Overview
Enumerate user accounts in SCCM database. This command provides comprehensive user intelligence including domain accounts, login patterns, and user-device relationships.Syntax
Parameters
The IP address, FQDN, or NetBIOS name of the SMS Provider to connect to
The three-character site code (e.g., “PS1”)
Filter users by name pattern (supports partial matching)
Specify properties to retrieve (can be used multiple times)
Custom WQL WHERE clause for advanced filtering
Return count of results only
Display all user properties
Examples
Key Properties
Required Permissions
SMS Admins local group membership on the SMS Provider server
Intelligence Gathering
Administrative Users
Administrative Users
High-Value Targets:Service Accounts:
User Patterns
User Patterns
Naming Conventions:
- Administrative accounts: admin, administrator prefixes
- Service accounts: svc-, service- prefixes
- Personal accounts: firstname.lastname format
- Shared accounts: shared-, team- prefixes
- Multiple domains indicate complex environments
- Domain trust relationships
- Cross-domain user access patterns
Common Queries
Use Cases
Target Identification
Target Identification
High-Privilege Users:
- Domain administrators and privileged accounts
- Service accounts with elevated permissions
- Shared administrative accounts
- Login patterns and frequency
- Account usage patterns
- Dormant or inactive accounts
Attack Planning
Attack Planning
Credential Targeting:
- Focus on administrative and service accounts
- Identify high-value user targets
- Map user privilege relationships
- User-device relationship mapping
- Cross-domain access patterns
- Service account abuse opportunities
Related Commands
get devices- Find devices used by specific usersget primary-users- Map user-device relationshipsget collections- Analyze user collectionsget admins- Enumerate SCCM administrators