rpcclient: Complete Guide to Windows RPC Enumeration and Active Directory Information Gathering Using Kali Linux

rpcclient is a low-level command-line utility, part of the Samba suite, that lets you speak directly to the MS-RPC (Microsoft Remote Procedure Call) interfaces exposed by Windows and Samba servers over SMB (specifically through the \PIPE\lsarpc, \PIPE\samr, and \PIPE\srvsvc named pipes). It is effectively the “raw” underlying tool that higher-level wrappers such as enum4linux/enum4linux-ng call behind the scenes — but used directly, it gives full manual control over which RPC calls to issue, making it the go-to tool when automated wrappers miss something or behave unexpectedly.

Once connected, rpcclient drops you into an interactive shell with dozens of subcommands mapping to specific RPC calls, covering:

• SAMR (Security Account Manager) — user/group enumeration, SID/RID lookups
• LSARPC (Local Security Authority) — policy info, privilege enumeration, SID↔name translation
• SRVSVC — share and server info
• SPOOLSS — printer enumeration

rpcclient is invaluable for manual, targeted enumeration once you already know roughly what you’re looking for (e.g., “give me the full member list of the Domain Admins group”).

Installation

# Kali Linux (preinstalled as part of samba-common-bin)
sudo apt update
sudo apt install smbclient -y   # rpcclient ships in the same samba-client tooling

# Verify
rpcclient --version
which rpcclient

Syntax

rpcclient -U [domain/]username[%password] <target IP>
rpcclient -U "" -N <target IP>          # null session
rpcclient -c "<command>" -U "" -N <target IP>   # one-shot command mode

Command-Line Options

Option	Description
-U username[%password]	Username (and optional password) to authenticate with
-N, --no-pass	Do not prompt for/use a password (null session)
-W, --workgroup	Set the domain/workgroup
-c, --command	Execute one or more ;-separated commands non-interactively and exit
-I, --dest-ip	Destination IP address (bypass name resolution)
-p, --port	Port to connect to (default 445)
-s, --configfile	Use alternate smb.conf
-A, --authentication-file	Read credentials from a file
--pw-nt-hash	Use an NT hash instead of plaintext password
-d, --debuglevel	Debug/verbosity level

Common interactive commands (subset of dozens available):

Command	Description
srvinfo	Server information (OS version, type)
enumdomusers	Enumerate domain/local users
enumdomgroups	Enumerate domain/local groups
queryuser <RID>	Detailed info about a user by RID
querygroup <RID>	Detailed info about a group by RID
querygroupmem <RID>	List members of a group by RID
lookupnames <name>	Resolve a name to a SID
lookupsids <SID>	Resolve a SID to a name
lsaquery	Query LSA policy (domain SID)
querydominfo	Query domain information (password policy, user/group counts)
getdompwinfo	Get domain password policy
netshareenum / netshareenumall	Enumerate shares
enumprinters	Enumerate printers
createdomuser <name>	Create a domain user (requires privileges)
deletedomuser <name>	Delete a domain user (requires privileges)
enumalsgroups builtin	Enumerate builtin alias groups
queryaliasmem builtin <RID>	List members of a builtin alias (e.g., Administrators)
exit / quit	Close the session

Basic Usage

Connect with a null session and drop into the interactive shell:

rpcclient -U "" -N 192.168.56.101

rpcclient $>

Practical Examples

Example 1 — Connect with null session

rpcclient -U "" -N 192.168.56.101

rpcclient $>

Example 2 — Server info (srvinfo)

rpcclient $> srvinfo

	192.168.56.101 Wk Sv PrQ Unx NT SNT metasploitable server (Samba 3.0.20-Debian)
	platform_id     :	500
	os version      :	4.9
	server type     :	0x9a03

Example 3 — Enumerate domain users

rpcclient $> enumdomusers

user:[msfadmin] rid:[0x3e8]
user:[service] rid:[0x3e9]
user:[user] rid:[0x3ea]
user:[postgres] rid:[0x3eb]

Example 4 — Query detailed information about a specific user

rpcclient $> queryuser 0x3e8

	User Name   :	msfadmin
	Full Name   :	msfadmin,,,
	Home Drive  :	
	Dir Drive   :	
	Profile Path:	
	Logon Script:	
	Description :	
	Workstations:	
	Comment     :	
	Remote Dial :	
	Logon Time               :	Thu, 01 Jan 1970 00:00:00 UTC
	Logoff Time              :	Thu, 07 Feb 2036 06:28:15 UTC
	Kickoff Time             :	Thu, 07 Feb 2036 06:28:15 UTC
	Password last set Time   :	Sat, 01 Jul 2026 03:11:04 UTC
	Password can change Time :	Sat, 01 Jul 2026 03:11:04 UTC
	Password must change Time:	Thu, 07 Feb 2036 06:28:15 UTC
	unknown_2[0..31]...
	user_rid :	0x3e8
	group_rid:	0x201
	acb_info :	0x00000010
	fields_present: 0x00ffffff
	logon_divs:	168
	bad_password_count:	0x00000000
	logon_count:	0x00000000

Example 5 — Enumerate domain groups

rpcclient $> enumdomgroups

group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]

Example 6 — List members of the Administrators alias

rpcclient $> queryaliasmem builtin 0x220

	sid:[S-1-5-21-1409982668-1417001333-682003330-0] *unknown*\root (1)

Example 7 — Query domain password policy

rpcclient $> getdompwinfo

min_password_length: 5
password_properties: 0x00000000

Example 8 — LSA query for domain SID

rpcclient $> lsaquery

Domain Name: WORKGROUP
Domain Sid: S-1-5-21-1409982668-1417001333-682003330

Example 9 — SID to name resolution (lookupsids)

rpcclient $> lookupsids S-1-5-21-1409982668-1417001333-682003330-1000

S-1-5-21-1409982668-1417001333-682003330-1000 METASPLOITABLE\msfadmin (1)

Example 10 — Enumerate network shares (netshareenumall)

rpcclient $> netshareenumall

netname: print$
	remark:	Printer Drivers
	path:	C:\var\lib\samba\printers
	password:	

netname: tmp
	remark:	oh noes!
	path:	C:\tmp
	password:	

Example 11 — One-shot non-interactive command usage

rpcclient -U "" -N 192.168.56.101 -c "enumdomusers;querydominfo"

user:[msfadmin] rid:[0x3e8]
user:[service] rid:[0x3e9]
Domain:		WORKGROUP
Server:		METASPLOITABLE
Comment:	metasploitable server (Samba 3.0.20-Debian)
Total Users:	6
Total Groups:	0
Total Aliases:	0

Example 12 — Authenticated session against a Domain Controller

rpcclient -U 'CORP\jdoe%Passw0rd!' 192.168.10.10 -c "enumdomusers"

user:[jdoe] rid:[0x44f]
user:[asmith] rid:[0x450]
user:[svc_backup] rid:[0x451]
...

Common Use Cases

• Manual, targeted follow-up when enum4linux/enum4linux-ng output looks incomplete or suspicious
• Extracting complete Domain Admins / Administrators group membership for privilege-escalation targeting
• Resolving SIDs to usernames (and vice versa) discovered from other sources (e.g., event logs, registry dumps)
• Scripting bulk RID enumeration when a target blocks SAMR EnumDomainUsers but still allows individual queryuser calls
• Testing whether a specific low-privilege account can perform privileged operations (createdomuser, etc.) — a strong indicator of misconfiguration

Automation with Bash

#!/bin/bash
# rpc_rid_bruteforce.sh - Manually RID-cycle using rpcclient queryuser (works when enumdomusers is blocked)
TARGET="$1"
START=500
END=1100

for rid in $(seq $START $END); do
    hexrid=$(printf '0x%x' "$rid")
    result=$(rpcclient -U "" -N "$TARGET" -c "queryuser $hexrid" 2>/dev/null | grep "User Name")
    if [ -n "$result" ]; then
        echo "RID $hexrid -> $result"
    fi
done

Tips and Best Practices

• Always try -U "" -N (null session) first; many Samba defaults and legacy Windows hosts still permit anonymous RPC access to lsarpc/samr.
• Use -c "cmd1;cmd2;cmd3" for fast, scriptable, non-interactive enumeration instead of the interactive shell when automating.
• If enumdomusers returns NT_STATUS_ACCESS_DENIED, individual queryuser <RID> calls (or lookupsids) often still work — this is the basis of manual RID cycling.
• Cross-check netshareenumall output against smbclient -L — occasionally one reveals hidden/administrative shares the other misses.
• Use -d 3 or higher when a call silently fails, to see the underlying DCE/RPC error for diagnosis.

Troubleshooting

Problem	Likely Cause	Solution
Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE	Invalid credentials	Verify username/password/domain format (DOMAIN\user%pass)
NT_STATUS_ACCESS_DENIED on enumdomusers	RestrictAnonymous hardening	Try authenticated session, or fall back to per-RID queryuser
Connection immediately drops	SMB1 disabled on modern Windows	No workaround via rpcclient alone — use enum4linux-ng or authenticate
command not found inside shell	Typo or command unsupported by target’s RPC version	Run help inside the shell to list available/valid commands
Hangs when specifying hostname	DNS/NetBIOS resolution failure	Add -I <ip> to bypass name resolution and connect directly

References

• Samba manual page: https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html
• Kali Linux tool page: https://www.kali.org/tools/samba/
• MS-RPC / MS-SAMR protocol documentation (Microsoft): https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/