From 792b8e6adbc45fbd609bdfc7c1bdbb333e4761e7 Mon Sep 17 00:00:00 2001
From: Machiavelli <145562237+MachiavelliII@users.noreply.github.com>
Date: Wed, 5 Mar 2025 02:22:49 +0200
Subject: [PATCH] GetADUsers.py, impacket-GetADUsers: add page (#15816)

---
 pages/common/getadusers.py.md       | 21 +++++++++++++++++++++
 pages/common/impacket-getadusers.md |  9 +++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 pages/common/getadusers.py.md
 create mode 100644 pages/common/impacket-getadusers.md

diff --git a/pages/common/getadusers.py.md b/pages/common/getadusers.py.md
new file mode 100644
index 0000000000..d068fce077
--- /dev/null
+++ b/pages/common/getadusers.py.md
@@ -0,0 +1,21 @@
+# GetADUsers.py
+
+> Retrieve a list of users from Active Directory, including attributes like last logon timestamp and email.
+> Part of the Impacket suite.
+> More information: <https://github.com/fortra/impacket>.
+
+- Enumerate all Active Directory users and their attributes:
+
+`GetADUsers.py -all -dc-ip {{domain_controller_ip}} {{domain}}/{{username}}:{{password}}`
+
+- Retrieve information only for a specific user:
+
+`GetADUsers.py -user {{user}} -dc-ip {{domain_controller_ip}} {{domain}}/{{username}}:{{password}}`
+
+- Extract user details using pass-the-hash authentication:
+
+`GetADUsers.py -all -dc-ip {{domain_controller_ip}} -hashes {{LM_Hash}}:{{NT_Hash}} {{domain}}/{{username}}`
+
+- Save output to a file:
+
+`GetADUsers.py -all -dc-ip {{domain_controller_ip}} {{domain}}/{{username}}:{{password}} > output.txt`
diff --git a/pages/common/impacket-getadusers.md b/pages/common/impacket-getadusers.md
new file mode 100644
index 0000000000..481deaae5a
--- /dev/null
+++ b/pages/common/impacket-getadusers.md
@@ -0,0 +1,9 @@
+# impacket-GetADUsers
+
+> This command is an alias of `GetADUsers.py`.
+> Part of the Impacket suite.
+> More information: <https://github.com/fortra/impacket>.
+
+- View documentation for the original command:
+
+`tldr GetADUsers.py`