[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

ONE network -- MULTIPLE Winodws 2012 domains ?

Posted on 2016-09-16
1
Medium Priority
?
80 Views
Last Modified: 2016-09-24
What tool can I run on each VLAN to find out all the possible MULTIPLE domains I have on the ONE location we purchased since there is NO documentation and some test domains/etc might be setup that I am not aware of ?
0
Comment
Question by:finance_teacher
1 Comment
 
LVL 14

Accepted Solution

by:
Schnell Solutions earned 2000 total points
ID: 41801743
Interesting :)

You will need to use one of these tools that scan the network and look for specific ports/services/applications.

If the network analyzer tool does not include such features, you will need to work with this manually. For example, if you find servers listening through the port TCP 389 it means that you have an LDAP service there, or if you get UDP 88 you know that you have a Kerberos Realm (Both ports are open by Domain Controllers). Therefore, a server that is running Active Directory is there (Unless it is an LDAP linux server or a different application working within that port).

Additionally, domains by default, broadcast information of their domain name into the same network segment where they are. (Like a WorkGroup does), so.. if you have a system capturing this information you can display it with the NetBios cache of a Windows PC or server. For example: net view. However, you can make it just within the same network segment, or against a WINS server if used (Conclusion... for this approach, use the same network segment).

Another example could be to scan for servers working as DNS servers (Listening on port UDP 53). After you detect these DNS servers you know that you have a service which is a dependency for AD (however, sometimes the DNS server is the same domain controller, or a DNS server can work as a service for AD at a different network. Therefore, it is better to search for the AD ports and services using the first options. If you know the domain name, you can take one of these DNS servers and run a simple query against them, like this:

(Example using nslookup)
nslookup    
set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME
0

Featured Post

Learn to develop an Android App

Want to increase your earning potential in 2018? Pad your resume with app building experience. Learn how with this hands-on course.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

591 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question