Domain Controllers
This details various different techniques and methods required to enumerate domain controllers within Active Directory.
Windows
PowerView
Native Powershell
Get all domain controllers inside the domain
corp.contoso.local
C:\> nltest /dclist:corp.contoso.local
C:\> nslookup -type=all _ldap._tcp.dc._msdcs.corp.contoso.local
C:\> net group "domain controllers" /domain
C:\>echo %LOGONSERVER%
C:\> nltest /dsgetdc:corp.contoso.local