> For the complete documentation index, see [llms.txt](https://activedirectory.mrw0l05zyn.cl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://activedirectory.mrw0l05zyn.cl/recoleccion-de-informacion-y-enumeracion/enumeracion-no-autenticada/enumeracion-de-politica-de-contrasenas.md).

# Enumeración de política de contraseñas

## SMB NULL sessions <a href="#smb-null-sessions" id="smb-null-sessions"></a>

### enum4linux <a href="#smb-null-sessions-enum4linux" id="smb-null-sessions-enum4linux"></a>

```shell
enum4linux -P <IP-address-DC>
```

### rpcclient <a href="#smb-null-sessions-rpcclient" id="smb-null-sessions-rpcclient"></a>

```shell
rpcclient -U "" -N <IP-address-DC>
getdompwinfo
```

## LDAP anonymous bind

### ldapsearch <a href="#ldap-anonymous-bind-ldapsearch" id="ldap-anonymous-bind-ldapsearch"></a>

```shell
ldapsearch -h <IP-address-DC> -x -b "DC=ACME,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
```