Sam tool connects to the Security Accounts Manager on a remote Windows system and enumerates user accounts, groups, and aliases. It queries general and account-level info for each object returned.
Subcommands
| Command | Description |
|---|---|
| enumusers | Enumerate user accounts |
| enumgroups | Enumerate groups |
| enumaliases | Enumerate aliases |
For help on any subcommand, run
Sam <subcommand> -h.Common options
AllSam subcommands share these authentication and connection options:
Authentication (credentials)
Authentication (credentials)
User name to authenticate with (not including the domain).
Domain of the authenticating user.
Password to authenticate with.
NTLM hash for pass-the-hash authentication.
Use anonymous login.
Authentication (Kerberos)
Authentication (Kerberos)
Connection
Connection
Override network address(es) of the server.
Use TCP over IPv4 only.
Use TCP over IPv6 only.
Encrypt RPC messages.
Connect over a named pipe instead of TCP when supported.
SOCKS5 proxy endpoint.
enumusers
Enumerates user accounts from the SAM database on a remote system. For each user,Sam enumusers queries the general account info and returns details such as the account name, SID, full name, last logon time, and password information.
Parameters
Parameters
RPC server to interact with.
Options
Options
Fields to display. Available:
AccountName, Domain, AccountType, Id, Sid, FullName, AdminComment, PasswordLastSet, LastLogon, BadPasswordCount.Output format:
Freeform, Raw, Table, List, Csv, Tsv, Json.Continue even if errors occur for individual accounts.