Domain Controller Discovery

Adversaries may identify domain controllers in an Active Directory environment to map important network systems. `nltest /dclist` lists controllers for a specified domain. `nltest /dsgetdc` locates a domain controller through the Windows DC-locator process and checks candidate availability; forcing a fresh lookup uses DNS SRV/A records and UDP-based LDAP pings. The locator API does not require particular access to the domain, so Internet-side use is possible only when locator records are publicly resolvable and the relevant DC-locator service is reachable. A returned controller is a candidate, not proof of authenticated directory access or a complete system inventory.