Identify Domain Controllers

Technique Info

Identify Domain Controllers using nmcli

Command

nmcli dev show eth1

Identify Domain Controllers using nmap

Command

nmap -p 88 --open <ip_range>

Identify Domain Controllers Using dig

Command

nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain>

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "active-directory") OR contains(tags, "enumeration") OR contains(tags, "dns")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

enumeration

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "enumeration")
SORT file.ctime DESC

dns

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "dns")
SORT file.ctime DESC