# AD Domain and DC Discovery

> Techniques for enumerating AD domains and locating Domain Controllers using DNS, LDAP, and native Windows tools during initial reconnaissance.

- **URL:** https://hackindex.io/platforms/active-directory/reconnaissance/ad-domain-and-dc-discovery
- **Path:** Active Directory > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/active-directory/reconnaissance.md)
- **Published:** 2026-06-09
- **Updated:** 2026-08-11

The first goal on an AD engagement is identifying the domain name, finding domain controllers, and mapping the network topology: all before you have any credentials. DCs expose several distinctive ports (88, 389, 445, 3268) and respond to DNS queries that reveal the domain structure.

- Port scanning for DC-specific services (Kerberos 88, LDAP 389, GC 3268)
- DNS SRV record queries for `_ldap._tcp` and `_kerberos._tcp`
- Anonymous rootDSE queries for domain naming context and functional level
- Authenticated enumeration for domain SID, DC list, and trust relationships

## Identify domain controllers from the network

Domain controllers run Kerberos (88), LDAP (389/636), Global Catalog (3268/3269), and SMB (445). A targeted port scan finds them quickly. nxc also labels hosts as `(PDC)` or `(DC)` in SMB output.

**Scan for DC-specific ports**

```bash
# Quick DC fingerprint: ports that only DCs run
nmap -p 88,389,445,3268 $TARGET_SUBNET/24 --open -oG - | grep 'open'

# Full DC port set
nmap -p 53,88,135,139,389,445,464,636,3268,3269,5985 $TARGET_SUBNET/24 --open

# nxc sweep: flags domain controllers explicitly
nxc smb $TARGET_SUBNET/24

# nxc: list only DCs
nxc smb $TARGET_SUBNET/24 | grep 'DC'
# SMB  10.10.10.10  445  DC01  [*] Windows Server 2019 x64 (name:DC01) (domain:corp.local) (signing:True) (SMBv1:False) (DC) (PDC)
# SMB  10.10.10.11  445  DC02  [*] Windows Server 2019 x64 (name:DC02) (domain:corp.local) (signing:True) (SMBv1:False) (DC)
```

## DNS-based domain discovery

AD registers SRV records in DNS. Querying `_ldap._tcp` and `_kerberos._tcp` SRV records reveals all DCs and the domain name without touching any AD-specific port.

**Discover domain via DNS SRV records**

```bash
# Discover domain name and DC from DNS
nslookup -type=SRV _ldap._tcp $TARGET_IP
nslookup -type=SRV _kerberos._tcp $TARGET_IP

# dig equivalent
dig SRV _ldap._tcp.corp.local @$TARGET_IP
dig SRV _kerberos._tcp.corp.local @$TARGET_IP
dig SRV _gc._tcp.corp.local @$TARGET_IP

# Enumerate all _msdcs records (DC locator)
dig any _msdcs.corp.local @$TARGET_IP

# Reverse lookup DC IP to get hostname
nslookup $TARGET_IP $TARGET_IP
# _ldap._tcp.corp.local  600  IN  SRV  0 100 389 dc01.corp.local.
# _kerberos._tcp.corp.local  600  IN  SRV  0 100 88 dc01.corp.local.
```

## LDAP anonymous info: no credentials needed

LDAP exposes the `rootDSE` object anonymously on every DC. This returns the domain naming context, forest name, DC hostname, and domain functional level without any authentication.

**Query rootDSE anonymously**

```bash
# Dump rootDSE: no credentials
ldapsearch -x -H ldap://$TARGET_IP -b '' -s base

# Key attributes: defaultNamingContext, rootDomainNamingContext, ldapServiceName
ldapsearch -x -H ldap://$TARGET_IP -b '' -s base '(objectClass=*)' defaultNamingContext rootDomainNamingContext ldapServiceName dnsHostName domainFunctionality

# nxc
nxc ldap $TARGET_IP
# defaultNamingContext: DC=corp,DC=local
# rootDomainNamingContext: DC=corp,DC=local
# ldapServiceName: corp.local:dc01$@CORP.LOCAL
# dnsHostName: dc01.corp.local
# domainFunctionality: 7
```

## Authenticated enumeration: domain info with credentials

Once you have any valid credential (even a low-privilege user), extract the domain SID, list all DCs, and get the full forest structure.

**Domain info with credentials**

```bash
# Domain SID: required for ticket forging
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --get-sid

# List all domain controllers
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --dc-list

# BloodyAD: domain info
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get domain

# All DC computer objects
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search \
  --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' \
  --attr dNSHostName operatingSystem operatingSystemVersion whenCreated

# Domain trusts
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get trusts

# nxc: enumerate trusts
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --trusted-for-delegation
# SMB  10.10.10.10  445  DC01  Domain SID: S-1-5-21-1234567890-0987654321-1122334455
# LDAP  10.10.10.10  389  DC01  dc01.corp.local - Windows Server 2019 (PDC)
# LDAP  10.10.10.10  389  DC01  dc02.corp.local - Windows Server 2019
```

**rpcclient: domain info without LDAP**

```bash
# Domain info via RPC (null session may work)
rpcclient -U "" -N $TARGET_IP -c "lsaquery"
rpcclient -U "$USER%$PASSWORD" $TARGET_IP -c "lsaquery"

# List DCs
rpcclient -U "$USER%$PASSWORD" $TARGET_IP -c "dsr_getdcname $DOMAIN"

# Domain users count
rpcclient -U "$USER%$PASSWORD" $TARGET_IP -c "querydominfo"
```

With domain name, DC IPs, and domain SID in hand, proceed to [AD Object Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-object-enumeration) for users, groups, and computers, and [BloodHound Collection](https://hackindex.io/platforms/active-directory/enumeration/bloodhound-and-sharphound-collection) to map attack paths.

## References

- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - smb sweep for DC identification, ldap --get-sid and --dc-list
- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - get domain, get trusts, get search for DC computer objects
- [Impacket: GitHub](https://github.com/fortra/impacket) - general AD interaction reference