{"record":{"id":"0a1cf057af55b97e","repo":"projectdiscovery/nuclei","slug":"ds-domain-dn-w","errorCode":null,"errorMessage":"ds domain dn: %w","messagePattern":"ds domain dn: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":146,"sourceCode":"\t\treturn nil, fmt.Errorf(\"drsuapi bind: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tbind, err := gpdrs.DsBind(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds bind: %w\", err)\n\t}\n\n\tdcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds dc info: %w\", err)\n\t}\n\n\tdomainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds domain dn: %w\", err)\n\t}\n\n\t// Resolve target -> DN if it doesn't already look like one.\n\tuserDN := target\n\tif len(target) < 3 || (target[:3] != \"CN=\" && target[:3] != \"cn=\") {\n\t\tcracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + \"\\\\\" + target})\n\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\tcracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})\n\t\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"could not resolve %q to a DN\", target)\n\t\t\t}\n\t\t}\n\t\tuserDN = cracked[0].Name\n\t}\n\n\tres, err := gpdrs.DsGetNCChanges(rpc, bind.Handle, domainDN, userDN, dcInfo.NtdsDsaObjectGuid, rpc.GetSessionKey())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"DsGetNCChanges: %w\", err)","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L128-L164","documentation":"GetDomainDN derives the domain's root distinguished name (e.g. DC=acme,DC=local) from the supplied domain name; that DN anchors all later replication calls. The error means the DC could not map the given domain name to a naming context it hosts — wrong domain string is the dominant cause, with access denial second.","triggerScenarios":"Calling DCSync with c.Domain set to a NetBIOS name the DC does not serve, an untrusted foreign domain, or a malformed string like 'ACME.LOCAL.' with a trailing dot; a principal denied listing of naming contexts.","commonSituations":"Templates written against one lab reused against another; forest trust domains; domain argument left as a placeholder.","solutions":["Confirm the domain naming context via LDAP rootDSE: defaultNamingContext attribute","Use the exact DNS name of the AD domain (acme.local)","Verify the account can read rootDSE on the DC"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"ds domain dn:\") {\n    // naming context lookup failed: fix the domain string and rebuild the client\n}","preventionTips":["Use the exact AD DNS domain name (acme.local) in the Client constructor","Verify with rootDSE naming contexts once per target and cache the result","Avoid trailing dots, NetBIOS guesses, and hostnames in the domain field"],"tags":["dcsync","active-directory","configuration"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}