Is there a way to determine which machine on an active directory network is the domain controller, if on a computer not logged on to the domain? This is for a penetration test, going in blind.

I've tried looking up the domain (which I know the name of) in nslookup, after setting type to all and running _ldap._tcp.dc._msdcs.Active_Directory_domain_name

I also tried dsdomroleinfo and enumdomains with rpcclient on machines that allowed null sessions.

Is there any easy way to look this up without resorting to sniffing?

  • Afaik most smb client can say this with a simple ask. Linux, samba are your keywords. smbclient -N -L a.b.c.d
    – peterh
    Dec 19, 2014 at 18:07

2 Answers 2


Try type "any" or "SRV"

Did you query for the "any" DNS resource record (wildcard/pseudo) type? (Otherwise the default is to simple query for A records. And the records in question are in fact SRV RRs.)

(Also: you said you used type "all", I don't know if there is such a thing. What any does is translate to a query for resource record type 0x00FF, decimal 255. I checked with Wireshark. This translation is done by your client. I don't know all clients, but I can tell you that dig does NOT know of "type all" and NOT "type *" either and will give you an error. But dig will work nicely if you say "-t any".)

Using dig (if "example.com" is your Active Directory domain name):

dig _ldap._tcp.dc._msdcs.EXAMPLE.COM -t any
dig _ldap._tcp.dc._msdcs.EXAMPLE.COM -t srv

Using the WINDOWS version of nslookup, the type MUST go as first parameter like so:

nslookup -type=any _ldap._tcp.dc._msdcs.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.dc._msdcs.EXAMPLE.COM

Also try just the regular "A" type

Also you can simply dig/nslookup the Active_Directory_DNS_domain_name and this will give you DC-IPs. (Because there's actually A records at that level.)


If you are inside the network, then most likely the DNS server that DHCP assigned to you is a domain controller. If you are using nslookup from outside the network, then you should not be able to look up the domain controller; that information should be only available internally.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.