ldapsearch autenticado

ldapsearch -x -H ldap://<dc-ip> -D "<user>@<domain>" -w '<pass>' -b "DC=empresa,DC=com" "(objectClass=user)"

Authenticated LDAP query to enumerate users, groups, and Active Directory attributes.

When you already have domain credentials and need to list users, groups, or specific attributes. This is the stealthiest way to extract AD data without using noisy tools. I use it to get users with SPNs (Kerberoast), admin groups, and OUs.

If the DC has LDAP over SSL (636) and the certificate is invalid, you'll need to use -H ldaps://. Also, if you don't have credentials, it won't work.