Solved

ONE network -- MULTIPLE Winodws 2012 domains ?

Posted on 2016-09-16
1
41 Views
Last Modified: 2016-09-24
What tool can I run on each VLAN to find out all the possible MULTIPLE domains I have on the ONE location we purchased since there is NO documentation and some test domains/etc might be setup that I am not aware of ?
0
Comment
Question by:finance_teacher
1 Comment
 
LVL 14

Accepted Solution

by:
Schnell Solutions earned 500 total points
ID: 41801743
Interesting :)

You will need to use one of these tools that scan the network and look for specific ports/services/applications.

If the network analyzer tool does not include such features, you will need to work with this manually. For example, if you find servers listening through the port TCP 389 it means that you have an LDAP service there, or if you get UDP 88 you know that you have a Kerberos Realm (Both ports are open by Domain Controllers). Therefore, a server that is running Active Directory is there (Unless it is an LDAP linux server or a different application working within that port).

Additionally, domains by default, broadcast information of their domain name into the same network segment where they are. (Like a WorkGroup does), so.. if you have a system capturing this information you can display it with the NetBios cache of a Windows PC or server. For example: net view. However, you can make it just within the same network segment, or against a WINS server if used (Conclusion... for this approach, use the same network segment).

Another example could be to scan for servers working as DNS servers (Listening on port UDP 53). After you detect these DNS servers you know that you have a service which is a dependency for AD (however, sometimes the DNS server is the same domain controller, or a DNS server can work as a service for AD at a different network. Therefore, it is better to search for the AD ports and services using the first options. If you know the domain name, you can take one of these DNS servers and run a simple query against them, like this:

(Example using nslookup)
nslookup    
set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME
0

Join & Write a Comment

The article will show you how you can maintain a simple logfile of all Startup and Shutdown events on Windows servers and desktops with PowerShell. The script can be easily adapted into doing more like gracefully silencing/updating your monitoring s…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now