enum4linux-ng: Complete Guide to Advanced SMB Enumeration and Active Directory Reconnaissance Using Kali Linux

enum4linux-ng is a complete Python 3 rewrite of the classic enum4linux, created and maintained by Sven Deichmann (cddmp). It preserves the original tool’s philosophy — a single command that wraps Samba’s toolset to enumerate Windows/Samba hosts over SMB/RPC — while fixing long-standing parsing bugs, adding modern protocol support (SMB2/SMB3), and offering structured output formats. It is preinstalled on current Kali Linux releases and is now the recommended default over legacy enum4linux.

Key improvements over the original:

• Native JSON and YAML output (-oJ, -oY) for easy integration with other tooling/reporting pipelines
• Color-coded terminal output for readability
• Better detection of Samba vs. Windows vs. Domain Controller targets
• More robust null-session and Kerberos pre-auth handling
• Uses the impacket Python library internally for several RPC calls instead of shelling out to rpcclient, improving reliability

It enumerates the same core categories as enum4linux: OS info, domain/workgroup info, users, groups, shares, password policy, and printers — plus, when running against a Domain Controller, additional domain-level information.

Installation

# Kali Linux (already installed by default)
sudo apt update
sudo apt install enum4linux-ng -y

# Verify
enum4linux-ng -h

# Manual install from source (any Linux distro with Python 3)
git clone https://github.com/cddmp/enum4linux-ng.git
cd enum4linux-ng
pip3 install -r requirements.txt --break-system-packages
python3 enum4linux-ng.py -h

Dependencies: python3, python3-impacket, python3-ldap3, python3-yaml, smbclient (from samba-client).

Syntax

enum4linux-ng [options] <ip address>

Command-Line Options

Option	Description
-h, --help	Show help message
-A	Do all simple enumeration (equivalent to -U -G -S -P -O -N -I) — default if no options given
-As	Do all simple short enumeration (skips slower checks)
-U	Enumerate users
-UM	Enumerate users via machine (RID cycling as fallback)
-G	Enumerate groups
-Gm	Enumerate group memberships
-S	Enumerate shares
-C	Enumerate share contents (implies -S)
-P	Enumerate password policy
-O	Enumerate OS information
-L	Enumerate additional info via LDAP (only against DCs, port 389)
-I	Enumerate printers
-N	Enumerate via nmblookup (NetBIOS names)
-R	Enumerate via RID cycling
-r range	Custom RID range for cycling (default 500-550,1000-1050)
-k users	Custom known usernames for SID lookup
-u user	Username for authentication
-p pass	Password for authentication
-K hash	NTLM hash for pass-the-hash authentication
-d, --domain	Domain name for authentication
-oJ filename	Write output in JSON format
-oY filename	Write output in YAML format
-v, --verbose	Verbose mode
-t timeout	Set connection timeout in seconds
--dns-server	DNS server to use for name resolution

Basic Usage

enum4linux-ng -A 192.168.56.101

Expected header output:

ENUM4LINUX - next generation (v1.3.4)

 =========================================
|    Target Information                  |
 =========================================
[*] Target ........... 192.168.56.101
[*] Username ......... ''
[*] Password ......... ''
[*] Domain ........... ''

Practical Examples

Example 1 — Full enumeration with default null session

enum4linux-ng -A 192.168.56.101

 =========================================
|    OS Information via RPC               |
 =========================================
[+] Found OS information via 'srvinfo'
OS: Windows 6.1
OS version: '6.1'
OS release: ''
OS build: '0'
Native OS: not supported
Native LAN manager: not supported
Platform id: 500
Server type: 0x9a03
Server type string: Wk Sv PrQ Unx NT SNT Server

Example 2 — JSON output for automation/reporting pipelines

enum4linux-ng -A -oJ report_192.168.56.101 192.168.56.101

[*] Writing output to report_192.168.56.101.json
[+] Done.

cat report_192.168.56.101.json | jq '.users'

{
  "1000": {
    "username": "msfadmin",
    "name": "",
    "acb": "0x00000010",
    "description": ""
  }
}

Example 3 — Share enumeration with content listing

enum4linux-ng -C 192.168.56.101

 =========================================
|    Shares via RPC                       |
 =========================================
[*] Enumerating shares
[+] Found 5 share(s):

tmp:
	comment: oh noes!
	type: Disk
	Enumerating share content:
		//192.168.56.101/tmp/
		dr--r--r-- 0 Wed Jul 15 05:23:11 2026 .
		dr--r--r-- 0 Wed Jul 15 05:23:11 2026 ..
		-r--r--r-- 42 Wed Jul 15 05:23:11 2026 notes.txt

Example 4 — User enumeration via SAMR (authenticated)

enum4linux-ng -u msfadmin -p msfadmin -U 192.168.56.101

 =========================================
|    Users via RPC                        |
 =========================================
[*] Enumerating users via 'querydispinfo'
[+] Found 6 user(s) via 'querydispinfo'
'1000':
	username: msfadmin
	name: (null)
	acb: 0x00000210
	description: (null)

Example 5 — RID cycling fallback when SAMR queries are blocked

enum4linux-ng -R -r 500-1100 192.168.56.101

 =========================================
|    Users via RID Cycling                |
 =========================================
[*] Trying to enumerate users via 'lookupsids' with RID range 500-1100
[+] After RID cycling, found 6 user(s):
'500': Administrator
'501': Guest
'1000': msfadmin
'1001': service
'1002': user
'1003': postgres

Example 6 — Password policy enumeration

enum4linux-ng -P 192.168.56.101

 =========================================
|    Password Policy via RPC              |
 =========================================
[+] Found policy:
Domain password information:
	Password history length: None
	Minimum password length: 5
	Maximum password age: not set
	Password properties:
		DOMAIN_PASSWORD_COMPLEX: false
		DOMAIN_PASSWORD_NO_ANON_CHANGE: false

Example 7 — Group membership enumeration

enum4linux-ng -Gm 192.168.56.101

 =========================================
|    Group Memberships via RPC            |
 =========================================
Group: 'Administrators' (RID: 544)
	Members:
	 root (Local User)

Example 8 — Domain Controller LDAP-based enumeration

enum4linux-ng -L -u jdoe -p 'Passw0rd!' -d CORP.LOCAL 192.168.10.10

 =========================================
|    Domain Information via LDAP          |
 =========================================
[*] Domain: CORP
[*] Domain SID: S-1-5-21-3623811015-3361044348-30300820
[*] Forest functional level: Windows Server 2016
[+] Found 143 user(s) in the domain

Example 9 — Pass-the-hash authentication

enum4linux-ng -u administrator -K aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -A 192.168.56.101

[*] Username ......... 'administrator'
[*] Using NTLM hash for authentication
[+] Server allows session using supplied NTLM hash

Example 10 — YAML output for direct reading

enum4linux-ng -S -oY shares_out 192.168.56.101
cat shares_out.yaml

target: 192.168.56.101
shares:
  tmp:
    comment: oh noes!
    type: Disk
  print$:
    comment: Printer Drivers
    type: Disk

Common Use Cases

• Modern replacement for enum4linux on any assessment involving Windows/Samba SMB shares (139/445)
• Structured (JSON/YAML) output ingestion into custom reporting scripts, dashboards, or vulnerability-management platforms
• Domain Controller enumeration combining SMB + LDAP data in one pass
• Pass-the-hash validation of captured/cracked NTLM hashes without needing the plaintext password
• CI/CD-style automated internal network assessments where output needs to be machine-parseable

Automation with Bash

#!/bin/bash
# e4lng_sweep.sh - Sweep a target list, output JSON per host, then merge users
TARGETS="targets.txt"     # one IP per line
OUTDIR="./e4lng_results"
mkdir -p "$OUTDIR"

while read -r ip; do
    echo "[*] Enumerating $ip"
    enum4linux-ng -A -oJ "$OUTDIR/${ip}" "$ip" > "$OUTDIR/${ip}.log" 2>&1
done < "$TARGETS"

echo "[*] Merging all discovered usernames..."
jq -r '.users[]?.username' "$OUTDIR"/*.json 2>/dev/null | sort -u > "$OUTDIR/all_usernames.txt"
echo "[+] Unique usernames saved to $OUTDIR/all_usernames.txt"

Tips and Best Practices

• Prefer enum4linux-ng over the legacy tool whenever possible; it handles SMB2/SMB3-only hosts far more reliably.
• Use -As for a quick triage pass across many hosts, then re-run -A -C against interesting targets to pull share contents.
• Always pipe output to -oJ during engagements — JSON is trivial to jq-filter later for usernames, shares, or policy fields.
• When SAMR-based user enumeration (-U) is blocked by RestrictAnonymous, fall back to -R (RID cycling), which often still works.
• Combine with a captured NTLM hash and -K to confirm valid credentials before attempting other pass-the-hash tooling (e.g., psexec.py, crackmapexec).

Troubleshooting

Problem	Likely Cause	Solution
Connection to 192.168.56.101 failed	SMB signing required / firewall block	Verify with nmap -p445 --script smb2-security-mode <ip>; ensure port reachable
STATUS_ACCESS_DENIED on SAMR queries	RestrictAnonymous=2 or modern default hardening	Try -R (RID cycling) or supply valid credentials
No output for -L LDAP section	Target is not a Domain Controller	Only use -L against DCs (port 389/636 open)
ModuleNotFoundError: impacket	Missing Python dependency	pip3 install impacket --break-system-packages
Garbled/incomplete JSON file	Process killed mid-run (timeout)	Increase -t timeout value

References

• Official repository: https://github.com/cddmp/enum4linux-ng
• Kali Linux tool page: https://www.kali.org/tools/enum4linux-ng/
• Impacket project (dependency): https://github.com/fortra/impacket
• Original enum4linux for comparison: https://github.com/portcullislabs/enum4linux