How to get FQDN of a Target User's (Different) Domain?

Question

How can I get the Fully Qualified Domain Name (FQDN) for a user on a different, trusted domain?

Normally, I would ask said user to take any one of the approaches outlined here (e.g. whoami /fqdn or echo %userDNSdomain%), but if this approach isn't available for whatever reason (e.g. the account is a proxy account that I am unable to log in with interactively, the company I'm working for was acquired and the new owners aren't as forthcoming, etc.), is there a way I can get this different user account's FQDN?

Alternatively, taking the approach of "emulating" the FQDN being returned by my user credentials is also prone to error. Take for example the output of running whoami /fqdn as my user:

C:\Users\john.eisbrener>whoami /fqdn
CN=John M. Eisbrener,OU=Standard Users,OU=Resources,DC=CONTOSO,DC=COM

I could conceptually adjust the CONTOSO Domain Component to the other, trusted domain, with the expectation that it follows the same structure, but that would be short sighted as not all domains follow the same naming convention. I've seen too many trusted domains using .org or including additional domain prefix or suffixes within their LDAP root path.

The main driver to all of this is that I need to pass the proper Domain Components to the following PowerShell queries which I rely on when trying to find what user groups and user names may need to be added to certain security groups, file paths, etc.

## List Groups for a Username
$domainName = 'CONTOSO'
$domainSuffix = 'COM'
$username = 'john.eisbrener'
(New-Object System.DirectoryServices.DirectorySearcher((New-Object System.DirectoryServices.DirectoryEntry("LDAP://dc=$($domainName),dc=$($domainSuffix)")), "(&(objectCategory=User)(samAccountName=$($username)))")).FindOne().GetDirectoryEntry().memberOf | % { (New-Object System.DirectoryServices.DirectoryEntry("LDAP://"+$_)) } | Sort-Object sAMAccountName | SELECT @{name="Group Name";expression={$_.Name}},@{name="Group sAMAccountName";expression={$_.sAMAccountName}}


## List Members in a Group
$domainName = 'CORP'
$domainSuffix = 'ORG'
$groupname = 'RemoteUsers'
(New-Object System.DirectoryServices.DirectoryEntry((New-Object System.DirectoryServices.DirectorySearcher((New-Object System.DirectoryServices.DirectoryEntry("LDAP://dc=$($domainname),dc=$($domainSuffix)")), "(&(objectCategory=Group)(name=$($groupname)))")).FindOne().GetDirectoryEntry().Path)).member | % { (New-Object System.DirectoryServices.DirectoryEntry("LDAP://"+$_)) } | Sort-Object sAMAccountName | SELECT @{name="User Name";expression={$_.Name}},@{name="User sAMAccountName";expression={$_.sAMAccountName}}

Why can't I install any other components or modules? The computer I'm using is pretty vanilla and doesn't have any extra PowerShell modules or mmc snapins (e.f. dsa.msc) available because my user account doesn't have sufficient privileges to install software.

My current approach to get the FQDN of this other user's domain is to setup a Windows Scheduled Task running as said user, saving the output of the aforementioned whoami /fqdn or echo %userDNSdomain% commands to a text file, but this seems a bit kludgy and I was hoping for a simple one-liner that I could run from the command prompt or a PowerShell prompt. Any suggestions would be appreciated.

Final note, my apologies if my terminology is incorrect or leading to confusion. I'm open to any edits to this from someone that understands what I'm asking.

Answer 1

This should just use .Net classes, so it should work just fine for you.

Function Get-TrustedDomainUser{
Param([String]$Alias)
    $Forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
    $AllTrusts=$Forest.GetAllTrustRelationships()
    $Filter = "(&(sAMAccountName=$Alias)(objectClass=user))"
    $Searcher = [adsisearcher]$Filter
    ForEach($Domain in $AllTrusts.TargetName){
        Write-Host "Trying to find user in $Domain"
        $LDAP = 'DC=' + ($Domain.split('.') -join ',DC=')
        $Searcher.SearchRoot = "LDAP://$LDAP"
        $ErrorActionPreference = 'Stop'
        try{
            $DomUser = $Searcher.FindAll()

        }Catch{
            Write-Host "User not found in $Domain"
        }
        If(!([string]::IsNullOrEmpty($DomUser.Path))){Break}
    }
    $DomUser
}

Get-TrustedDomainUser -Alias 'SomeUser'

That will get all trusted domains, and then try and find the user in each domain until it finds the user, at which point it returns the user. If you don't like the on screen spam just comment out the Write-Host lines.

Answer 2

$s = [adsisearcher]'(&(objectcategory=user)(samaccountname=somename))'
$s.SearchRoot = [adsi]'LDAP://DomainFqdnOfTargetUserDomain'
$r = $s.FindOne()

$r.properties

• Use the adsisearcher type accelerator constructor to specify the ldap search we want to run
• Use properties on the underlying DirectorySearcher object to specify we don't want use the default user's domain but the domain we specify (must be an ADSI reference).
• distinguishedname is a default AD attribute returned. If it wasn't or you needed to add one that wasn't default, you can use: $s.PropertiesToLoad.Add('propertyname')
• Execute the .FindOne() method to return a singular item. If you are doing a generic search, e.g. (samaccountname=tom*), you can switch this to .FindAll().
• Emit the results to the screen so you can see the object properties that are returned.
• Understand that for some crazy reason, these calls return every property as an array (even if it's defined as single-value in the AD schema) so in most cases, while referencing the property will work in single-item arrays, it would be more proper to reference it by index as well: e.g. $r.properties.samaccountname[0]