Active Directory DNS · PowerShell
udfx
In an air-gapped Windows estate the DNS zone is the map, and Active Directory is already holding it. This asks for it directly.
- PowerShell
- Windows
Every domain and subdomain registered in AD-integrated DNS, read over LDAP. No internet, no extra service, and no administrator account — a plain domain user is enough, which is the point: this is what an attacker who has one already sees.
Each record comes out with its type (A, NS, CNAME, MX, SRV, TXT), its value, its zone, and the root domain it belongs to, with zones sorted into primary, subdomain and external. The run writes four files: the full record set as CSV, JSON and text, plus a deduplicated list of root domains, which is usually the one you actually open first.
.\Get-ADDnsRecords.ps1 -Domain corp.example.com
Needs PowerShell 5.1 or newer on a domain-joined system.