> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/dc-enumeration-locally.md).

# DC Enumeration Locally

## List Domain Controllers

### AdFind.exe

To list domain controllers with [AdFind.exe](https://www.joeware.net/freetools/tools/adfind/usage.htm)

```bat
adfind.exe -sc dclist
```

<details>

<summary>Example run</summary>

```bat
Z:\Win_Programs>adfind.exe -sc dclist
Hydra-DC.MARVEL.local
```

</details>

### Get-ADDomainController

To list basic information about domain controllers with [Get-ADDomainController](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addomaincontroller?view=windowsserver2022-ps) from [RSAT](https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools)

```powershell
Get-ADDomainController | select Name, Hostname, ComputerObjectDN, Domain, IPv4Address, OperatingSystem, Site
```

To list standard information

```powershell
Get-ADDomainController 
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\fcastle> Get-ADDomainController                                                                                                 

ComputerObjectDN           : CN=HYDRA-DC,OU=Domain Controllers,DC=MARVEL,DC=local
DefaultPartition           : DC=MARVEL,DC=local
Domain                     : MARVEL.local
Enabled                    : True
Forest                     : MARVEL.local
HostName                   : Hydra-DC.MARVEL.local
InvocationId               : c597f488-9b1f-46db-8c1e-da0b51e62153
IPv4Address                : 192.168.140.129
IPv6Address                :
IsGlobalCatalog            : True
IsReadOnly                 : False
LdapPort                   : 389
Name                       : HYDRA-DC
NTDSSettingsObjectDN       : CN=NTDS
                             Settings,CN=HYDRA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MARVEL,DC=local
OperatingSystem            : Windows Server 2019 Standard Evaluation
OperatingSystemHotfix      :
OperatingSystemServicePack :
OperatingSystemVersion     : 10.0 (17763)
OperationMasterRoles       : {SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster...}
Partitions                 : {DC=ForestDnsZones,DC=MARVEL,DC=local, DC=DomainDnsZones,DC=MARVEL,DC=local,
                             CN=Schema,CN=Configuration,DC=MARVEL,DC=local, CN=Configuration,DC=MARVEL,DC=local...}
ServerObjectDN             : CN=HYDRA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MARVEL,DC=local
ServerObjectGuid           : 6ed6578f-35c3-4f9e-baac-06729cf7a3e6
Site                       : Default-First-Site-Name
SslPort                    : 636

```

</details>

To list all information

```powershell
Get-ADDomainController | select -Property *
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\fcastle> Get-ADDomainController | select -Property *


ComputerObjectDN           : CN=HYDRA-DC,OU=Domain Controllers,DC=MARVEL,DC=local
DefaultPartition           : DC=MARVEL,DC=local
Domain                     : MARVEL.local
Enabled                    : True
Forest                     : MARVEL.local
HostName                   : Hydra-DC.MARVEL.local
InvocationId               : c597f488-9b1f-46db-8c1e-da0b51e62153
IPv4Address                : 192.168.140.129
IPv6Address                :
IsGlobalCatalog            : True
IsReadOnly                 : False
LdapPort                   : 389
Name                       : HYDRA-DC
NTDSSettingsObjectDN       : CN=NTDS
                             Settings,CN=HYDRA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MARVEL,DC=local
OperatingSystem            : Windows Server 2019 Standard Evaluation
OperatingSystemHotfix      :
OperatingSystemServicePack :
OperatingSystemVersion     : 10.0 (17763)
OperationMasterRoles       : {SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster...}
Partitions                 : {DC=ForestDnsZones,DC=MARVEL,DC=local, DC=DomainDnsZones,DC=MARVEL,DC=local,
                             CN=Schema,CN=Configuration,DC=MARVEL,DC=local, CN=Configuration,DC=MARVEL,DC=local...}
ServerObjectDN             : CN=HYDRA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MARVEL,DC=local
ServerObjectGuid           : 6ed6578f-35c3-4f9e-baac-06729cf7a3e6
Site                       : Default-First-Site-Name
SslPort                    : 636
PropertyNames              : {ComputerObjectDN, DefaultPartition, Domain, Enabled...}
AddedProperties            : {}
RemovedProperties          : {}
ModifiedProperties         : {}
PropertyCount              : 24

```

</details>

### Get-DomainController

[Get-DomainController](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetDomainController`.

Import the module

```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```

To list the most interesting information about the domain controllers for the current domain

```powershell
Get-DomainController | Select-Object Name, Domain, IPAddress, OSVersion, SiteName, Roles
```

To list **all** information about the domain controllers for the current domain

```powershell
Get-DomainController
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools> Get-DomainController


Forest                     : corp.com
CurrentTime                : 4/18/2026 8:40:15 AM
HighestCommittedUsn        : 557543
OSVersion                  : Windows Server 2022 Standard
Roles                      : {SchemaRole, NamingRole, PdcRole, RidRole...}
Domain                     : corp.com
IPAddress                  : 192.168.105.70
SiteName                   : Default-First-Site-Name
SyncFromAllServersCallback :
InboundConnections         : {}
OutboundConnections        : {}
Name                       : DC1.corp.com
Partitions                 : {DC=corp,DC=com, CN=Configuration,DC=corp,DC=com, CN=Schema,CN=Configuration,DC=corp,DC=com, DC=DomainDnsZones,DC=corp,DC=com...}

```

</details>

### netdom.exe

To list domain controllers with [netdom.exe](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netdom-query) from [RSAT](https://www.microsoft.com/en-us/download/details.aspx?id=45520)

```bat
netdom.exe query dc
```

<details>

<summary>Example run</summary>

```bat
PS C:\Users\fcastle> netdom.exe query dc
List of domain controllers with accounts in the domain:

HYDRA-DC
The command completed successfully.
```

</details>

To list the primary domain controller

```bat
netdom.exe query pdc
```

<details>

<summary>Example run</summary>

```bat
PS C:\Users\fcastle> netdom.exe query pdc
Primary domain controller for the domain:

HYDRA-DC
The command completed successfully.
```

</details>

To list [FSMO (Flexible Single Master Operation) roles](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/fsmo-roles) in Active Directory

```bat
netdom.exe query fsmo
```

<details>

<summary>Example run</summary>

```bat
PS C:\Users\fcastle> netdom.exe query fsmo
Schema master               Hydra-DC.MARVEL.local
Domain naming master        Hydra-DC.MARVEL.local
PDC                         Hydra-DC.MARVEL.local
RID pool manager            Hydra-DC.MARVEL.local
Infrastructure master       Hydra-DC.MARVEL.local
The command completed successfully.
```

</details>

### nltest.exe

To list domain controllers with [nltest.exe](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935\(v=ws.11\))

```bat
nltest.exe /dclist:
```

<details>

<summary>Example run</summary>

```bat
PS C:\Users\fcastle> nltest.exe /dclist:
Get list of DCs in domain '' from '\\Hydra-DC.MARVEL.local'.
    Hydra-DC.MARVEL.local [PDC]  [DS] Site: Default-First-Site-Name
The command completed successfully
```

</details>

## Resources

Active Directory - Enumeration - Internal All The Things: <https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adds-enumerate/>

**AdFind** - Docs: <https://www.joeware.net/freetools/tools/adfind/usage.htm>

**Get-ADDomainController** - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addomaincontroller?view=windowsserver2022-ps>

**Get-DomainController** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/>

**Netdom query** - Microsoft Learn: <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc835089(v=ws.11)>

**Nltest** - Microsoft Learn: <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731935(v=ws.11)>

**Remote Server Administration Tools** (RSAT) for Windows - Microsoft Learn: <https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools>