How can I get other domains from one domain

Question

I try to get all domains in a forest.

I can connect to one specific domain and get its DirectoryEntry like this:

DirectoryContext dc =
    new DirectoryContext(DirectoryContextType.DirectoryServer, "xx.x.xxx.40", "w28\\administrator", "pwd");

Domain domain = Domain.GetDomain(dc);
DirectoryEntry entry = domain.GetDirectoryEntry();
foreach (DirectoryEntry child in entry.Children)
{
    Console.WriteLine(" - " + child.Name);
}

However, when I try to get other domains via the Forest properity.

Forest forest = domain.Forest;
Console.WriteLine("Count: " + forest.Domains.Count); //It crashes here
DomainCollection domains = forest.Domains;

My app crashes and the exception message is shown below: System.DirectoryServices.ActiveDirectory.ActiveDirectoryServerDownException: The specified domain either does not exist or could not be contacted.

at System.DirectoryServices.ActiveDirectory.Locator.GetDomainControllerInfo(String computerName, String domainName, String siteName, Int64 flags) at System.DirectoryServices.ActiveDirectory.DirectoryContext.isCurrentForest() at System.DirectoryServices.ActiveDirectory.DirectoryContext.GetServerName() at System.DirectoryServices.ActiveDirectory.DirectoryEntryManager.GetNewDirectoryEntry(String dn) at System.DirectoryServices.ActiveDirectory.DirectoryEntryManager.GetCachedDirectoryEntry(String distinguishedName) at System.DirectoryServices.ActiveDirectory.DirectoryEntryManager.ExpandWellKnownDN(WellKnownDN dn) at System.DirectoryServices.ActiveDirectory.DirectoryEntryManager.ExpandWellKnownDN(WellKnownDN dn) at System.DirectoryServices.ActiveDirectory.Forest.GetDomains() at System.DirectoryServices.ActiveDirectory.Forest.get_Domains()

Please help me.

Thanks in advance.

Answer 1

I have this same problem. I'm outside the domain and I always will be because we're network security testers.

I found this is a good way to work around

 class PInvoke {
[DllImport("Netapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        public static extern int DsGetDcName
        (
          [MarshalAs(UnmanagedType.LPTStr)]
            string ComputerName,
          [MarshalAs(UnmanagedType.LPTStr)]
            string DomainName,
          [In] int DomainGuid,
          [MarshalAs(UnmanagedType.LPTStr)]
            string SiteName,
          [MarshalAs(UnmanagedType.U4)]
            DSGETDCNAME_FLAGS flags,
          out IntPtr pDOMAIN_CONTROLLER_INFO
        );

    [StructLayout(LayoutKind.Sequential)]
    public class GuidClass
    {
        public Guid TheGuid;
    }
    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]

    public struct DOMAIN_CONTROLLER_INFO
    {
        [MarshalAs(UnmanagedType.LPTStr)]
        public string DomainControllerName;
        [MarshalAs(UnmanagedType.LPTStr)]
        public string DomainControllerAddress;
        public uint DomainControllerAddressType;
        public Guid DomainGuid;
        [MarshalAs(UnmanagedType.LPTStr)]
        public string DomainName;
        [MarshalAs(UnmanagedType.LPTStr)]
        public string DnsForestName;
        public uint Flags;
        [MarshalAs(UnmanagedType.LPTStr)]
        public string DcSiteName;
        [MarshalAs(UnmanagedType.LPTStr)]
        public string ClientSiteName;
    }



    [DllImport("Netapi32.dll", SetLastError = true)]
    public static extern int NetApiBufferFree(IntPtr Buffer);

    [Flags]
    public enum DSGETDCNAME_FLAGS : uint
    {
        DS_FORCE_REDISCOVERY = 0x00000001,
        DS_DIRECTORY_SERVICE_REQUIRED = 0x00000010,
        DS_DIRECTORY_SERVICE_PREFERRED = 0x00000020,
        DS_GC_SERVER_REQUIRED = 0x00000040,
        DS_PDC_REQUIRED = 0x00000080,
        DS_BACKGROUND_ONLY = 0x00000100,
        DS_IP_REQUIRED = 0x00000200,
        DS_KDC_REQUIRED = 0x00000400,
        DS_TIMESERV_REQUIRED = 0x00000800,
        DS_WRITABLE_REQUIRED = 0x00001000,
        DS_GOOD_TIMESERV_PREFERRED = 0x00002000,
        DS_AVOID_SELF = 0x00004000,
        DS_ONLY_LDAP_NEEDED = 0x00008000,
        DS_IS_FLAT_NAME = 0x00010000,
        DS_IS_DNS_NAME = 0x00020000,
        DS_RETURN_DNS_NAME = 0x40000000,
        DS_RETURN_FLAT_NAME = 0x80000000
    }
}

class domain
{
   public static void DetectDc(string domain, string username, string password, out string dc, out string dcAddress, out string path)
        {
            PInvoke.DOMAIN_CONTROLLER_INFO domainInfo;
            const int errorSuccess = 0;
            var pDci = IntPtr.Zero;

            try
            {
                var val = PInvoke.DsGetDcName(null, domain, 0, "", 0, out pDci);
                //check return value for error
                if (errorSuccess == val)
                {
                    domainInfo = (PInvoke.DOMAIN_CONTROLLER_INFO)Marshal.PtrToStructure(pDci, typeof(PInvoke.DOMAIN_CONTROLLER_INFO));
                }
                else
                {
                    dc = "";
                    dcAddress = "";
                    path = "";
                    namingContext = "";
                    return;
                }
            }
            finally
            {
                PInvoke.NetApiBufferFree(pDci);
            }

            dc = domainInfo.DomainControllerName;
            dc = dc.Replace("\\\\", "");

            dcAddress = domainInfo.DomainControllerAddress;
            dcAddress = dcAddress.Replace("\\\\", "");

            var ldap = new Ldap(domain, dcAddress, username, password);

        }
}

Answer 2

I ran similar code in my forest (by GetCurrentDomain() and query its Forest) and they worked well. I think the problem was just as the exception and callstack presented - it tries to get info about your forest by querying the forest root server which is a DC, and it cannot be contacted. I think you need to check your topology and then look at the server's status.