adidnsdump

Install

pip install adidnsdump

adidnsdump -u 'DOMAIN\user' -p 'password' DC_IP
adidnsdump -u 'DOMAIN\user' -p 'password' DC_IP -r    # Resolve unknown records

adidnsdump -u 'DOMAIN\user' -p 'password' DC_IP --include-tombstoned

Creates records.csv with all DNS records from AD-integrated DNS zones.

cat records.csv

Columns: type, name, value (three columns; the CSV header is literally type,name,value). There is no zone column.

ldapsearch -x -H ldap://DC_IP -b "DC=domain.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=local" -D "[email protected]" -w 'pass'

Task	Command
Dump DNS	`adidnsdump -u 'DOM\user' -p 'pass' DC_IP`
Resolve	Add `-r` flag
Tombstoned	Add `--include-tombstoned`
Output	`records.csv`