Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 83
  • Last Modified:

ONE network -- MULTIPLE Winodws 2012 domains ?

What tool can I run on each VLAN to find out all the possible MULTIPLE domains I have on the ONE location we purchased since there is NO documentation and some test domains/etc might be setup that I am not aware of ?
0
finance_teacher
Asked:
finance_teacher
1 Solution
 
Schnell SolutionsSystems Infrastructure EngineerCommented:
Interesting :)

You will need to use one of these tools that scan the network and look for specific ports/services/applications.

If the network analyzer tool does not include such features, you will need to work with this manually. For example, if you find servers listening through the port TCP 389 it means that you have an LDAP service there, or if you get UDP 88 you know that you have a Kerberos Realm (Both ports are open by Domain Controllers). Therefore, a server that is running Active Directory is there (Unless it is an LDAP linux server or a different application working within that port).

Additionally, domains by default, broadcast information of their domain name into the same network segment where they are. (Like a WorkGroup does), so.. if you have a system capturing this information you can display it with the NetBios cache of a Windows PC or server. For example: net view. However, you can make it just within the same network segment, or against a WINS server if used (Conclusion... for this approach, use the same network segment).

Another example could be to scan for servers working as DNS servers (Listening on port UDP 53). After you detect these DNS servers you know that you have a service which is a dependency for AD (however, sometimes the DNS server is the same domain controller, or a DNS server can work as a service for AD at a different network. Therefore, it is better to search for the AD ports and services using the first options. If you know the domain name, you can take one of these DNS servers and run a simple query against them, like this:

(Example using nslookup)
nslookup    
set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now