# Reconnaissance

> Discover AD domains, DCs, and users without credentials

- **URL:** https://hackindex.io/platforms/active-directory/reconnaissance
- **Platform:** [Active Directory](https://hackindex.io/platforms/active-directory.md)
- **Published:** 2026-06-09
- **Updated:** 2026-08-11

AD reconnaissance gathers domain information without direct interaction with the target environment. This means passive DNS lookups, public certificate transparency logs, and metadata leakage from exposed documents and services.

DNS records reveal domain controller hostnames, mail servers, and naming conventions. Certificate transparency databases expose internal hostnames and subdomain structures registered through public CAs. Metadata from publicly accessible documents, job postings, and code repositories can leak internal domain names, usernames, and software versions.

## Guides

- [AD Domain and DC Discovery](https://hackindex.io/platforms/active-directory/reconnaissance/ad-domain-and-dc-discovery.md): Techniques for enumerating AD domains and locating Domain Controllers using DNS, LDAP, and native Windows tools during initial reconnaissance.
- [Unauthenticated User Enumeration](https://hackindex.io/platforms/active-directory/reconnaissance/ad-unauthenticated-user-enumeration.md): Identifies valid AD usernames without credentials using Kerberos pre-auth errors, LDAP null binds, and SMB probing to map attack surface.