IgNiTeD SoUL

Problem

You want to find the NetBIOS name of a domain. Although Microsoft has moved to using DNS for its primary means of name resolution, the NetBIOS name of a domain is still important, especially with down-level clients that are still based on NetBIOS instead of DNS for name resolution.

Solution

Using a graphical user interface

1. Open the Active Directory Domains and Trusts snap-in (domain.msc).
2. Right-click the domain you want to view in the left pane and select Properties.

The NetBIOS name will be shown in the “Domain name (pre-Windows 2000)” field.

You can also retrieve this information using LDP, as follows:

1. Open LDP and from the menu, select Connection Connect.
2. For Server, enter the name of a domain controller (or leave blank to do a serverless bind).
3. For Port, enter 389.
4. Click OK.
5. From the menu select Connection Bind.
6. Enter credentials of a domain user.
7. Click OK.
8. From the menu, select Browse Search.
9. For BaseDN, type the distinguished name of the Partitions container (e.g., cn=partitions,cn=configuration,dc=rallencorp, dc=com).

10.  For Scope, select Subtree.

11.  For Filter, enter:

12.  (&(objectcategory=crossref)(dnsHostName=<DomainDNSName>)(netbiosname=*))

13.  Click Run.

Using a command-line interface

To find the NetBIOS name of a Windows domain, use the following command:

        > dsquery * cn=partitions,cn=configuration,<ForestRootDN> -filter
        "(&(objectcategory=crossref)(dnsroot=<DomainDNSName>)(netbiosname=*))" -attr
        netbiosname

Or you can use the AdFind utility as follows:

        > adfind -b cn=partitions,cn=configuration,<ForestRootDN>
        -f "(&(objectcategory=crossref)(dnsroot=<DomainDNSName>))" cn netbiosname

Using VBScript

        ' This code prints the  
NetBIOS name for the specified domain
        ' ------ SCRIPT CONFIGURATION -----
        strDomain = "<DomainDNSName>" ' e.g. amer.rallencorp.com
        ' ------ END CONFIGURATION --------

        set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE")
        strADsPath = "<LDAP://" & strDomain & "/cn=Partitions," & _
                    objRootDSE.Get("configurationNamingContext") & ">;"
        strFilter = "(&(objectcategory=Crossref)" & _
                     "(dnsRoot=" & strDomain & ")(netBIOSName=*));
        strAttrs = "netbiosname;"
        strScope = "Onelevel"
        set objConn = CreateObject("ADODB.Connection")
        objConn.Provider = "ADsDSOObject"
        objConn.Open "Active Directory Provider"
        set objRS = objConn.Execute(strADsPath &  strFilter &  strAttrs &  strScope)
        objRS.MoveFirst
        WScript.Echo "NetBIOS name for " &  strDomain &  " is " &  objRS.Fields(0).Value

Discussion

Each domain has a crossRef object that is used by Active Directory to generate referrals to other naming contexts within an Active Directory forest. Referrals are necessary when a client performs a query, and the domain controller handling the request does not have the matching object(s) in any naming contexts that it has stored locally. The NetBIOS name of a domain is stored in the domain’s crossRef object in the Partitions container in the Configuration NC. Each crossRef object has a dnsRoot attribute, which is the fully qualified DNS name of the domain. The netBIOSName attribute contains the NetBIOS name for the domain.