> For the complete documentation index, see [llms.txt](https://xedex.gitbook.io/internalpentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://xedex.gitbook.io/internalpentest/internal-pentest/active-directory/domain-name-and-domain-controllers.md).

# Reconnaissance

This page discusses ways of finding Domain names and Domain Controllers ... with or without a domain user, depending on the situation you're in.

 This section can be used before and after the initial attack vectors

### Using simple CMD

#### Domain name

```
ipconfig /all
```

#### Domain Controllers

```
nslookup <domain>
```

```
nltest /dclist:{domainname}
```

```
echo %logonserver%
```

## On Linux

#### Domain name

```
cat /etc/resolv.conf
```

Or scan machines with CrackMapExec:

```
cme smb 192.168.12.0/24
```

#### Domain controller

As domain controllers are often DNS Servers, you can simply use these commands:

```bash
systemd-resolve --status | grep "DNS Servers"
```

or :

```bash
nmcli dev show | grep DNS
```

For more, i suggest to visit @aas notebook here :

{% embed url="<https://lydericlefebvre.gitbook.io/cheatsheet/internalpentest/active-directory/reconnaissance>" %}