I am trying to gather our domain controllers host A records remotely.
I am able to use ldapsearch to gather lots of info about the schema, computers, and users. But I cant seem to find where the A records are located.
I have been using “Active Directory Explorer” to build my baseDNs. As I look through it I do not see where host a records would be listed. Maybe its not possible to look them up.
BTW, our AD severs have zone transfers disabled so there is no way I can just dump them with a simple dig request.
Any recommendations? Note, not able to RDP to the system, must be done remote.
