Domain controller discovery through LDAP identifies the machines that hold directory services and Kerberos authority. We use these results to pick reliable LDAP, Kerberos, SMB, DNS, and replication targets.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Domain controller computer objects:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' name dNSHostName operatingSystem servicePrincipalName userAccountControl
Domain controller SPNs:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(objectCategory=computer)(servicePrincipalName=LDAP/*))' name dNSHostName servicePrincipalName
Domain object and SID:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(objectClass=domain)' distinguishedName objectSid
DNS SRV lookup:
nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN $DC
nslookup -type=SRV _kerberos._tcp.dc._msdcs.$DOMAIN $DC
nxc ldap $DC -d OOTW -u $USER -p "$PASS" --dns
nxc smb $DC -d OOTW -u $USER -p "$PASS"
PowerShell:
Get-ADDomainController -Filter * | Select-Object HostName,Site,IPv4Address,OperatingSystem
Get-ADComputer -LDAPFilter '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' -Properties dNSHostName,servicePrincipalName