rpcclient: Complete Guide to Windows RPC Enumeration and Active Directory Information Gathering Using Kali Linux

rpcclient is a low-level command-line utility, part of the Samba suite, that lets you speak directly to the MS-RPC (Microsoft Remote Procedure Call) interfaces exposed by Windows and Samba servers over SMB (specifically through the \PIPE\lsarpc, \PIPE\samr, and \PIPE\srvsvc named pipes). It is effectively the “raw” underlying tool that higher-level wrappers such as enum4linux/enum4linux-ng call behind the scenes — but used directly, it gives full manual control over which RPC calls to issue, making it the go-to tool when automated wrappers miss something or behave unexpectedly.

Once connected, rpcclient drops you into an interactive shell with dozens of subcommands mapping to specific RPC calls, covering:

• SAMR (Security Account Manager) — user/group enumeration, SID/RID lookups
• LSARPC (Local Security Authority) — policy info, privilege enumeration, SID↔name translation
• SRVSVC — share and server info
• SPOOLSS — printer enumeration

rpcclient is invaluable for manual, targeted enumeration once you already know roughly what you’re looking for (e.g., “give me the full member list of the Domain Admins group”).

Installation

# Kali Linux (preinstalled as part of samba-common-bin)
sudo apt update
sudo apt install smbclient -y   # rpcclient ships in the same samba-client tooling

# Verify
rpcclient --version
which rpcclient

Syntax

rpcclient -U [domain/]username[%password] <target IP>
rpcclient -U "" -N <target IP>          # null session
rpcclient -c "<command>" -U "" -N <target IP>   # one-shot command mode

Command-Line Options

Common interactive commands (subset of dozens available):

Basic Usage

Connect with a null session and drop into the interactive shell:

rpcclient -U "" -N 192.168.56.101

rpcclient $>

Practical Examples

Example 1 — Connect with null session

rpcclient -U "" -N 192.168.56.101

rpcclient $>

Example 2 — Server info (srvinfo)

rpcclient $> srvinfo

	192.168.56.101 Wk Sv PrQ Unx NT SNT metasploitable server (Samba 3.0.20-Debian)
	platform_id     :	500
	os version      :	4.9
	server type     :	0x9a03

Example 3 — Enumerate domain users

rpcclient $> enumdomusers

user:[msfadmin] rid:[0x3e8]
user:[service] rid:[0x3e9]
user:[user] rid:[0x3ea]
user:[postgres] rid:[0x3eb]

Example 4 — Query detailed information about a specific user

rpcclient $> queryuser 0x3e8

	User Name   :	msfadmin
	Full Name   :	msfadmin,,,
	Home Drive  :	
	Dir Drive   :	
	Profile Path:	
	Logon Script:	
	Description :	
	Workstations:	
	Comment     :	
	Remote Dial :	
	Logon Time               :	Thu, 01 Jan 1970 00:00:00 UTC
	Logoff Time              :	Thu, 07 Feb 2036 06:28:15 UTC
	Kickoff Time             :	Thu, 07 Feb 2036 06:28:15 UTC
	Password last set Time   :	Sat, 01 Jul 2026 03:11:04 UTC
	Password can change Time :	Sat, 01 Jul 2026 03:11:04 UTC
	Password must change Time:	Thu, 07 Feb 2036 06:28:15 UTC
	unknown_2[0..31]...
	user_rid :	0x3e8
	group_rid:	0x201
	acb_info :	0x00000010
	fields_present: 0x00ffffff
	logon_divs:	168
	bad_password_count:	0x00000000
	logon_count:	0x00000000

Example 5 — Enumerate domain groups

rpcclient $> enumdomgroups

group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]

Example 6 — List members of the Administrators alias

rpcclient $> queryaliasmem builtin 0x220

	sid:[S-1-5-21-1409982668-1417001333-682003330-0] *unknown*\root (1)

Example 7 — Query domain password policy

rpcclient $> getdompwinfo

min_password_length: 5
password_properties: 0x00000000

Example 8 — LSA query for domain SID

rpcclient $> lsaquery

Domain Name: WORKGROUP
Domain Sid: S-1-5-21-1409982668-1417001333-682003330

Example 9 — SID to name resolution (lookupsids)

rpcclient $> lookupsids S-1-5-21-1409982668-1417001333-682003330-1000

S-1-5-21-1409982668-1417001333-682003330-1000 METASPLOITABLE\msfadmin (1)

Example 10 — Enumerate network shares (netshareenumall)

rpcclient $> netshareenumall

netname: print$
	remark:	Printer Drivers
	path:	C:\var\lib\samba\printers
	password:	

netname: tmp
	remark:	oh noes!
	path:	C:\tmp
	password:	

Example 11 — One-shot non-interactive command usage

rpcclient -U "" -N 192.168.56.101 -c "enumdomusers;querydominfo"

user:[msfadmin] rid:[0x3e8]
user:[service] rid:[0x3e9]
Domain:		WORKGROUP
Server:		METASPLOITABLE
Comment:	metasploitable server (Samba 3.0.20-Debian)
Total Users:	6
Total Groups:	0
Total Aliases:	0

Example 12 — Authenticated session against a Domain Controller

rpcclient -U 'CORP\jdoe%Passw0rd!' 192.168.10.10 -c "enumdomusers"

user:[jdoe] rid:[0x44f]
user:[asmith] rid:[0x450]
user:[svc_backup] rid:[0x451]
...

Common Use Cases

• Manual, targeted follow-up when enum4linux/enum4linux-ng output looks incomplete or suspicious
• Extracting complete Domain Admins / Administrators group membership for privilege-escalation targeting
• Resolving SIDs to usernames (and vice versa) discovered from other sources (e.g., event logs, registry dumps)
• Scripting bulk RID enumeration when a target blocks SAMR EnumDomainUsers but still allows individual queryuser calls
• Testing whether a specific low-privilege account can perform privileged operations (createdomuser, etc.) — a strong indicator of misconfiguration

Automation with Bash

#!/bin/bash
# rpc_rid_bruteforce.sh - Manually RID-cycle using rpcclient queryuser (works when enumdomusers is blocked)
TARGET="$1"
START=500
END=1100

for rid in $(seq $START $END); do
    hexrid=$(printf '0x%x' "$rid")
    result=$(rpcclient -U "" -N "$TARGET" -c "queryuser $hexrid" 2>/dev/null | grep "User Name")
    if [ -n "$result" ]; then
        echo "RID $hexrid -> $result"
    fi
done

Tips and Best Practices

• Always try -U "" -N (null session) first; many Samba defaults and legacy Windows hosts still permit anonymous RPC access to lsarpc/samr.
• Use -c "cmd1;cmd2;cmd3" for fast, scriptable, non-interactive enumeration instead of the interactive shell when automating.
• If enumdomusers returns NT_STATUS_ACCESS_DENIED, individual queryuser <RID> calls (or lookupsids) often still work — this is the basis of manual RID cycling.
• Cross-check netshareenumall output against smbclient -L — occasionally one reveals hidden/administrative shares the other misses.
• Use -d 3 or higher when a call silently fails, to see the underlying DCE/RPC error for diagnosis.

Troubleshooting

References

• Samba manual page: https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html
• Kali Linux tool page: https://www.kali.org/tools/samba/
• MS-RPC / MS-SAMR protocol documentation (Microsoft): https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/