{"record":{"id":"99f87f36b151df9d","repo":"shadow1ng/fscan","slug":"cannot-find-dc-for-s","errorCode":null,"errorMessage":"cannot find DC for %s","messagePattern":"cannot find DC for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/systeminfo_dc_windows.go","lineNumber":127,"sourceCode":"func (p *SystemInfoPlugin) findDC(domain string) (string, error) {\n\tif out, err := exec.Command(\"nslookup\", \"-type=SRV\", fmt.Sprintf(\"_ldap._tcp.dc._msdcs.%s\", domain)).Output(); err == nil {\n\t\tfor _, line := range strings.Split(string(out), \"\\n\") {\n\t\t\tif common.ContainsAny(line, \"svr hostname\", \"service\") {\n\t\t\t\tparts := strings.Split(line, \"=\")\n\t\t\t\tif len(parts) > 1 {\n\t\t\t\t\thost := strings.TrimSpace(parts[len(parts)-1])\n\t\t\t\t\thost = strings.TrimSuffix(host, \".\")\n\t\t\t\t\tif host != \"\" {\n\t\t\t\t\t\treturn host, nil\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tif err := exec.Command(\"ping\", \"-n\", \"1\", domain).Run(); err == nil {\n\t\treturn domain, nil\n\t}\n\treturn \"\", fmt.Errorf(\"cannot find DC for %s\", domain)\n}\n\nfunc (p *SystemInfoPlugin) getBaseDN(conn *ldap.Conn, domain string) (string, error) {\n\tsr, err := conn.Search(ldap.NewSearchRequest(\"\", ldap.ScopeBaseObject, ldap.NeverDerefAliases, 0, 0, false, \"(objectClass=*)\", []string{\"defaultNamingContext\"}, nil))\n\tif err == nil && len(sr.Entries) > 0 {\n\t\tif dn := sr.Entries[0].GetAttributeValue(\"defaultNamingContext\"); dn != \"\" {\n\t\t\treturn dn, nil\n\t\t}\n\t}\n\tvar parts []string\n\tfor _, p := range strings.Split(domain, \".\") {\n\t\tparts = append(parts, fmt.Sprintf(\"DC=%s\", p))\n\t}\n\treturn strings.Join(parts, \",\"), nil\n}\n\nfunc (p *SystemInfoPlugin) queryDomainBasicInfo(conn *domainInfo) {\n\tsr, err := conn.LDAPConn.Search(ldap.NewSearchRequest(conn.BaseDN, ldap.ScopeBaseObject, ldap.NeverDerefAliases, 0, 0, false, \"(objectClass=*)\", []string{\"whenCreated\", \"whenChanged\", \"msDS-Behavior-Version\"}, nil))","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/systeminfo_dc_windows.go#L109-L145","documentation":"findDC's last-resort check pings the domain (\"ping -n 1 <domain>\") to confirm a domain controller is discoverable; when the ping fails and no DC was otherwise located, it returns \"cannot find DC for <domain>\". It signals that no domain controller could be identified or reached for the given domain name.","triggerScenarios":"exec.Command(\"ping\", \"-n\", \"1\", domain).Run() returns an error after prior DC-lookup steps failed — i.e., the domain name is unresolvable, ICMP is blocked, or no DC responds for that domain.","commonSituations":"Typo in the domain name, scanner host not on the corporate network/VPN, DNS search suffix missing so bare domain names don't resolve, ICMP blocked by firewall making the fallback ping fail even when LDAP would work, or the target is not actually an AD domain.","solutions":["Verify the domain name spelling and that DNS resolves it (nslookup <domain>) from the scanning host.","Ensure the scanning host is connected to the network/VPN where the domain's DCs are reachable.","Add the domain's DNS suffix/search configuration so bare domain lookups resolve.","Check whether ICMP is blocked; if DCs are reachable but ping is filtered, run the tool with a resolvable DC hostname instead of the bare domain."],"exampleFix":"// before\nreturn \"\", fmt.Errorf(\"cannot find DC for %s\", domain) // ping -n 1 corp.example.com failed\n// after (pre-verify on the caller side)\nif out, err := exec.Command(\"nslookup\", domain).CombinedOutput(); err != nil {\n    return nil, fmt.Errorf(\"domain %s does not resolve: %v: %s\", domain, err, out)\n}\n// then call connectToDomain with a resolvable domain or explicit DC host","handlingStrategy":"validation","validationCode":"// Confirm the domain resolves before attempting DC discovery\naddrs, err := net.LookupHost(domain)\nif err != nil || len(addrs) == 0 {\n    return fmt.Errorf(\"domain %s does not resolve; check DNS/VPN\", domain)\n}","typeGuard":null,"tryCatchPattern":"result := plugin.Scan(ctx, host, session)\nif result != nil && !result.Success && strings.Contains(result.Error.Error(), \"cannot find DC for\") {\n    // surface to user: wrong domain name, offline VPN, or DNS suffix problem\n}","preventionTips":["Validate the domain name with nslookup before scanning.","Connect to the corporate network/VPN that can reach the domain's DCs.","Configure DNS search suffixes so bare domain names resolve."],"tags":["network","dns","active-directory","windows"],"backgroundTag":"resource-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}