Domain controllers and DNS: SRV records
You read one by one the SRV records a Windows computer asks to find the DC (LDAP, Kerberos, password change, Global Catalog), verify the DC’s ports, connect to the Global Catalog, try a zone transfer and an unauthenticated DNS update (both must be refused) and write the DNS audit findings.
Level 201 · 40 min
AD doesn’t work without DNS. When a computer starts, the first thing it does is ask DNS: "where is the DC of the corp.lab domain, which server runs Kerberos?" The answers are in SRV records. That is why DNS is AD’s nervous system.
Attackers love DNS too: they want to pull every record of the domain at once (a zone transfer) or add a fake record that redirects traffic to them. In this lesson you will also verify that both these doors are closed.
The first half of the commands is ready; then you type them by hand, and in the last two steps you only see the goal.
What you will do in this lesson
- The DC locator: _ldap._tcp.dc._msdcs
- Kerberos, kpasswd and the Global Catalog
- The zone’s base: A and NS
- All of the DC’s doors
- Ask the Global Catalog and see TLS being required
- Is zone transfer closed?
- Can a fake record be added?
- The DC identity card
- DNS audit findings
- Short quiz
Skills you will earn
- Finding the DC through DNS (_ldap._tcp.dc._msdcs)
- Reading the Kerberos, kpasswd and GC SRV records
- Reading the AD DNS zone (A, NS)
- Knowing the DC services and their ports
- Querying the Global Catalog (3268/3269)
- Seeing LDAP require TLS and using ldaps
- Verifying that zone transfer is closed
- Verifying unauthenticated DNS updates are refused
- Writing audit findings into a report
← What Active Directory is: domain, forest, OU · Active Directory security: auditing and hardening · Authentication: Kerberos and NTLM →
Start for free