6.1.1 Establish the current identity and domain
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A Windows session, or domain credentials on Kali. A Windows username alone does not establish the identity used for network authentication.
Where to look: Start in the current Windows token and logon context; then inspect domain/DC discovery, DNS records and time. On Kali, use the explicit domain credentials and resolver context in the complete procedure.
Expected behavior / secure boundary: A member workstation can identify its domain and DC when its DNS and connectivity work. A local account, a /netonly process or a remote session can have different local and network identities. Multiple DCs are normal; the PDC emulator is not the only usable LDAP or Kerberos server.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.1.1.1 Baseline identity, DC and time checks
Run: Windows. Requires: Current token; domain/DC queries additionally need a usable domain/network context. Effect: Reads identity, discovery and time state.
whoami /all
echo %USERDNSDOMAIN%
echo %USERDOMAIN%
echo %LOGONSERVER%
nltest /dsgetdc:DOMAIN
nltest /dclist:DOMAIN
w32tm /query /status
6.1.1.2 Resolve domain and DNS context from Windows PowerShell domain and DNS queries
Run: Windows PowerShell. Requires: Domain .NET context for the domain query; DNS connectivity for SRV lookups. Effect: Reads directory/DNS state.
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.DOMAIN
Resolve-DnsName -Type SRV _kerberos._tcp.DOMAIN
What this checks: whoami describes the process token. Domain environment variables are clues, not proof of successful authentication. nltest discovers a DC; SRV lookups test the naming layer. A plausible time source is useful, but does not itself prove the clock agrees with the KDC.
6.1.1.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
whoami: EXAMPLE\analyst
USERDNSDOMAIN: example.test
DC: \\DC01.example.test
Address: \\192.0.2.10
Domain Name: example.test
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| EXAMPLE\analyst | The current token names a domain-style identity. | Record its SID/groups and how this session was obtained. | §6.2.1.1 — Baseline enumeration — users and groups |
| DC01.example.test / 192.0.2.10 | A discovered DC name and address. | Check the required service route; do not treat discovery as an LDAP bind. | §6.1.1.1 — Establish the current identity and domain |
| No DC found | Discovery failed in this context. | Check DNS and route; this does not prove the credentials are wrong. | §6.5.1.1 — Diagnose the failed boundary |
Stop when: The local/network identity, domain/DC and relevant naming/time/route dependencies are recorded.
Revisit only when: Identity, DC, resolver, clock or source route changes.
6.1.1.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Domain/DC naming and the required protocol work: enumerate users, groups and shares. | §6.2.1.1 — Baseline enumeration — users and groups |
| Ruled out in this context | This is a local account with no domain authentication context: obtain or select a supported domain query context first. | §6.3.2.1 — Classify recovered credentials and their scope |
| Inconclusive / failed check | Discovery or time checks fail: repair that dependency before judging an account or technique. | §6.5.1.1 — Diagnose the failed boundary |
6.1.1.5 Tooling and complete procedure
Windows built-ins first; PowerShell DNS/.NET alternatives require Windows domain connectivity. No RSAT prerequisite for the native baseline. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.