> For the complete documentation index, see [llms.txt](https://xedex.gitbook.io/internalpentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://xedex.gitbook.io/internalpentest/internal-pentest/active-directory/reconnaissance/powerview.md).

# Powerview

You need first to download [PowerView](https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1) to the host you compromised (up to you how you want to do it)

Now we need to launch powershell and bypass the execution policy by doing :

```
powershell -ep bypass
```

next we need to load PowerView :

```
. .\PowerView.ps1
```

Now obviously this script can retrieve a lot of information, you can for example get information about the domain by :

```
Get-NetDomain
```

or DC :

```
Get-NetDomainController
```

If for example you want to check a particular attribute (say, system access) of the Domain policy you can :

```
(Get-DomainPolicy)."system access"
```

Look for shares :

```
Invoke-ShareFinder
```

GPO:

```
Get-NetGPO
```

\
a cheat sheet is available here :

{% embed url="<https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993>" %}