Guys, I inherited a load of Windows Domain Controller servers am I'm tasked with upgrading them and decommissioning some of them. Thing is we have tonnes of Linux stuff using them and lots of those systems have hard-coded one DC for DNS/LDAP lookup, auth etc. Worse still, some are critical production systems, so shutting off their only LDAP/DNS sever is not an option 🙂
So, I can hide a DC from Windows OS not problem using/32 subnets. I have then been using tshark to track incoming requests and see who's still looking for it. This scales horribly though when you have 100 DCs 🙂
SO, I was thinking of using Splunk for stream to track incoming connections for things like DNS,LDAP etc. I know I'm being lazy and should read all the docs etc. but I have little time to do this.
Can anyone point me in the direction of how to achieve this?
