kerbrute userenum

kerbrute userenum -d <domain> --dc <dc-ip> users.txt

Enumerates valid domain users via Kerberos pre-authentication.

When you have a list of potential usernames and want to validate which ones exist in the domain. Kerbrute uses Kerberos traffic (port 88) and is stealthier than LDAP queries, as it does not require authentication (uses pre-auth).

If the domain has lockout policies for failed Kerberos attempts (uncommon) or if the firewall blocks port 88.