LDAP enumeration is the act of querying an LDAP directory to discover users, groups, computers, and attribute values. Attackers and administrators use filters and search scopes to map directory structure, identify valid accounts, and learn group membership, which can reveal access paths and privileged identities.
What LDAP enumeration does
LDAP enumeration is more than simple directory searching. It is a structured way to query an LDAP directory for users, groups, computers, and attributes so that a reader can understand what information the directory exposes and how those search results can be used to map access relationships inside an environment.
Because directory data often reflects real account structure, enumeration can reveal naming patterns, privileged groups, service accounts, and other objects that matter to both attackers and defenders. That makes the term relevant to discovery, hardening, and exposure analysis rather than only to directory administration.
How enumeration maps directory structure
LDAP searches are defined by filters, base objects, and search scope. Those parameters determine whether a query returns a narrow set of entries or a broader view of the directory tree, which is why enumeration can be used to infer organisational units, delegated administration boundaries, and where accounts are located.
In practice, even limited attributes can be revealing. A returned object class, group membership field, or computer reference can show how identity data is organised and which relationships exist between people, systems, and access groups.
Why LDAP enumeration is useful to an attacker
Attackers value LDAP enumeration because it reduces guesswork. Instead of probing blindly, they can confirm valid accounts, discover privileged groups, and identify naming conventions that support follow-on activity such as password spraying, targeted phishing, or privilege escalation planning.
It is also useful for understanding the directory’s trust boundaries. A directory query may expose whether a user belongs to administrative groups, whether computers are domain-joined, or whether service identities exist that could support later abuse.
For defenders, the same information is useful because it shows where the directory unintentionally leaks structure. The LDAP Security Deep Dive Guide explains how signing, channel binding, and auditing reduce the value of unauthenticated or lightly protected directory access.
Detection, exposure, and hardening considerations
LDAP enumeration is usually visible through patterns such as repeated search activity, unusual bind behaviour, or queries that target broad directory bases and sensitive groups. Watching for those patterns helps distinguish normal application lookups from reconnaissance.
Defensive review should focus on who can query the directory, how much data each bind can see, and whether anonymous or unsigned access is still enabled. The Discovery and Reconnaissance Techniques Guide and the T1087 and T1069 Account and Permission Group Discovery Defensive Guide place LDAP enumeration in the broader context of account and group discovery detection.
Risk and Threat Considerations
LDAP enumeration creates exposure because it turns directory metadata into intelligence. When search access is too broad, an attacker can map identities, groups, and computers before attempting credential attacks or privilege abuse, which makes later compromise more efficient.
Failure mechanism: Overly permissive search access, weak bind protection, or insufficient logging allows an adversary to query directory objects at scale and extract account and group structure without triggering clear resistance.
Impact: The resulting intelligence can support account discovery, privilege targeting, and lateral movement planning, and it can also expose sensitive group membership or service-account relationships that defenders may not realise are visible.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1087 — Account Discovery | LDAP enumeration directly supports discovering valid accounts and group membership. |
| T1069 — Permission Groups Discovery | Directory searches often reveal groups and membership relationships used for access mapping. | |
| Recommendation — Map LDAP enumeration activity to T1087 and hunt for account discovery patterns in directory logs. Correlate LDAP group queries with T1069 to detect permission group discovery and privilege mapping. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Directory enumeration becomes actionable when audit data can reveal suspicious query patterns. |
| AC-6 — Least Privilege | Restricting directory read access limits how much structure enumeration can expose. | |
| IA-2 — Identification and Authentication (Organizational Users) | Authenticated access to directory services reduces the value of anonymous enumeration paths. | |
| Recommendation — Review LDAP audit events for unusual search scope, repetition, and sensitive object access. Limit directory read permissions so ordinary users and apps can only query the attributes they need. Require strong authenticated access before allowing directory searches that reveal user and group data. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org