Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

ONE network -- MULTIPLE Winodws 2012 domains ?

Posted on 2016-09-16
1
Medium Priority
?
78 Views
Last Modified: 2016-09-24
What tool can I run on each VLAN to find out all the possible MULTIPLE domains I have on the ONE location we purchased since there is NO documentation and some test domains/etc might be setup that I am not aware of ?
0
Comment
Question by:finance_teacher
1 Comment
 
LVL 14

Accepted Solution

by:
Schnell Solutions earned 2000 total points
ID: 41801743
Interesting :)

You will need to use one of these tools that scan the network and look for specific ports/services/applications.

If the network analyzer tool does not include such features, you will need to work with this manually. For example, if you find servers listening through the port TCP 389 it means that you have an LDAP service there, or if you get UDP 88 you know that you have a Kerberos Realm (Both ports are open by Domain Controllers). Therefore, a server that is running Active Directory is there (Unless it is an LDAP linux server or a different application working within that port).

Additionally, domains by default, broadcast information of their domain name into the same network segment where they are. (Like a WorkGroup does), so.. if you have a system capturing this information you can display it with the NetBios cache of a Windows PC or server. For example: net view. However, you can make it just within the same network segment, or against a WINS server if used (Conclusion... for this approach, use the same network segment).

Another example could be to scan for servers working as DNS servers (Listening on port UDP 53). After you detect these DNS servers you know that you have a service which is a dependency for AD (however, sometimes the DNS server is the same domain controller, or a DNS server can work as a service for AD at a different network. Therefore, it is better to search for the AD ports and services using the first options. If you know the domain name, you can take one of these DNS servers and run a simple query against them, like this:

(Example using nslookup)
nslookup    
set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question