Can someone without a domain user account interact with Active Directory to obtain, e.g. password policy, list of domain users, list of domain controllers etc.? - or is it impossible to interact with Active Directory without domain user credentials?


If you are a Domain Administrator, it is possible to enable anonymous (unauthenticated) logins to the AD LDAP service via the dSHeuristics parameter. The search term for that is "anonymous bind". Once that's enabled, you'll probably have to grant access to individual LDAP entries via ACLs.

Is it wise to do so? IMHO, not at all. At the very least, it would easily become a major privacy issue for your employees – and attract security problems as well. (Hence no links to documentation.)

If you are writing a script for domains managed by someone else – the general answer is "no". Even things such as services or batch jobs should have their own credentials.


I'm not sure what you mean by windows specific. Active Directory provides a LDAP interface to work with it. Most of the information AD provides can be queried using that interface.

Microsoft has various articles that go into detail as to how it works and what's important. For instance:

By default AD wouldn't/shouldn't accept anonymous connections which can be changed. If they are enabled ACLs might limit what you're able to query for. In order to test this you migth be able to use ADSI edit or another LDAP tool. Access to RootDSE should be possible.

  • Most of the information OP asks for isn't part of the RootDSE though. – grawity Sep 25 '18 at 7:58
  • @grawity you're right that a lot of the information he likely wants won't be accessible, if nobody changed the AD configuration, but his initial question is whenever you can interact with the AD without having an account. The answer to that question is yes. How valuable the obtainable information is depends on the specific AD configuration (which is also being pointed out). – Seth Sep 25 '18 at 10:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.