4 ms·
They can be. But here's the problem: You have a GPO that turns on command and ps logging. Ok, so if you type those commands, you alert script logging engines.
by crankylinuxuser 8y ago
They can be. But here's the problem:
You have a GPO that turns on command and ps logging. Ok, so if you type those commands, you alert script logging engines.
And then you search how to find the DC: https://serverfault.com/questions/78089/find-name-of-active-directory-domain-controller https://serverfault.com/questions/78089/find-name-of-active-...
It's all PS or cmd. Trapped.
You might find the DC listed in the registry if you look for key "DCname". However again, that's another thing you'd use app whitelisting for, and catch every invocation of regedit. A lot of unattended driveby attacks attempt to do bad things here, so you catch/trap them.
Again, dead end.
So, I'd love to see a good walkthrough how to find the DC if these avenues don't work.
- brazzledazzle 8y agoI think this one won’t get you caught: Explorer address bar (or start>run) > %logonserver%
- crankylinuxuser 8y agoTrue, for smaller orgs. When you get to larger orgs, the DC doesnt always have to be the logon server. In fact, you're liable to see a slew of logon kerb redirectors talking to a few ldap backends running as pri and secondary AD.
- brazzledazzle 8y agoI have to admit I’m not familiar with anything in your comment. Is this different terminology for a RODCs? I was also under the impression that AD didn’t have a primary DC, the only vestige of that is the PDC Emulator FSMO role.
- emmelaich 8y agoYou can just do a SRV DNS lookup. For PDC it is _ldap._tcp.pdc._msdcs.<DnsDomainName> See https://blogs.msdn.microsoft.com/servergeeks/2014/07/12/dns-records-that-are-required-for-proper-functionality-of-active-directory/ https://blogs.msdn.microsoft.com/servergeeks/2014/07/12/dns-... [edit: I see the SO link mentions SRV. Still]