enum4linux: Complete Guide to SMB Enumeration and Windows Network Reconnaissance Using Kali Linux

enum4linux is a Perl-based reconnaissance tool built specifically to enumerate information from Windows and Samba systems over SMB/RPC. It was written by Mark Lowe (Portcullis Labs) as a re-implementation and wrapper around the Samba suite of tools (smbclient, rpcclient, net, nmblookup), combining their output into a single, easy-to-read report. It has been a staple of Windows/Active Directory enumeration since the early 2000s and remains preinstalled on Kali Linux.

enum4linux can pull:

• Workgroup/domain name
• OS version and build information
• Host SID (Security Identifier)
• User listing (via RID cycling and SAMR queries)
• Group listing and membership
• Shares (and whether they are accessible)
• Password policy information
• Printer information

It is most effective against older Windows versions (2000/2003/2008/2012) and Samba servers, and against any host where null sessions (unauthenticated SMB connections) are permitted, though it also supports authenticated enumeration with a valid username/password.

Installation

enum4linux ships by default in Kali Linux. If it is missing or you are on a different distribution:

# Kali Linux (already installed, but to reinstall/update)
sudo apt update
sudo apt install enum4linux -y

# Verify installation
enum4linux -h
which enum4linux

# Manual install from source (Debian/Ubuntu)
git clone https://github.com/portcullislabs/enum4linux.git
cd enum4linux
chmod +x enum4linux.pl
sudo ln -s $(pwd)/enum4linux.pl /usr/local/bin/enum4linux

Dependencies (installed automatically via apt): perl, samba-common-bin (provides rpcclient, net, nmblookup, smbclient).

Syntax

enum4linux [options] <ip address>

Command-Line Options

Basic Usage

The simplest invocation runs all standard checks (-a) against a target with a null/anonymous session:

enum4linux -a 192.168.56.101

Expected initial output header:

Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Jul 19 10:02:11 2026

 ==========================
|    Target Information   |
 ==========================
Target ........... 192.168.56.101
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none

Practical Examples

Example 1 — Full basic scan (anonymous session)

enum4linux -a 192.168.56.101

 ====================================
|    Nbtstat Information for 192.168.56.101    |
 ====================================
Looking up status of 192.168.56.101
	METASPLOITABLE  <00> -         B <ACTIVE>  Workstation Service
	METASPLOITABLE  <03> -         B <ACTIVE>  Messenger Service
	METASPLOITABLE  <20> -         B <ACTIVE>  File Server Service
	WORKGROUP       <00> - <GROUP> B <ACTIVE>  Domain/Workgroup Name

	MAC Address = 00-00-00-00-00-00

Example 2 — Get OS information only

enum4linux -o 192.168.56.101

 ==================================
|    OS information on 192.168.56.101    |
 ==================================
Got OS info for 192.168.56.101 from smbclient: Unix
Got OS info for 192.168.56.101 from srvinfo:
	192.168.56.101 Wk Sv PrQ Unx NT SNT Metasploitable server (Samba 3.0.20-Debian)
	platform_id     :	500
	os version      :	4.9
	server type     :	0x9a03

Example 3 — Enumerate shares

enum4linux -S 192.168.56.101

 =====================================
|    Share Enumeration on 192.168.56.101    |
 =====================================

	Sharename       Type      Comment
	---------       ----      -------
	print$          Disk      Printer Drivers
	tmp             Disk      oh noes!
	opt             Disk
	IPC$            IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))
	ADMIN$          IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))

	Server               Comment
	---------            -------
	METASPLOITABLE       metasploitable server (Samba 3.0.20-Debian)

	Workgroup            Master
	---------            -------
	WORKGROUP            METASPLOITABLE

[+] Attempting to map shares on 192.168.56.101
//192.168.56.101/print$	Mapping: DENIED, Listing: N/A
//192.168.56.101/tmp	Mapping: OK, Listing: OK
//192.168.56.101/opt	Mapping: DENIED, Listing: N/A
//192.168.56.101/IPC$	[E] Can't understand response:
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
//192.168.56.101/ADMIN$	Mapping: DENIED, Listing: N/A

Example 4 — Enumerate users via RID cycling

enum4linux -r -u "" -p "" 192.168.56.101

 ===============================================
|    Users on 192.168.56.101 via RID cycling (RIDs: 500-550,1000-1050)    |
 ===============================================
[I] Assuming that user "" exists
S-1-5-21-1409982668-1417001333-682003330-500 METASPLOITABLE\Administrator (Local User)
S-1-5-21-1409982668-1417001333-682003330-501 METASPLOITABLE\nobody (Local User)
S-1-5-21-1409982668-1417001333-682003330-1000 METASPLOITABLE\msfadmin (Local User)
S-1-5-21-1409982668-1417001333-682003330-1001 METASPLOITABLE\service (Local User)
S-1-5-21-1409982668-1417001333-682003330-1002 METASPLOITABLE\user (Local User)
S-1-5-21-1409982668-1417001333-682003330-1003 METASPLOITABLE\postgres (Local User)

Example 5 — Password policy enumeration

enum4linux -P 192.168.56.101

 =============================================
|    Password Policy Information for 192.168.56.101    |
 =============================================

[+] Attaching to 192.168.56.101 using a NULL share
[+] Trying protocol IPC$ with NULL account
[+] Found domain(s):

	[+] METASPLOITABLE
	[+] Builtin

[+] Password Info for Domain: METASPLOITABLE

	[+] Minimum password length: 5
	[+] Password history length: None
	[+] Maximum password age: Not Set
	[+] Password Complexity Flags: 000000

	[+] Minimum password age: None
	[+] Reset Account Lockout Counter: 30 minutes
	[+] Locked Account Duration: 30 minutes
	[+] Account Lockout Threshold: None
	[+] Forced Log off Time: Not Set

Example 6 — Group and member enumeration

enum4linux -G 192.168.56.101

 =======================================
|    Groups on 192.168.56.101    |
 =======================================

[+] Getting builtin groups:
group:[Administrators] rid:[0x220]
group:[Backup Operators] rid:[0x227]
group:[Guests] rid:[0x222]
group:[Users] rid:[0x221]

[+]  Getting builtin group memberships:
Group 'Administrators' (RID: 544) has member: METASPLOITABLE\root

Example 7 — Authenticated enumeration with known credentials

enum4linux -u msfadmin -p msfadmin -a 192.168.56.101

Username ......... 'msfadmin'
Password ......... 'msfadmin'
...
[+] Server 192.168.56.101 allows sessions using username 'msfadmin', password 'msfadmin'

Example 8 — Custom RID range enumeration

enum4linux -r -R 500-600 192.168.56.101

[I] Assuming that user "" exists
S-1-5-21-...-500 METASPLOITABLE\Administrator (Local User)
S-1-5-21-...-501 METASPLOITABLE\nobody (Local User)
...
S-1-5-21-...-600 *unknown*\*unknown* (SID_ERROR)

Example 9 — Verbose mode showing underlying commands

enum4linux -v -U 192.168.56.101

[V] Attempting to get userlist with command: rpcclient -U'' -N 192.168.56.101 -c 'enumdomusers'
 =========================================
|    Users on 192.168.56.101 via RPC    |
 =========================================
index: 0x1 RID: 0x3e8 acb: 0x00000010 Account: msfadmin	Name: msfadmin,,,	Desc: (null)

Example 10 — Piping output to a file for reporting

enum4linux -a 192.168.56.101 | tee enum4linux_192.168.56.101.txt

Starting enum4linux v0.9.1 ...

Common Use Cases

• Initial null-session SMB enumeration against Windows/Samba hosts discovered by nmap on port 139/445
• Enumerating local user accounts on older, unpatched Windows/Samba servers for password-spraying target lists
• Extracting SMB share names to identify accessible/writable shares for lateral movement or data exfiltration
• Pulling password policy to inform brute-force/lockout-safe attack throttling
• Quick single-tool “kitchen sink” report during CTFs (e.g., OSCP-style boxes such as Metasploitable2)

Automation with Bash

Scan a whole subnet and save individual reports per host:

#!/bin/bash
# enum4linux_sweep.sh - Run enum4linux -a against every live host in a subnet
SUBNET="192.168.56.0/24"
OUTDIR="./enum4linux_results"
mkdir -p "$OUTDIR"

for ip in $(nmap -p 139,445 --open -oG - "$SUBNET" | awk '/Up$/{next} /445\/open/{print $2}'); do
    echo "[*] Enumerating $ip"
    enum4linux -a "$ip" > "$OUTDIR/${ip}.txt" 2>&1
done
echo "[+] Done. Results in $OUTDIR"

Extract just the discovered usernames from a batch of reports:

grep -h "Local User" "$OUTDIR"/*.txt | awk -F'\\' '{print $2}' | awk '{print $1}' | sort -u > all_users.txt

Tips and Best Practices

• Always try an anonymous/null session first (-u "" -p "", the default) before assuming credentials are required.
• Combine -v with a specific flag (e.g., -v -U) when troubleshooting, so you can see and re-run the exact underlying rpcclient/net command manually.
• RID cycling (-r) can be slow and noisy; narrow the -R range if you already know the domain has few accounts, or widen it (e.g., 500-2000) for large AD environments.
• Save raw output with tee or redirection for every host — enum4linux output is a primary source for later exploitation planning.
• Cross-verify results with enum4linux-ng and rpcclient directly, since enum4linux occasionally mis-parses Samba banners on very old or very new Samba versions.

Troubleshooting

References

• Official repository: https://github.com/portcullislabs/enum4linux
• Kali Linux tool page: https://www.kali.org/tools/enum4linux/
• Samba project documentation: https://www.samba.org/samba/docs/
• Successor tool: enum4linux-ng — https://github.com/cddmp/enum4linux-ng