A library engagement needs a foundation for later AD attack-path planning. Which enumeration class best builds that map?

For a library engagement that needs a foundation for later AD attack-path planning, systematic enumeration of domain users, computers, and groups best builds that relationship map. External website spidering alone cannot chart internal directory relationships. Exclusive focus on printer firmware without listing users, computers, or groups misses the identity graph. Random local file encryption tests on a single workstation are not a substitute for directory mapping and may be destructive. Exam caveat: path analysis starts with accurate principal and group inventory under authorization. Operational check: collect in-scope directory objects with approved tools, store results in the engagement vault, begin relationship analysis for high-value paths, and defer exploit-oriented techniques until the map justifies them. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.