Solved

ONE network -- MULTIPLE Winodws 2012 domains ?

Posted on 2016-09-16
1
48 Views
Last Modified: 2016-09-24
What tool can I run on each VLAN to find out all the possible MULTIPLE domains I have on the ONE location we purchased since there is NO documentation and some test domains/etc might be setup that I am not aware of ?
0
Comment
Question by:finance_teacher
1 Comment
 
LVL 14

Accepted Solution

by:
Schnell Solutions earned 500 total points
ID: 41801743
Interesting :)

You will need to use one of these tools that scan the network and look for specific ports/services/applications.

If the network analyzer tool does not include such features, you will need to work with this manually. For example, if you find servers listening through the port TCP 389 it means that you have an LDAP service there, or if you get UDP 88 you know that you have a Kerberos Realm (Both ports are open by Domain Controllers). Therefore, a server that is running Active Directory is there (Unless it is an LDAP linux server or a different application working within that port).

Additionally, domains by default, broadcast information of their domain name into the same network segment where they are. (Like a WorkGroup does), so.. if you have a system capturing this information you can display it with the NetBios cache of a Windows PC or server. For example: net view. However, you can make it just within the same network segment, or against a WINS server if used (Conclusion... for this approach, use the same network segment).

Another example could be to scan for servers working as DNS servers (Listening on port UDP 53). After you detect these DNS servers you know that you have a service which is a dependency for AD (however, sometimes the DNS server is the same domain controller, or a DNS server can work as a service for AD at a different network. Therefore, it is better to search for the AD ports and services using the first options. If you know the domain name, you can take one of these DNS servers and run a simple query against them, like this:

(Example using nslookup)
nslookup    
set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

943 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now