Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

Selecting LSA bruteforcing or SAMR enumeration exclusively

These techniques use different mechanisms to attempt to list valid users of a system and each have their own advantages and disadvantages. In general, LSA lookups are noisier but you can select what technique to use when enumerating users by setting the script argument samronly or lsaonly:

$ nmap -sU -p137 --script smb-enum-users --script-args lsaonly=true <target>$ nmap -sU -p137 --script smb-enum-users --script-args samronly=true <target>