On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how can it be determined what the Domain Controller is?

Assuming a dedicated DNS server instead of the DC handling DNS

Is there any way to determine what the domain controller is in this scenario?

  • 1
    sniff the wire? clients communicate with the DC pretty regularly in predictable ways
    – schroeder
    Jan 30, 2015 at 23:15
  • @schroeder That's where I lack familiarity. What kind of traffic on what ports am I looking for that would indicate traffic to a DC, as opposed to another windows machine? Jan 30, 2015 at 23:23
  • 1
    The ports for ldap (389 and 636) and kerberos (88) seem like they should be indicators. Feb 7, 2015 at 5:35

4 Answers 4


Jumping on the NMAP bandwagon: also look for machines that have TCP port 389 (LDAP), 636 (LDAPS), 3268 (LDAP Global Catalog), or 3269 (LDAPS Global Catalog). The last two are particularly juicy, since only a DC can be a Global Catalog server.


Sniff for TCP or UDP 88 (Kerberos), amongst others

Or if you have an account on the domain (just in case), from the command prompt run nltest /dclist:yourdomain.com


Look for NetBIOS over TCP broadcasts, NBT


Look for Group Names with 1C , as this indicates the Domain Controllers. I would expect this name to be broadcasted on the same subnet, and be queried on a per machine basis by using NBTSTAT -A IP.


Depending on where the pentest is being launched, one should be able to determine the DC by querying the SRV records for LDAP, Kerberos, GC, etc.

This Microsoft TechNet link has some examples.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .