Overview
Retrieve information about SCCM sites by querying Active Directory via LDAP. This command identifies potential site servers by examining permissions on the System Management container.Syntax
Parameters
Target Active Directory domain FQDN
Examples
Required Permissions
Domain\Authenticated Users - Standard LDAP read access to Active Directory
Technical Details
Detection Method
Detection Method
This command queries LDAP for computer accounts with GenericAll (Full Control) permissions on the System Management container in Active Directory. Systems with this permission are typically SCCM site servers, as they need these rights to manage the container.
Detection Points
Detection Points
Security teams can monitor for:
- LDAP queries to domain controllers
- Enumeration of System Management container permissions
- Computer account privilege analysis
- Queries for
CN=System Management,CN=System,DC=domain,DC=com
Output Format
The command identifies computer accounts with elevated permissions:Analysis and Next Steps
Site Server Identification
Site Server Identification
Computer accounts with GenericAll permissions are strong indicators of:
- Primary site servers hosting SMS Provider role
- Central Administration Sites (CAS) in hierarchies
- Secondary site servers in some configurations
Infrastructure Mapping
Infrastructure Mapping
Use the identified servers for:
- SMS Provider connections for WMI operations
- Management point identification
- Site hierarchy mapping
- Network topology understanding
Common Use Cases
Initial Reconnaissance
Initial Reconnaissance
First command to run when discovering SCCM infrastructure in a domain - provides entry points for further enumeration.
Site Hierarchy Discovery
Site Hierarchy Discovery
In multi-site environments, identify all site servers and understand the organizational structure.
Attack Surface Analysis
Attack Surface Analysis
Discover SCCM infrastructure components for security assessment and penetration testing.
Integration with Other Commands
Use discovered site servers with other SharpSCCM commands:Related Commands
local site-info- Get local client site configurationget site-push-settings- Analyze client push configurationget admins- Enumerate SCCM administrators