6.3.6.2 NetBIOS-Based Discovery

To locate a domain controller using NetBIOS-based discovery, the client either queries a Windows Internet Name Service (WINS) server or performs broadcasting. To find a domain controller in domain fabrikam, the client either sends a NetBIOS name query for <fabrikam>[1C] to the WINS server or broadcasts for <fabrikam>[1C] record. And if the client wants to find a primary domain controller, it issues a name query for <fabrikam>[1B] to the WINS server or broadcasts for <fabrikam>[1B] record.

Upon receiving the list of matching records from WINS or broadcasting, the client either contacts servers (attempts the intended protocol request) or sends a mailslot ping (section 6.3.5) to servers first, and then attempts the intended protocol request to a server that responded to the ping.