How do I determine total number of Active Directory Forests in an enterprise?

Question

I heard that theoretically we could port scan global network for TCP 3268 i.e identifying all Global Catalog Domain Controllers(DCs). So my questions are:

1. How Global Catalog servers is correlated with total number of Active Directory Forests in an enterprise and how can I tell number of forests by identifying all Global Catalog servers? Please elaborate this method.
2. Is there any alternative/automated/practical way to answer this question without checking network documentation and AD design documents or interviewing? Kindly answer with explanation specific to above mentioned questions.

Answer 1

Hi,

A catalog Global has a partial replicate of each child domain in forest with multiple child domains.

global-catalog

You can launch the following command to check the number of global catalogue in each domainenter code here

If you want know the number of global catalog in each child domain you can run the following powershell script

$domainlist= get-adforest | select -expandproperty domains  
  
foreach ($domain in $domainlist)  
{  
$GClist = Get-Addomaincontroller -filter *  | where-object {$_.isglobalcatalog -eq $true}  
  
$GCnumber = $GClist.count  
write-host "the number of Global Catalog in $domain domain is $DCnumber"  
  
}  

Please don't forget to mark this reply as answer if it help you to fix your issue

Answer 2

Hello,

Thank you so much for posting here.

As per my experience and knowledge, it could not tell numbers of forests by identifying all Global Catalog servers. In AD, there is no relationship between the forests since they are separate unless we create the forest trust between the forests. Besides, GC is functional within one forest.

To understand the GC, we must first understand the concept of a "forest." A forest is a collection of one or more AD trees organized as peers and connected by two-way transitive trust relationships between the root domains of each tree. All trees in a forest share a common schema, configuration, and GC.

Every domain controller in a forest stores three full, writable directory partitions:

Domain directory partition
Schema directory partition
Configuration directory partition

A GC server is a domain controller that stores these three writable directory partitions, as well as a partial, read-only copy of all other domain directory partitions in the forest. The additional directory partitions are "partial" because although they collectively contain every object in the directory, they have a limited set of specific attributes for each object. The AD replication system automatically builds the GC. AD automatically designates the first domain controller in a forest as a GC server, although any domain controller can be a GC server.

When a search request is sent to port 389 (the default Lightweight Directory Access Protocol—LDAP—port for AD) on a specific domain, computer, or IP address, the search is performed on one domain directory partition. If the object isn't found in that directory partition (and isn't in the schema or configuration directory partitions), the request is referred to a domain controller in a different domain that might contain the requested object (on the basis of the distinguished name—DN—you present in the search request). Such a referral is called an LDAP referral and can be very expensive in terms of the time it takes the search to find what it's looking for.

When a search request is sent to port 3268 (the default GC port), the search includes all directory partitions in the forest. In other words, a GC server processes the search. A GC search can return results for objects in any domain without generating a referral to a domain controller in a different domain. This tool is extremely powerful for software developers in a huge company with AD forests residing in different locations all over the world.

For more information, we could refer to:
https://www.itprotoday.com/active-directory/active-directory-forests-and-global-catalog

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.