0

I am going to be demoting some DC's and want to see if there is a way via wireshark or netstat or something to see if a server might be out there that has statically mapped to them for LDAP queries.

Thanks

Improve this question

1 Answer 1

Reset to default
2

Unfortunately no - from that DC, you cannot tell which machines are hitting it via LDAP because they queried DNS to get any LDAP server, or which machines are hitting it because they are configured to hit only it.

Using one of those tools, you could determine which machines are using it for LDAP in the first place, but that won't tell you why they are querying it, or which applications are doing so.

In the future, if you maintain this environment long term, it's best to use documentation and standards so that you will know for sure which DCs are being used for LDAP queries by applications that can't simply query DNS or AD for a list of them.

For DNS, you can turn on logging and you'll know that any clients in the logs need to be reconfigured.

Here's a more general approach to the overall topic of "How do I decommission a server that might still be in use?" : How to identify who/what uses a Windows 2003 server?

Improve this answer
3
  • how about if servers have it as DNS?
    – Doms
    Feb 3, 2015 at 1:25
  • That's easy - DNS works by IP address, not by, well, DNS, so anything using it for DNS is configured to do so. Turn on DNS logging on it and then fix any clients you see.
    – mfinni
    Feb 3, 2015 at 1:26
  • Please see my edits to my answer.
    – mfinni
    Feb 3, 2015 at 1:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .