7.4 KiB
7.4 KiB
The record types listed below can be queried in a number of ways. One of the most simple methods is using NSLOOKUP from a command line. For example from a command prompt type:
- nslookup and then press ENTER
- At the nslookup prompt type "set type=all" and press ENTER.
- Next type "_ldap._tcp.dc._msdcs.ad.cbp.dhs.gov" and press ENTER. You will receive a list of the servers advertising LDAP services for the AD domain. Since AD servers are permitted to auto register records in DNS, the list should be all active domain controllers in CBP.
| SRV Resource Record | Description |
| _ldap._tcp. DnsDomainName . | Enables a client to locate a server that is running the LDAP service in the domain named DnsDomainName. The server is not necessarily a domain controller — that is, the only assumption that can be made about the server is that it supports the LDAP application programming interface (API). All Windows Server 2003–based domain controllers register this SRV record (for example, _ldap._tcp.contoso.com.). |
| _ldap._tcp. SiteName . _sites. DnsDomainName . | Enables a client to locate a server that is running the LDAP service in the domain named DnsDomainName in the site named SiteName. SiteName is the relative distinguished name of the site object that is stored in the Configuration container in Active Directory. All Windows Server 2003–based domain controllers register this SRV record (for example, _ldap._tcp.charlotte._sites.contoso.com.). |
| _ldap._tcp.dc._msdcs. DnsDomainName . | Enables a client to locate a domain controller (dc) of the domain named DnsDomainName. All Windows Server 2003–based domain controllers register this SRV record. |
| _ldap._tcp. SiteName . _sites.dc._msdcs. DnsDomainName . | Enables a client to locate a domain controller for the domain named DnsDomainName and in the site named SiteName. All Windows Server 2003–based domain controllers register this SRV record. |
| _ldap._tcp.pdc._msdcs. DnsDomainName . | Enables a client to locate the server that is acting as the primary domain controller (PDC) in the mixed-mode domain named DnsDomainName. Only the PDC emulator master of the domain (the Windows Server 2003–based domain controller that advertises itself as the primary domain controller to computers that need a primary domain controller) registers this SRV record. |
| _ldap._tcp.gc._msdcs. DnsForestName . | Enables a client to locate a global catalog (gc) server for this forest. Only domain controllers that are functioning as gc servers for the forest named in DnsForestName register this SRV record (for example, _ldap._tcp.gc._msdcs.contoso.com.). |
| _ldap._tcp. SiteName . _sites.gc._msdcs. DnsForestName . | Enables a client to locate a global catalog (gc) server for this forest in the site named in SiteName. Only domain controllers that are serving as gc servers for the forest named in DnsForestName register this SRV record (for example, _ldap._tcp.charlotte._sites.gc._msdcs.contoso.com.). |
| _gc._tcp.DnsForestName. | Enables a client to locate a global catalog (gc) server for this domain. The server is not necessarily a domain controller. Only a server that is running the LDAP service and functioning as the GC server for the forest named DnsForestName registers this SRV record (for example, _gc._tcp.contoso.com.). In Windows Server 2003, a GC server is a domain controller. Other implementations of directory services (that are not Windows Server 2003 implementations) can also register servers as GC servers. |
| _gc._tcp.SiteName. _sites.DnsForestName. | Enables a client to locate a global catalog (gc) server for this forest in the site named SiteName. The server is not necessarily a domain controller. Only a server that is running the LDAP service and functioning as the GC server for the forest named DnsForestName registers this SRV record (for example, _gc._tcp.charlotte._sites.contoso.com.). |
| _ldap._tcp. DomainGuid . domains._msdcs. DnsForestName . | Enables a client to locate a domain controller in a domain on the basis of its GUID. A GUID is a 128-bit number that is automatically generated for referencing objects in Active Directory — in this case, the domain object. This operation is expected to be infrequent; it occurs only when the DnsDomainName of the domain has changed, the DnsForestName is known, and DnsForestName has not also been renamed (for example, _ldap._tcp.4f904480-7c78-11cf-b057-00aa006b4f8f.domains. _msdcs.contoso.com.). All domain controllers register this SRV record. |
| _kerberos._tcp. DnsDomainName . | Enables a client to locate a server that is running the Kerberos KDC service for the domain that is named in DnsDomainName. The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record. |
| _kerberos._udp. DnsDomainName . | Same as _kerberos._tcp.DnsDomainName, except that UDP is implied. |
| _kerberos._tcp. SiteName . _sites. DnsDomainName . | Enables a client to locate a server that is running the Kerberos KDC service for the domain that is named DnsDomainName and is also in the site named SiteName. The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record. |
| _kerberos._tcp.dc._msdcs. DnsDomainName . | Enables a client to locate a domain controller that is running the Windows Server 2003 implementation of the Kerberos KDC service for the domain named in DnsDomainName. All Windows Server 2003–based domain controllers that are running the KDC service (that is, that implement a public key extension to the Kerberos v5 protocol Authentication Service Exchange subprotocol) register this SRV record. |
| _kerberos.tcp. SiteName . _sites.dc._msdcs. DnsDomainName . | Enables a client to locate a domain controller that is running the Windows Server 2003 implementation of the Kerberos KDC service for the domain that is named DnsDomainName and that is also in the site named SiteName. All Windows Server 2003–based domain controllers that are running the KDC service (that is, that implement a public key extension to the Kerberos v5 protocol Authentication Service Exchange subprotocol) register this SRV record. |
| _kpasswd._tcp.DnsDomainName. | Enables a client to locate a Kerberos Password Change server for the domain. All servers that provide the Kerberos Password Change service (which includes all Windows Server 2003–based domain controllers) register this name. This server must at least conform to the Kerberos Change Password Protocol. (For more information about this draft, see the Microsoft Platform SDK.) The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record. |
| _kpasswd._udp.DnsDomainName. | Same as _kpasswd._tcp.DnsDomainName, except that UDP is implied. |
| > From <https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/DNS%20SRV%20Records%20for%20Domain%20Controllers.aspx> |