166

How can I find out the name/IP address of the AD domain controller on my network?

Improve this question
2

9 Answers 9

Reset to default
173

On any computer, that has DNS configured to use AD's DNS server do:

  • Start -> Run -> nslookup 

    set type=all
_ldap._tcp.dc._msdcs.DOMAIN_NAME

Replace DOMAIN_NAME with the actual domain name e.g. example.com. Read more here.

Improve this answer
3
  • 1
    In the answer above, entering set type=all (in nslookup) allows you to see DNS SRV records. You could also have typed "set type=SRV", SRV records are how AD advertises itself on the network
    – Les
    Oct 26, 2016 at 19:24
  • But how can a Windows user find out real domain name? I see everywhere some stupid consumer friendly name containing whitespace and other strange chars.
    – Tomas Tintera
    Dec 22, 2022 at 8:40
  • nslookup -querytype=all _ldap._tcp.dc._msdcs.eb.eu [as a single line]
    – emirjonb
    Feb 2 at 17:04
82

For a computer that is a member of a domain the Environment Variable LOGONSERVER contains the name of the DC that authenticated the current user. This is obviously not going to be all DC's in a multi-DC environment but if all you want is a quick way to find the name of a Domain Controller then from a command shell:

set l <enter>

Will return all Environment variables that start with "L" including the name of a DC.

Improve this answer
3
  • 7
    +1 for simplicity. After obtaining the name of the DC, just ping it to get the IP.
    – Bigbio2002
    Jan 9, 2013 at 1:40
  • 2
    simple yes, but if you have a VPN connection to the network you are interested in, LOGONSERVER doesn't give you that. The accepted answer will give you the right server in all cases I can think of.
    – Les
    Oct 26, 2016 at 19:19
  • 1
    It's not perfect, but sometimes it's important also to know how to do something that's good enough quickly. It also fails for local logons but I never checked it over VPN, good to know, thanks.
    – Helvick
    Oct 28, 2016 at 20:23
60

An unmentioned, super easy, and quick option is to run this from a command prompt:

nltest /dclist:domainname

Just replace 'domainname' with your domain

You can also run some other options to find out more:

/dcname:domainname gets the PDC name for the domain /dsgetdc:domainname has flags for other information

Try nltest /? in your prompt to get more options! :)

Improve this answer
4
  • C:\> nltest /dclist:domainname Cannot find DC to get DC list from.Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN The command completed successfully What does that mean?
    – jp2code
    Oct 12, 2017 at 16:16
  • 5
    Replace domainname with the name of your domain
    – Abraxas
    Oct 12, 2017 at 16:36
  • Oh. That's what I thought this was going to find for me.
    – jp2code
    Oct 12, 2017 at 17:08
  • This was super useful for me because [Bash# host -t srv _ldap._tcp.MYCOMPANY] said domain not found. [CMD:\> nltest /dclist:MYCOMPANY] told me that the domain name was corp.ad.mycompany.com, and then I was able to use that info to make the other commands work. [Bash# host -t srv _ldap._tcp.corp.ad.mycompany.com] then worked
    – neokyle
    Feb 8, 2019 at 2:33
22

This will return your closest Domain Controller in Powershell:

Import-Module ActiveDirectory
(Get-ADDomainController -DomainName <Domain FQDN> -Discover -NextClosestSite).HostName
Improve this answer
2
  • Nice, but doesn't work on Windows 10, not even "install-module ..." . Maybe it requires Server or something?
    – Macke
    Feb 21, 2020 at 10:17
  • 2
    You would need to install the RSAT tools for Active Directory for this to work from Windows 10: petri.com/…
    – Mark Henderson
    Feb 23, 2020 at 21:33
20

From a Windows command prompt, run gpresult. You will get:

  • General workstation and domain information
  • For both the computer and the user:
    • Distinguished name in AD and which DC the policy was applied from
    • Applied Group Policy objects
    • List of security groups a member of

Here is some analysis of gpresult output. You can also specify gpresult /z to get more detailed information.

Improve this answer
1
  • 8
    Wow, gpresult /Z outputs a LOT of data. Thanks.
    – friederbluemle
    Feb 12, 2014 at 9:53
16

DNS and DHCP are the best way to check since there can be Unix/Linux machines on the network managed by the AD domain controller or acting as the domain controller.

Plus, considering active directory is nothing more than Microsoft's version of Kerberos, LDAP, dhcp and dns. It would be better to understand and debug things at lower layers than layer 7+. This is because the operating system would preform these same requests and the underlining RFC for each protocol actually operates at a OSI level not the "insert favorite tool here" level.

One can go a step further and query the dhcp for options 6, 15, and 44 to get the domain name, domain name server, and Wins/NetBIOS name server.

Then using dns to check for the _kerberos._tcp, _kpasswd._tcp, _LDAP._TCP.dc._msdcs, and _ldap._tcp SRV records:

nslookup -type=srv _kerberos._tcp.EXMAPLE.COM
nslookup -type=srv _kpasswd._tcp.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.dc._msdcs.EXAMPLE.COM

.EXAMPLE.COM ::= value returned from dhcp option-1

This breaks down into three areas, two are protocol supported DNS-SD records:

  • _kerberos._tcp and _kpasswd._tcp (also under UNIX/Linux/OSX+some windows networks has _kadmin._tcp) are for kerberos
  • _ldap._tcp is for ldap (openldap, opendc, sun/oracle directory, ms ad) _LDAP._TCP.dc._msdcs is the Microsoft only extension to ldap to map the domain controller.
Improve this answer
2

Crude CMD

Just find DC names

Save as GetDcNames.cmd:

nslookup -type=any %userdnsdomain%.

Run as: GetDcNames.cmd.

(Note: The trailing dot in "%userdnsdomain%." is on purpose. It stops your local nslookup from using any DNS search path strings.)

Find more AD related DNS domains

I whipped up a quick and dirty batch file, so that I don't have to remember the DNS domain names and/or have to type them all. (List may not be complete.)

Works from domain joined machines. If your machine is not domain joined, then you must manually set USERDNSDOMAIN to what you want.

Save as TestAdDnsRecords.cmd:

@setlocal
@REM Test AD DNS domains for presence.
@REM For details see: http://serverfault.com/a/811622/253701

nslookup -type=srv _kerberos._tcp.%userdnsdomain%.
nslookup -type=srv _kerberos._udp.%userdnsdomain%.
@echo .

nslookup -type=srv _kpasswd._tcp.%userdnsdomain%.
nslookup -type=srv _kpasswd._udp.%userdnsdomain%.
@echo .

nslookup -type=srv _ldap._tcp.%userdnsdomain%.
@echo .

nslookup -type=srv _ldap._tcp.dc._msdcs.%userdnsdomain%.
@echo .

nslookup -type=srv _ldap._tcp.pdc._msdcs.%userdnsdomain%.
@echo .

@REM Those next few lines here are forest specific:
@REM Change the next line your current domain is not also the forest root.
@SET "DNSFORESTNAME=%USERDNSDOMAIN%"

nslookup -type=srv _ldap._tcp.gc._msdcs.%DNSFORESTNAME%.
@echo .

nslookup -type=srv _gc._tcp.%DNSFORESTNAME%.

Run as TestAdDnsRecords.cmd | more. There is a lot of text output.

Sources

Improve this answer
0

Go to command prompt and type "net time" - it will fetch you Domain Controller name along with time. Example - "Current time at \{DCName} is {time}.

Improve this answer
0

If you just have access to DNS, you can get a list of all DCs by the following query in PowerShell:

Resolve-DnsName -Name _ldap._tcp.dc._msdcs.<YOU_DOMAIN> -Type SRV

This can be done by any user with access to DNS.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.