> For the complete documentation index, see [llms.txt](https://aas-s3curity.gitbook.io/cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aas-s3curity.gitbook.io/cheatsheet/internalpentest/active-directory/reconnaissance/find-domain-controllers.md).

# Find Domain Controllers

## On Linux

As domain controllers are often DNS Servers, you can simply use these commands:

```bash
systemd-resolve --status | grep "DNS Servers"
```

Alternatively, you can use nmcli:

```bash
nmcli dev show | grep DNS
```

## On Windows

On the same principle, use:

```bash
nslookup <domain>
```

Or you can use:

```bash
nltest /dclist:{domainname}
```

If you belong to the domain, you can use:

```bash
echo %logonserver%
```