dsquery is a Windows command-line tool for querying Active Directory objects such as users, groups, computers, and OUs. Attackers use it for directory discovery and target selection before lateral movement, so defenders should monitor unusual directory enumeration, limit administrative access, and review scripts that query AD at scale.
What dsquery Does in Active Directory
dsquery is a command-line utility for searching Active Directory objects, such as users, groups, computers and organizational units. Because it can enumerate directory structure quickly, it is often useful for administration, and equally useful for reconnaissance when abused.
Why dsquery Matters to Security Operations
Directory query tools matter because they reveal how an environment is organised, who belongs where, and which hosts or groups may be worth targeting next. A single query can expose patterns that support follow-on abuse, especially when an attacker is already operating inside the network.
That makes dsquery part of the broader class of living-off-the-land activity, where built-in administrative utilities are used to avoid dropping obvious malware. Living off the Land Guide covers how dual-use tools, command-line auditing and hardening help defenders spot that pattern.
How Defenders Recognise Legitimate and Suspicious Use
In normal administration, dsquery tends to appear in approved scripts, helpdesk workflows, inventory tasks or troubleshooting routines. Suspicion rises when it is used from unusual endpoints, by accounts that do not normally perform directory administration, or in bursts that suggest broad enumeration rather than a focused operational task.
Monitoring should therefore look for scale, timing and context, not just the presence of the command. Large-volume directory enumeration, repeated targeting of privileged groups, or use immediately before remote access or lateral movement attempts can indicate hostile discovery.
What Exposure dsquery Can Reveal
Even though dsquery does not modify objects, it can expose the information an attacker needs to plan the next step. That includes group membership, naming conventions, computer placement, and which organisational units are likely to contain high-value systems or delegated administration paths.
When this kind of reconnaissance is paired with credential access or privilege abuse, directory data becomes an enabler for escalation and movement. MITRE ATT&CK Enterprise Matrix is a useful reference for mapping those discovery and follow-on techniques, while NIST SP 800-207 Zero Trust Architecture reinforces the need to treat directory visibility and access paths as sensitive control points.
Risk and Threat Considerations
dsquery becomes risky when directory enumeration is allowed to proceed unnoticed, because attackers can use it to map privilege relationships and identify the best targets for later abuse. The tool is especially valuable after an initial foothold, when built-in utilities help blend into routine Windows activity.
Failure mechanism: Excessive or unmonitored Active Directory queries provide an attacker with rapid discovery of users, groups, computers and OUs, which shortens the path to privilege targeting and lateral movement.
Impact: Organisations may lose visibility into reconnaissance activity before a larger compromise develops, making containment harder and increasing the chance that privileged accounts, sensitive hosts or administrative workflows are selected for attack.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1087 — Account Discovery | dsquery supports discovery of AD accounts and groups before later attack steps. |
| T1018 — Remote System Discovery | Directory queries often enumerate computers and hosts to support target selection. | |
| Recommendation — Map dsquery-heavy enumeration to T1087 and alert on unusual discovery patterns. Correlate dsquery host discovery with staging activity and suspicious host enumeration. | ||
| NIST CSF 2.0 | DE.CM-01 — Anomalies and Events Are Monitored | Unexpected directory enumeration is a detectable security event that should be monitored. |
| Recommendation — Monitor directory-query spikes and investigate deviations from normal administrative use. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Audit review is needed to detect abnormal command-line directory enumeration and related abuse. |
| AC-6 — Least Privilege | Restrict who can enumerate directory data and where privileged querying is permitted. | |
| Recommendation — Review command and authentication logs for unusual dsquery activity. Limit dsquery use to accounts and systems that genuinely need directory enumeration. | ||
Practitioner Guidance
What to watch for: Treat dsquery as a normal administration utility that still deserves detection logic. The most useful signal is not the command alone, but whether it appears in a reasonable administrative context, from approved hosts, and at a volume consistent with the task.
Governance implication: Teams should define who is allowed to run directory-query tooling, where it may run, and what logging is required when it is used at scale. That makes it easier to distinguish legitimate administration from reconnaissance without blocking ordinary operations.
Practitioner takeaway: The best control is not to forbid directory queries outright, but to make unusual enumeration noisy, attributable and reviewable.