Try standard DNS query as follow. A windows 2000 domain is represented by a DNS domain name. Each domain controller register its address with DNS using the standard DNS dynamic update (RFC 2136 ). In addition to register its host name (A record ), the domain controller registers pseudonym(s) (SRV or CNAME records ) that will help finding the DC based on predictable criteria (e.g. the DC in a particular site ). If multiple DC have the same criteria, then there would be multiple records with the same pseudonym. A client locking for a DC with that criteria would receive all the applicable records from the DNS server.
For example, a DC named spiros in the domain nt.egge.com with an IP address of 192.68.1.1 would register the following records with DNS: spiros.nt.egge.com. A 192.68.1.1 _ldap._tcp.nt.egge.com. SRV 0 0 389 spiros.nt.egge.com. _kerberos._tcp.nt.egge.com. SRV 0 0 99 spiros.nt.egge.com. _ldap._tcp.dc._msdcs.nt.egge.com. SRV 0 0 389 spiros.nt.egge.com. _kerberos._tcp.dc._msdcs.nt.egge.com. SRV 0 0 99 spiros.nt.egge.com. with these record in place ( and similar record by all the other DCs in the same domain) a simple lookup of "_ldap._tcp.dc._msdcs.nt.egge.com" will return the names and address of all the DCs in the domain. In short the query for finding all the DCs is: _ldap._tcp.dc._msdcs.<DnsDomainName> For the PDCs the query is _ldap._tcp.pdc._msdcs.<DnsDomainName>. host or dig should be able to do the work. You can find more information from the google search engine with "Windows 2000 DNS". Hope this can help. Elia -----Messaggio originale----- Da: Richard Sharpe [mailto:[EMAIL PROTECTED]] Inviato: venerd́ 3 maggio 2002 5.24 A: [EMAIL PROTECTED] Oggetto: Heuristics for finding a Win2K domain controller ... Hi, Does anyone know any heuristics for finding a Win2K Domain controller? WINS does not seem to work the same way as NT4 ... Regards ----- Richard Sharpe, [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED]