Safe AD Enumeration Under Scope