Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I find out the name/IP address of the AD domain controller on my network?

share|improve this question

6 Answers 6

up vote 71 down vote accepted

On any computer, that has DNS configured to use AD's DNS server do:

Start -> Run -> nslookup    
set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME

Replace DOMAIN_NAME with actual domain name i.e. contoso.com. Read more here.

share|improve this answer

For a computer that is a member of a domain the Environment Variable LOGONSERVER contains the name of the DC that authenticated the current user. This is obviously not going to be all DC's in a multi-DC environment but if all you want is a quick way to find the name of a Domain Controller then from a command shell:

set l <enter>

Will return all Environment variables that start with "L" including the name of a DC.

share|improve this answer
    
+1 for simplicity. After obtaining the name of the DC, just ping it to get the IP. –  Bigbio2002 Jan 9 '13 at 1:40

This will return your closest Domain Controller in Powershell:

Import-Module ActiveDirectory
(Get-ADDomainController -DomainName <Domain FQDN> -Discover -NextClosestSite).HostName
share|improve this answer

From a command prompt, run gpresult. You will get:

  • General workstation and domain information
  • Computer distinguished name in AD and which DC the policy was applied from
  • List of computer applied Group Policy objects
  • List of security groups the computer is a member of
  • User distinguished name in AD and which DC the policy was applied from
  • List of user applied Group Policy objects
  • List of security groups the user is a member of

Here is example output of running gpresult. You can also specify gpresult /z to get more detailed information.

share|improve this answer
1  
Wow, gpresult /Z outputs a LOT of data. Thanks. –  friederbluemle Feb 12 '14 at 9:53

DNS should be there exactly for this purpose.

http://support.microsoft.com/kb/816587/en-us
http://www.petri.co.il/active%5Fdirectory%5Fsrv%5Frecords.htm

share|improve this answer
    
This is in my book the best way since active directory is nothing more than microsoft's version of Kerberos, LDAP, dhcp and dns. –  Dwight Spencer 5 hours ago

DNS and DHCP are the best way to check since there can be Unix/Linux machines on the network managed by the AD domain controller or acting as the domain controller.

Plus, considering active directory is nothing more than Microsoft's version of Kerberos, LDAP, dhcp and dns. It would be better to understand and debug things at lower layers than layer 7+. This is because the operating system would preform these same requests and the underlining RFC for each protocol actually operates at a OSI level not the "insert favorite tool here" level.

One can go a step further and query the dhcp for options 6, 15, and 44 to get the domain name, domain name server, and Wins/NetBIOS name server.

Then using dns to check for the _kerberos._tcp, _kpasswd._tcp, _LDAP._TCP.dc._msdcs, and _ldap._tcp SRV records:

nslookup -type=srv _kerberos._tcp.EXMAPLE.COM
nslookup -type=srv _kpasswd._tcp.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.dc._msdcs.EXAMPLE.COM

.EXAMPLE.COM ::= value returned from dhcp option-1

This breaks down into three areas, two are protocol supported DNS-SD records:

  • _kerberos._tcp and _kpasswd._tcp (also under UNIX/Linux/OSX+some windows networks has _kadmin._tcp) are for kerberos
  • _ldap._tcp is for ldap (openldap, opendc, sun/oracle directory, ms ad) _LDAP._TCP.dc._msdcs is the Microsoft only extension to ldap to map the domain controller.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.