PowerShell and Active Directory

PowerShell is an automated framework that provides system administrators with many capabilities to perform tasks. It supports the scripting language. Every command in the script is called a cmdlet. You can build your own cmdlets using the .NET programming language. An explanation is given here:

To check out a forest, you can use the get-adforest cmdlet, as shown:

To check all the commands type: Get-Command, as shown:

To check the domains, you can use Get-ADDomain, as shown:

To check the trust of the forest, you need to use get-adtrust, as shown:

get-aduser is used to get a specified user, as shown:

PowerShell is used as an attack platform in many cases for the following reasons:

• It runs code in memory without touching disk
• It downloads and executes code from another system
• It interfaces with .NET and Windows APIs
• Most organizations are not watching PowerShell activity
• CMD.exe is commonly blocked, though not PowerShell