projectdiscovery/nuclei · error

ds domain dn: %w

Error message

ds domain dn: %w

What it means

GetDomainDN derives the domain's root distinguished name (e.g. DC=acme,DC=local) from the supplied domain name; that DN anchors all later replication calls. The error means the DC could not map the given domain name to a naming context it hosts — wrong domain string is the dominant cause, with access denial second.

Source

Thrown at pkg/js/libs/secretsdump/secretsdump.go:146

		return nil, fmt.Errorf("drsuapi bind: %w", err)
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	bind, err := gpdrs.DsBind(rpc)
	if err != nil {
		return nil, fmt.Errorf("ds bind: %w", err)
	}

	dcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)
	if err != nil {
		return nil, fmt.Errorf("ds dc info: %w", err)
	}

	domainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)
	if err != nil {
		return nil, fmt.Errorf("ds domain dn: %w", err)
	}

	// Resolve target -> DN if it doesn't already look like one.
	userDN := target
	if len(target) < 3 || (target[:3] != "CN=" && target[:3] != "cn=") {
		cracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + "\\" + target})
		if err != nil || len(cracked) == 0 || cracked[0].Name == "" {
			cracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})
			if err != nil || len(cracked) == 0 || cracked[0].Name == "" {
				return nil, fmt.Errorf("could not resolve %q to a DN", target)
			}
		}
		userDN = cracked[0].Name
	}

	res, err := gpdrs.DsGetNCChanges(rpc, bind.Handle, domainDN, userDN, dcInfo.NtdsDsaObjectGuid, rpc.GetSessionKey())
	if err != nil {
		return nil, fmt.Errorf("DsGetNCChanges: %w", err)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Confirm the domain naming context via LDAP rootDSE: defaultNamingContext attribute
2. Use the exact DNS name of the AD domain (acme.local)
3. Verify the account can read rootDSE on the DC

if err != nil && strings.Contains(err.Error(), "ds domain dn:") {
    // naming context lookup failed: fix the domain string and rebuild the client
}

When it happens

Trigger: Calling DCSync with c.Domain set to a NetBIOS name the DC does not serve, an untrusted foreign domain, or a malformed string like 'ACME.LOCAL.' with a trailing dot; a principal denied listing of naming contexts.

Common situations: Templates written against one lab reused against another; forest trust domains; domain argument left as a placeholder.

Related errors

• ds dc info: %w
• smb connect: %w
• open lsass pipe: %w
• ds bind: %w
• could not resolve %q to a DN

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/0a1cf057af55b97e. Report an issue: GitHub.