You can just do a SRV DNS lookup. For PDC it is _ldap._tcp.pdc._msdcs.<DnsDomainName> See https://blogs.msdn.microsoft.com/servergeeks/2014/07/12/dns-records-t

You can just do a SRV DNS lookup. For PDC it is _ldap._tcp.pdc._msdcs.<DnsDomainName> See https://blogs.msdn.microsoft.com/servergeeks/2014/07/12/dns-records-that-are-required-for-proper-functionality-of-active-directory/ https://blogs.msdn.microsoft.com/servergeeks/2014/07/12/dns-... [edit: I see the SO link mentions SRV. Still]