net Module Reference
The net module exposes Mimikatz helpers for enumerating Windows networking primitives such as users, groups, sessions, trusts, and delegation configuration. Each command is invoked from the Mimikatz console as net::<command>.
Most commands accept an optional positional argument (net::<command> <server>) that is passed directly to the corresponding Windows API. When provided, the remote machine (for example \\FILESERVER) is queried; when omitted, the local host is inspected.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L39-L148】【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L387-L466】【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L522-L574】
| Command | Purpose | Notable options |
|---|---|---|
net::user |
Enumerate users, group memberships, and alias memberships from the SAM database. | Positional <server> |
net::group |
List domain groups and their members. | Positional <server> |
net::alias |
Inspect alias (local group) memberships. | Positional <server> |
net::session |
List active SMB/NetBIOS sessions. | Positional <server> |
net::wsession |
Show users logged on via Workstation service. | Positional <server> |
net::tod |
Retrieve the remote time-of-day. | Positional <server> |
net::stats |
Dump workstation service statistics. | Positional <server> |
net::share |
Enumerate shared resources. | Positional <server> |
net::serverinfo |
Display server role, version, and comment metadata. | Positional <server> |
net::trust |
Enumerate AD domain trusts via RPC and LDAP. | /server:<dc> |
net::deleg |
Audit delegation-enabled principals in Active Directory. | /server:<dc>, /dns |
net::if |
Query DCOM endpoint mapper interfaces. | Positional <server> |
net::usernet::user [\\server]net::groupnet::group [\\server]net::aliasnet::alias [\\server]net::sessionnet::session [\\server]NetSessionEnum to report active client sessions, including the connecting computer name, username, session duration, and idle time.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L377-L403】net::wsessionnet::wsession [\\server]NetWkstaUserEnum to enumerate users logged on via the Workstation service, returning username, logon domain, logon server, and any other trusted domains.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L405-L434】net::session by showing interactive/logon-session data instead of just SMB connections, revealing cached logon contexts or RDP users.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L405-L434】net::todnet::tod [\\server]NetRemoteTOD to retrieve the target system’s time-of-day information and prints it in local time (with commented logic for boot time if needed).【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L436-L466】net::statsnet::stats [\\server]NetStatisticsGet against the Workstation service to report when statistics were last reset, a proxy for machine uptime or service availability.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L469-L483】net::sharenet::share [\\server]NetShareEnum, showing the share name, type (with decoded flags), usage limits, and backing path.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L485-L542】net::serverinfonet::serverinfo [\\server]NetServerGetInfo level 102 to display the server’s platform ID, OS version, comment, and role flags decoded into human-readable roles (workstation, domain controller, DFS, etc.).【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L552-L575】net::trustnet::trust [/server:<dc>]DsEnumerateDomainTrusts to list trust relationships (including flags, direction, type, SID, and GUID). It then performs an LDAP query against the same domain controller to pull attributes such as trust partner, flat name, direction, and type, decoding bit fields for readability.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L593-L738】/server: Pointing the command at a specific domain controller ensures the RPC and LDAP calls query the intended forest or domain, which is essential in multi-forest or segmented environments.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L593-L738】net::delegnet::deleg [/server:<dc>] [/dns]msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, unconstrained delegation via userAccountControl). When /dns is supplied, HTTP SPNs are validated via DnsQuery_A to flag names that are not resolvable.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L742-L856】/server: Directs the LDAP bind to a particular domain controller, which is necessary when auditing cross-domain trusts or when the default DC might not expose the desired context.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L742-L769】/dns: Adds immediate feedback on whether published HTTP SPNs have matching DNS A records, helping defenders find misconfigurations and enabling attackers to prioritize exploitable delegation entries.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L818-L835】net::ifnet::if [target]ncacn_ip_tcp on port 135) and calls ServerAlive2 to enumerate registered interface strings returned in the dual-string array.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L860-L892】net::autoda is present in the source but commented out; it is not exposed via the command table and therefore has no console documentation.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L332-L375】kuhl_m_net_simpleLookup resolve RIDs to names, which is why several commands can show friendly labels without additional LDAP queries.【F:mimikatz/mimikatz/modules/kuhl_m_net.c†L317-L331】