Windows - List Windows shares remotely from Linux

[Resheph]

If you need to see which shares a Windows host has available and you have login information for that server you can use the linux smbclient tool.
You don't have to state a domain even though the Windows host is in a domain or as in this case, you request the SMB shares on the AD server itself.

[email protected]:~# smbclient --list=mainadserver --user=lanadmin
Enter WORKGROUP\lanadmin's password: 

    Sharename       Type      Comment
    ---------       ----      -------
    ADMIN$          Disk      Remote Admin
    C$              Disk      Default share
    CertEnroll      Disk      Active Directory Certificate Services share
    Company         Disk      Company
    File History Backups Disk      File History Backups
    Folder Redirection Disk      Folder Redirection
    IPC$            IPC       Remote IPC
    NETLOGON        Disk      Logon server share 
    Shared Folders  Disk      
    SYSVOL          Disk      Logon server share 
    Users           Disk      Users
Reconnecting with SMB1 for workgroup listing.

    Server               Comment
    ---------            -------

    Workgroup            Master
    ---------            -------
[email protected]:~#

The hostname of the server is "mainadserver" and the uesrname is "lanadmin". The smbclient tool will prompt you for a valid password.