I'm exploring the Bloodhound Active Directory reconnaissance tool. There are few labels in this tool such as "AdminTo, MemberOf, HasSession" the first two is obvious to me. However, I didn't get the concept of "HasSession". Does it mean a user has RDP connection on that machine or executed something on that machine with psexec or totally something else?

closed as off-topic by Tobi Nary, ISMSDEV, Serge Ballesta, Rory Alsop Nov 10 '17 at 23:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Tobi Nary, ISMSDEV, Serge Ballesta, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.


This corresponds to the "User-Hunter" Powerview script that finds admins who are authenticated to resources. Yes, I have confirmed that only RDP sessions are logged, and not PSExec or any other sessions, which is unfortunate, because those sessions are often just as valuable.

However, you can find SMB sessions using the PSLoggedon.exe Sysinternals tool. The Nmap script "smb-enum-sessions.nse" uses the same method and may also work.

Not the answer you're looking for? Browse other questions tagged or ask your own question.