{"record":{"id":"14f6829a12fca20e","repo":"projectdiscovery/nuclei","slug":"ds-dc-info-w","errorCode":null,"errorMessage":"ds dc info: %w","messagePattern":"ds dc info: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":141,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"open lsass pipe: %w\", err)\n\t\t}\n\t}\n\trpc := gprpc.NewClient(pipe)\n\tif err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"drsuapi bind: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tbind, err := gpdrs.DsBind(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds bind: %w\", err)\n\t}\n\n\tdcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds dc info: %w\", err)\n\t}\n\n\tdomainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds domain dn: %w\", err)\n\t}\n\n\t// Resolve target -> DN if it doesn't already look like one.\n\tuserDN := target\n\tif len(target) < 3 || (target[:3] != \"CN=\" && target[:3] != \"cn=\") {\n\t\tcracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + \"\\\\\" + target})\n\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\tcracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})\n\t\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"could not resolve %q to a DN\", target)\n\t\t\t}\n\t\t}\n\t\tuserDN = cracked[0].Name","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L123-L159","documentation":"DsDomainControllerInfo asks the DC for information about the domain named by c.Domain; the response supplies fields like NtdsDsaObjectGuid needed later for replication. This error means the call was rejected — most often because the domain string does not match the forest the DC serves, or the caller lacks rights to query DS info.","triggerScenarios":"new sd.Client('dc01', 'wrongdom', ...) where wrongdom is a typo'd or untrusted domain; domain given as an FQDN where NetBIOS form (or vice versa) is not resolvable by the DC; low-privilege principal denied directory queries.","commonSituations":"Copy-paste template with the wrong domain value; multi-domain forest where the DC belongs to a child domain; using the host's DNS suffix instead of the AD domain.","solutions":["Set the domain to the exact AD domain the DC holds (run nltest /dsgetdc: on the DC to confirm the name)","Verify with an LDAP query that the account can read rootDSE naming contexts","Escalate to an account with directory-read rights"],"exampleFix":"// before\nconst c = new sd.Client('dc01.acme.local', 'dc01.acme.local', 'admin', 'P@ss'); // host FQDN used as domain\n\n// after\nconst c = new sd.Client('dc01.acme.local', 'acme.local', 'admin', 'P@ss');","handlingStrategy":"try-catch","validationCode":"// Confirm the domain string matches the DC's NC before syncing\nnc, err := ldapRootDSE(dc, \"defaultNamingContext\")\nif err == nil && !strings.HasSuffix(nc, \",DC=\"+strings.ReplaceAll(domain, \".\", \",DC=\")) {\n    return fmt.Errorf(\"domain %q not served by %s\", domain, dc)\n}","typeGuard":null,"tryCatchPattern":"secret, err := c.DCSync(target)\nif err != nil && strings.Contains(err.Error(), \"ds dc info:\") {\n    // domain string mismatch: re-resolve domain from the DC and rebuild the Client\n    return err\n}","preventionTips":["Source the domain from the DC's rootDSE defaultNamingContext instead of hardcoding","Distinguish DNS domain from host FQDN in template variables","Validate domain naming context with one LDAP query before DCSync chains"],"tags":["dcsync","active-directory","ldap","configuration"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}