Logged-On User Enumeration

After infiltrating a network, an attacker typically looks for privileged users as their next target. To find these users, an attacker might connect to directory services or accounts to enumerate users, administrators, domains, or groups on the network. Active Directory (AD) is the directory service in a domain-based Windows environment. One approach for enumerating active users is to send Microsoft remote procedure call (MSRPC) queries to the Microsoft Workstation Service Remote Protocol (MS-WKST) interface. An attacker with administrator privileges retrieves a list of users that are currently logged into the server. An attacker without administrator privileges only learns about the login status of the victim.