granted to an account

Synopsis

Lsa setsysaccess [options] <ServerName> <Rights>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with
<Rights> <SystemAccessRights[]> Access rights to grant
Possible values:
None
SeInteractiveLogonRight
SeNetworkLogonRight
SeBatchLogonRight
SeServiceLogonRight
SeDenyInteractiveLogonRight
SeDenyNetworkLogonRight
SeDenyBatchLogonRight
SeDenyServiceLogonRight
SeRemoteInteractiveLogonRight
SeDenyRemoteInteractiveLogonRight

Options

Name Aliases Value Description
-Reset <SwitchParam> Clears any rights already set on the account
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
Value
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-BySid <SecurityIdentifier> SID of account
-ByName <String> Account name
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Details

By default, the specified access rights are added to the rights already granted to the account. Use -Reset to clear existing access rights and only grant the rights specified. To reset all access rights currently granted, use -Reset and specify a single right of 0

Examples

Example 1 - Set system access rights by SID

Lsa setsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -BySid S-1-5-32-544 SeBatchLogonRight

Example 2 - Set system access rights by account name

Lsa setsysaccess LUMON-FS1 -UserName milchick -Password Br3@kr00m! -ByName Administrators SeBatchLogonRight

Lsa whoami

Gets the name and domain of the connected user

Synopsis

Lsa whoami [options] <ServerName>

Parameters

Name Aliases Value Description
<ServerName> <String> RPC server to interact with

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
Possible values:
Freeform
Raw
Table
List
Csv
Tsv
Json
-OutputFields <String[]> Fields to display in output
Possible values:
WireName
UserName
Realm
OriginalText
NameType
NamePartCount
-OutputHeaders <SwitchParam> Print headers for table/list/CSV/TSV styles
Default: True
-Spnego <SwitchParam> Uses SP-NEGO for authentication
-AuthEpm <SwitchParam> Authenticates EP mapper requests
-EncryptEpm <SwitchParam> Encrypts EP mappend requests
-EncryptRpc <SwitchParam> Encrypts RPC messages
-PreferSmb <SwitchParam> If the interface supports named pipes, attempt to connect over the named pipe instead of TCP
-SpnOverride <SpnMapping[]> Specifies an SPN override
-AuthProxy <EndPoint> Endpoint of auth proxy
-Socks5 <host-or-ip:port> End point of SOCKS 5 server to use

Output

Name Aliases Value Description
-LogLevel <LogMessageSeverity> Sets the lowest level of messages to log
Possible values:
Debug
Diagnostic
Verbose
Info
Warning
Error
Critical
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
Default: 0
Possible values:
Text
TextWithTimestamp
Json
-Verbose -V <SwitchParam> Prints verbose messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable <SwitchParam> Formats file sizes as human-readable values

Authentication

Name Aliases Value Description
-Anonymous <SwitchParam> Uses anonymous login
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain
-UserDomain -ud <String> Domain of user to authenticate with
-Password -p <String> Password to authenticate with
-NtlmHash <hexadecimal hash> NTLM hash for NTLM authentication

Authentication (Kerberos)

Name Aliases Value Description
-AesKey <HexString> AES key (128 or 256)
-DesKey <HexString> DES key
-Tgt <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-Tickets <String[]> Name of file containing service tickets (.kirbi or ccache)
-TicketCache <String> Name of ticket cache file
-K, -Kdc <host-or-ip:port> KDC endpoint
-S4UserName <UserPrincipalName> Name of user to impersonate with S4U
-U2UserName <UserPrincipalName> User name to request TGT for U2U
-S4UserCert <String> Name of file containing a certificate of a user to impersonate with S4U
-S4ProxyService <SecurityPrincipalName> Name of service to proxy through
-UserCert <String> Name of file containing user's certificate (for PKINIT)
-UserKey <String> Name of file containing user's key (for PKINIT)
-UserKeyPassword <String> Password to decrypt file containing user's key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-Workstation -w <String> Name of workstation to send with NTLM authentication
-NtlmVersion <Version> NTLM version number (a.b.c.d)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-Dialects <Smb2Dialect[]> List of SMB2 dialects to negotiate
Possible values:
Smb2_0_2
Smb2_1
Smb3_0
Smb3_0_2
Smb3_1_1
-RequireSigning -signreq <SwitchParam> Requires packets to be signed
-RequireSecureNegotiate <SwitchParam> Requires the client to authenticate the negotiation
-EncryptSmb <SwitchParam> Requires an encrypted connection

Client Behavior

Name Aliases Value Description
-F, -FollowDfs <SwitchParam> Checks for and follows DFS referrals (default=true)
-DfsReferralBufferSize <Int32> Specifies the size for the DFS referral buffer (default=4096)

Examples

Example 1 - Get connected user name

Lsa whoami LUMON-FS1 -UserName milchick -Password Br3@kr00m!