> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-compromise-enumeration/ldapdomaindump.md).

# Ldapdomaindump

## Overview

**Ldapdomaindump** works by connecting to  the LDAP server/Domain Controller, and querying it for information about users, groups, etc. It takes the responses from the server and puts it into a nice readable format for us to read.

**Impacket-ntlmrelayx** uses this tool by automatically default but if the[ IPv6 DNS Takeover](/active-directory/initial-attack-strategy/ipv6-attacks.md) attack didn't work there is a manual way of doing it.

## Domain Enumeration

```bash
sudo ldapdomaindump ldaps://192.168.1.129 -u 'PNPT\greg' -p 'Password1' 
```