Finding All Domain Controllers (no module required)

Reviewing the ActiveDirectory Module Approach

In the previous tip we explained how you can use the ActiveDirectory module and its cmdlets to find all domain controllers in your organization, or perform any other LDAP query.

Leveraging Pure .NET Methods

Here is the same approach with pure .NET methods. It runs without the need for any additional PowerShell module and does not require the RSAT tools to be installed. It does require your computer to be member of an Active Directory.

$ldapFilter = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))"
$searcher = [ADSISearcher]$ldapFilter

$searcher.FindAll()

This returns search result objects. If you’d rather like to see the true AD objects, try this:

$searcher.FindAll() | ForEach-Object { $_.GetDirectoryEntry() }

ReTweet this Tip!