Is It a Domain Controller ~ My blog about Active Directory and everything else

Friday, July 20, 2012

Is It a Domain Controller

I recently went into our test lab and there was a guy working in there and he asked me.

If I'm on a machine how do I know if it is a Domain Controller
These are often my favorite types of questions.  No time to check Bing/Google, no time to check a book.  Just a quick question that is answered in seconds.   By the way in those situations it is also ok to say "I don't know" or "I'll get back to you".  A lot of times you will see people blowing smoke and making stuff up.

The guy wasn't trying to be an ass but trying to learn AD and the lab is a perfect place for it.  We have a lot of VMs in our lab and I didn't know what box he was on when I walked in.

My initial thought was to tell him to look for admin tools etc but then after a second I realized not every box has the admin tools installed.  Then I thought look for the AD Domain Services and see if they are started.  That thought lasted for a half second.  We still have 2003 DCs too so if he was on one of those then no services.

The answer I gave him was to run:

net share 


If the sysvol share is present then it is a domain controller.








I started thinking of other ways and reached out to some friends and asked what they would have suggested for this quick question.


One suggestion by my friend Troy was to run


netdom query dc


I thought that was a good one and team that with hostname so that the person knows the name of the machine works great.



My buddy Eric had a good one, it is a bit more involved because it would require the person to know about AD ports...but if they are learning they should know some of these. Use netstat -ano and look for AD ports (88, 389, 3268, and others)

netstat -ano  or netstat -ano | findstr /i listening




There are a lot of ways to do this.  You could look for SRV records.  If ADUC was installed you could have them check there for the DC.

If you also look at the drop down when you login and it has no local server name then that is another good indication.  In this case he was already logged in.

So what answers would you have given?  Are there quicker easier ways that you would have told someone just starting out with AD to check if they are at a domain controller?

Update from Kurt (thanks for your service in the Army...in war zones).    I posed this question to a mid-level AD admin.  His response was "run dcpromo, it will tell you if it is a DC".   That is true and something I didn't think of in the 5 second response.  This is why I love AD...so many ways to do something and a lot of great solutions.

My only caveat about this method is that if someone was being careless didn't read and clicked next next and finished the wizard then they could also be demoting a DC....I'm hoping people using AD can read :)

In the example below the computer is obviously a DC.




Note: The dcpromo method won't work in Windows 2012...because they killed that off...more on that in future posts.   I'm guessing very few folks are currently running Windows 2012 in production.  Example of start > run > dcpromo on a Windows 2012 DC below.




Update 2: Krzystof  had a great suggestion in the comments and that was to use systeminfo 

systeminfo /i "os configruation"




8 comments:

  1. Hello Mike,

    you're right, there are many ways to check some features and not always in short time you remember them all :)

    I really like Microsoft command "systeminfo" which gives a lot of useful output and I also use this to verify if machine is DC or not :)

    In the output you can search for "OS Configuration" field or filter it using "find" command. An example with find

    systeminfo | find /i "OS Configuration"

    This is really cool as it is working from Windows XP and command is also available in server core editions.

    I hope this is also useful for someone else than me :)

    Regards,
    Krzysztof

    ReplyDelete
    Replies
    1. Very nice Krzystof, I'm going to update the blog with your great suggestion.

      Delete
  2. Thank you, Mike! This is really kind form your side :)

    One small remark, in the screen, you posted proper command, whereas above it there is missing pipe (|) and find command ;)

    Instead of (systeminfo /i "os configruation") should be (systeminfo | find /i "os configruation")

    Just small typo :]

    Krzysztof

    ReplyDelete
  3. Hey Mike,

    Congrats on the 4-peat of MVP's.
    My favourite tool for finding your Domain Controllers?
    nltest /dclist:yourDomainName.here

    Regards,
    dvt_localboy

    ReplyDelete
    Replies
    1. Thanks a lot, hopefully I can make it 5 next year :)

      nltest is a good one too

      Delete
  4. If you attempt to logon onto DC you haven't possibility to logon to local computer, to domains only.

    Regards,
    VadimP

    ReplyDelete
  5. being logged on, you can do echo %logonserver% in your command line... if it matches your local computer name, you can be certain this is a domain controller.

    regards,

    Jente

    ReplyDelete
  6. I think this one is a short shoot..

    net accounts or net accounts |find "role"

    Computer role: PRIMARY

    If it primary or Backup , then its a DC.

    ReplyDelete