> For the complete documentation index, see [llms.txt](https://strange-1.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://strange-1.gitbook.io/notes/active-directory/password-spraying/enumerating-and-retrieving-password-policies.md).

# Enumerating & Retrieving Password Policies

**Enumerating the Password Policy - from Linux - Credentialed**

```bash
# getting password policy with valid domain credentials using cme tool
crackmapexec smb ip -u eren -p pass --pass-pol
```

**Enumerating the Password Policy - from Linux - SMB NULL Sessions**

```bash
# Obtaining the Password Policy 

# rpcclient
rpcclient -U "" -N ip
querydominfo
getdompwinfo

# enum4linux-ng
enum4linux-ng -P ip -oA ilfreight
```

**Enumerating the Password Policy - from Linux - LDAP Anonymous Bind**

```bash
# Using ldapsearch
ldapsearch -h ip -x -b "DC=DOMAIN,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
```

**Enumerating the Password Policy - from Windows**

```bash
# Using net.exe
C:\> net accounts

# Using PowerView
PS C:\> import-module .\PowerView.ps1
PS C:\> Get-DomainPolicy
```