I am going to be demoting some DC's and want to see if there is a way via wireshark or netstat or something to see if a server might be out there that has statically mapped to them for LDAP queries.



Unfortunately no - from that DC, you cannot tell which machines are hitting it via LDAP because they queried DNS to get any LDAP server, or which machines are hitting it because they are configured to hit only it.

Using one of those tools, you could determine which machines are using it for LDAP in the first place, but that won't tell you why they are querying it, or which applications are doing so.

In the future, if you maintain this environment long term, it's best to use documentation and standards so that you will know for sure which DCs are being used for LDAP queries by applications that can't simply query DNS or AD for a list of them.

For DNS, you can turn on logging and you'll know that any clients in the logs need to be reconfigured.

Here's a more general approach to the overall topic of "How do I decommission a server that might still be in use?" : How to identify who/what uses a Windows 2003 server?

  • how about if servers have it as DNS? – Doms Feb 3 '15 at 1:25
  • That's easy - DNS works by IP address, not by, well, DNS, so anything using it for DNS is configured to do so. Turn on DNS logging on it and then fix any clients you see. – mfinni Feb 3 '15 at 1:26
  • Please see my edits to my answer. – mfinni Feb 3 '15 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.