In many organizations, as a penetration tester, you will encounter a lot of Windows Server machines that serve the role of domain controller (DC). A DC is simply a Windows server machine running Active Directory Domain Services and is used to manage all the devices within the organization. Active Directory (AD) is used by IT professionals to manage components such as computers and users on a network. Additionally, IT professionals can use Group Policy Objects (GPOs) in AD to assign privileges to end devices and users, thereby creating restrictions to prevent unauthorized activities and actions on the network.

Within a Windows environment, both the NetBIOS-NS and LLMNR protocols are present. NetBIOS-NS means Network Basic Input/Output System name service. NetBIOS-NS is commonly used to resolve hostnames on local networks. NetBIOS has been around...