Enumeración de política de contraseñas

SMB NULL sessions

enum4linux

enum4linux -P <IP-address-DC>

rpcclient

rpcclient -U "" -N <IP-address-DC>
getdompwinfo

LDAP anonymous bind

ldapsearch

ldapsearch -h <IP-address-DC> -x -b "DC=ACME,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength