# Enumeracion de Grupos

### <mark style="color:red;">**Importancia**</mark><mark style="color:red;">:</mark>&#x20;

Los grupos en AD, especialmente los grupos con privilegios, son un objetivo principal para los atacantes porque proporcionan acceso a recursos.&#x20;

### <mark style="color:red;">**Vulnerabilidades posibles**</mark><mark style="color:red;">:</mark>

* Grupos con privilegios que contienen demasiados miembros.
* Grupos que no deberían existir (por ejemplo, restos de pruebas o configuraciones antiguas).
* Grupos anidados que pueden ser explotados para elevar privilegios de forma indirecta.

```powershell
PS C:\v> Get-NetGroup | select samaccountname, admincount, description

samaccountname                          admincount description                                                         
--------------                          ---------- -----------                                                         
Administrators                                   1 Administrators have complete and unrestricted access to the compu...
Users                                              Users are prevented from making accidental or intentional system-...
Guests                                             Guests have the same access as members of the Users group by defa...
Print Operators                                  1 Members can administer printers installed on domain controllers     
Backup Operators                                 1 Backup Operators can override security restrictions for the sole ...
Replicator                                       1 Supports file replication in a domain                               
Remote Desktop Users                               Members in this group are granted the right to logon remotely       
Network Configuration Operators                    Members in this group can have some administrative privileges to ...
Performance Monitor Users                          Members of this group can access performance counter data locally...
Performance Log Users                              Members of this group may schedule logging of performance counter...
Distributed COM Users                              Members are allowed to launch, activate and use Distributed COM o...
IIS_IUSRS                                          Built-in group used by Internet Information Services.               
Cryptographic Operators                            Members are authorized to perform cryptographic operations.         
Event Log Readers                                  Members of this group can read event logs from local machine        
Certificate Service DCOM Access                    Members of this group are allowed to connect to Certification Aut...
RDS Remote Access Servers                          Servers in this group enable users of RemoteApp programs and pers...
RDS Endpoint Servers                               Servers in this group run virtual machines and host sessions wher...
RDS Management Servers                             Servers in this group can perform routine administrative actions ...
Hyper-V Administrators                             Members of this group have complete and unrestricted access to al...
Access Control Assistance Operators                Members of this group can remotely query authorization attributes...
Remote Management Users                            Members of this group can access WMI resources over management pr...
Storage Replica Administrators                     Members of this group have complete and unrestricted access to al...
Domain Computers                                   All workstations and servers joined to the domain                   
Domain Controllers                               1 All domain controllers in the domain                                
Schema Admins                                    1 Designated administrators of the schema                             
Enterprise Admins                                1 Designated administrators of the enterprise                         
Cert Publishers                                    Members of this group are permitted to publish certificates to th...
Domain Admins                                    1 Designated administrators of the domain                             
Domain Users                                       All domain users                                                    
Domain Guests                                      All domain guests                                                   
Group Policy Creator Owners                        Members in this group can modify group policy for the domain        
RAS and IAS Servers                                Servers in this group can access remote access properties of users  
Server Operators                                 1 Members can administer domain servers                               
Account Operators                                1 Members can administer domain user and group accounts               
Pre-Windows 2000 Compatible Access                 A backward compatibility group which allows read access on all us...
Incoming Forest Trust Builders                     Members of this group can create incoming, one-way trusts to this...
Windows Authorization Access Group                 Members of this group have access to the computed tokenGroupsGlob...
Terminal Server License Servers                    Members of this group can update user accounts in Active Director...
Allowed RODC Password Replication Group            Members in this group can have their passwords replicated to all ...
Denied RODC Password Replication Group             Members in this group cannot have their passwords replicated to a...
Read-only Domain Controllers                     1 Members of this group are Read-Only Domain Controllers in the domain
Enterprise Read-only Domain Controllers            Members of this group are Read-Only Domain Controllers in the ent...
Cloneable Domain Controllers                       Members of this group that are domain controllers may be cloned.    
Protected Users                                    Members of this group are afforded additional protections against...
Key Admins                                       1 Members of this group can perform administrative actions on key o...
Enterprise Key Admins                            1 Members of this group can perform administrative actions on key o...
DnsAdmins                                          DNS Administrators Group                                            
DnsUpdateProxy                                     DNS clients who are permitted to perform dynamic updates on behal...
```

### <mark style="color:red;">Grupos relevantes en AD:</mark>

1. <mark style="color:red;">**Administradores del Dominio**</mark> <mark style="color:red;"></mark><mark style="color:red;">(</mark>*<mark style="color:red;">Domain Admins</mark>*<mark style="color:red;">):</mark> Miembros de este grupo tienen permisos completos y de control total en el dominio. Es el grupo más poderoso y es el objetivo principal para muchos atacantes.
2. <mark style="color:red;">**Administradores de la Empresa**</mark> <mark style="color:red;"></mark><mark style="color:red;">(</mark>*<mark style="color:red;">Enterprise Admins</mark>*<mark style="color:red;">):</mark> Estos administradores tienen permisos en todos los dominios de un bosque. Si una organización tiene múltiples dominios, este grupo es aún más poderoso que "Domain Admins".
3. <mark style="color:red;">**Administradores de Esquema**</mark> <mark style="color:red;"></mark><mark style="color:red;">(</mark>*<mark style="color:red;">Schema Admins</mark>*<mark style="color:red;">):</mark> Los miembros de este grupo pueden modificar el esquema del AD, que es la estructura subyacente que define objetos y atributos.
4. <mark style="color:red;">**Usuarios del Dominio**</mark> <mark style="color:red;"></mark><mark style="color:red;">(</mark>*<mark style="color:red;">Domain Users</mark>*<mark style="color:red;">): Este</mark> grupo incluye todas las cuentas de usuario en un dominio. A menudo se verifica para identificar posibles cuentas huérfanas o no utilizadas.
5. <mark style="color:red;">**Computadoras del Dominio**</mark> <mark style="color:red;"></mark><mark style="color:red;">(</mark>*<mark style="color:red;">Domain Computers</mark>*<mark style="color:red;">):</mark> Este grupo incluye todas las estaciones de trabajo y servidores unidos al dominio.
6. <mark style="color:red;">**Controladores de Dominio**</mark> <mark style="color:red;"></mark><mark style="color:red;">(</mark>*<mark style="color:red;">Domain Controllers</mark>*<mark style="color:red;">):</mark> Este grupo incluye todos los controladores de dominio en un dominio. Es esencial garantizar que sólo las máquinas confiables sean parte de este grupo.
7. <mark style="color:red;">**Política de replicación de lectura**</mark> <mark style="color:red;"></mark><mark style="color:red;">(</mark>*<mark style="color:red;">Read-Only Domain Controllers - RODC</mark>*<mark style="color:red;">):</mark> Si la organización utiliza RODCs, es esencial garantizar que estén configurados correctamente.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://books.spartan-cybersec.com/cpad/enumeracion-en-ad/enumeracion-con-powershell-ofensivo/guia-de-comandos-de-powerview.ps1/enumeracion-de-grupos.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.