How can you find available ldap servers from a computer in the same network, but different domain?

Question

My company has code that integrates with activedirectory/LDAP for centralized userid/password login. Currently, the configuration page can only show the LDAP server linked to the Exchange domain the current computer is on. I'd like to list all available LDAP servers, similar to when you go to Windows Explorer and view 'Microsoft Windows Network'. As of now, I've been unable to get this information through LDAP or through other means.

Answer 1

There are a few things you can attempt:

1. You can look for SRV records in DNS for the domain you're on. These look like _protoname._transportname.domain.tld - I suspect this might be what you're already doing.
2. You can attempt to use Service Location Protocol as documented in RFC 2608.
3. There might be some MS-specific way to look for these services that I'm not aware of.
4. You could attempt to brute-force port scan. (poor form)