获取域控制器名称

Question

总结：我想仅使用 WinAPI 获取域控制器的名称，计算机不在网络上，这可能会使我的代码因“NERR_DCNotFound”而失败？

我正在尝试获取联网计算机所属的域控制器的名称。

我正在试验的计算机只是一台个人计算机，我从未设置域控制器或任何可能使测试变得困难的东西？目前它位于 VirtualBox 内部，与互联网隔离。

当我从命令行运行时，我得到以下输出，其中似乎包含一个域名：

C:\Users\lone>gpresult /Z

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
© 2016 Microsoft Corporation. All rights reserved.

Created on 31/01/2018 at 12:24:12


RSOP data for DESKTOP-I53IU6C\lone on DESKTOP-I53IU6C : Logging Mode
---------------------------------------------------------------------

OS Configuration:            Standalone Workstation
OS Version:                  10.0.10586
Site Name:                   N/A
Roaming Profile:             N/A
Local Profile:               C:\Users\lone
Connected over a slow link?: No


USER SETTINGS
--------------

    Last time Group Policy was applied: 31/01/2018 at 10:30:38
    Group Policy was applied from:      N/A
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        DESKTOP-I53IU6C
    Domain Type:                        <Local Computer>

    Applied Group Policy Objects
    -----------------------------
        N/A

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

    The user is a part of the following security groups
    ---------------------------------------------------
        None
        Everyone
        Local account and member of Administrators group
        HelpLibraryUpdaters
        BUILTIN\Administrators
        BUILTIN\Users
        NT AUTHORITY\INTERACTIVE
        CONSOLE LOGON
        NT AUTHORITY\Authenticated Users
        This Organization
        Local account
        LOCAL
        NTLM Authentication
        High Mandatory Level

    The user has the following security privileges
    ----------------------------------------------


    Resultant Set Of Policies for User
    -----------------------------------

        Software Installations
        ----------------------
            N/A

        Logon Scripts
        -------------
            N/A

        Logoff Scripts
        --------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            N/A

        Folder Redirection
        ------------------
            N/A

        Internet Explorer Browser User Interface
        ----------------------------------------
            N/A

        Internet Explorer Connection
        ----------------------------
            N/A

        Internet Explorer URLs
        ----------------------
            N/A

        Internet Explorer Security
        --------------------------
            N/A

        Internet Explorer Programs
        --------------------------
            N/A

我从上面的输出中得到这个：

域名：DESKTOP-I53IU6C

也许我将域名与域控制器名称混淆了？

我从 MSDN tutorial 复制并粘贴代码：

#ifndef UNICODE
#define UNICODE
#endif

#include <stdio.h>
#include <stdlib.h>  // for _wtoi function
#include <assert.h>
#include <windows.h>
#include <lm.h>

// Need to link with netapi32.lib
#pragma comment(lib, "netapi32.lib")

int wmain(int argc, wchar_t * argv[])
{

    NET_API_STATUS nStatus;

    LPCWSTR lpServer = NULL;
    LPCWSTR lpDomain = NULL;

    LPCWSTR lpDcName = NULL;

    if (argc != 3 ) {
        wprintf(L"Usage: %ws <ServerName> <DomainName>\n",
                argv[0]);
        wprintf(L"     %ws Myserver Domain\n", argv[0]);
        exit(1);
    }

    // lpServer = argv[1];
    // lpDomain = argv[2];

    wprintf(L"Calling NetGetDCName with parameters\n");
    wprintf(L"    lpServer = %ws\n", lpServer);
    wprintf(L"    lpDomain = %ws\n", lpDomain);

    //
    // Call the NetGetDCName function
    //
    nStatus = NetGetDCName(lpServer, lpDomain, (LPBYTE *) &lpDcName);
    //
    // If the call succeeds,
    //
    if (nStatus == NERR_Success) {
        wprintf(L"NetGetDCName was successful\n", nStatus);
        wprintf(L"DC Name = %ws\n", lpDcName);
        // Need to free the returned buffer
        nStatus = NetApiBufferFree( (LPVOID) lpDcName);
        if (nStatus != NERR_Success)
            wprintf(L"NetApiBufferFree failed with error: %lu (0x%lx)\n",
                nStatus, nStatus);
    } else {
        wprintf(L"NetGetDCName failed with error: %lu (0x%lx)\n", nStatus,
                nStatus);
        wprintf(L"   Error = ");
        switch (nStatus) {
        case ERROR_INVALID_PARAMETER:
            wprintf(L"ERROR_INVALID_PARAMETER\n");
            break;
        case ERROR_NO_SUCH_DOMAIN:
            wprintf(L"ERROR_NO_SUCH_DOMAIN\n");
            break;
        case ERROR_NOT_SUPPORTED:
            wprintf(L"ERROR_NOT_SUPPORTED\n");
            break;
        case ERROR_BAD_NETPATH:
            wprintf(L"ERROR_BAD_NETPATH\n");
            break;
        case ERROR_INVALID_COMPUTERNAME:
            wprintf(L"ERROR_INVALID_COMPUTERNAME\n");
            break;
        case DNS_ERROR_INVALID_NAME_CHAR:
            wprintf(L"DNS_ERROR_INVALID_NAME_CHAR\n");
            break;
        case DNS_ERROR_NON_RFC_NAME:
            wprintf(L"DNS_ERROR_NON_RFC_NAME\n");
            break;
        case ERROR_INVALID_NAME:
            wprintf(L"ERROR_INVALID_NAME\n");
            break;
        case NERR_DCNotFound:
            wprintf(L"NERR_DCNotFound\n");
            break;
        case NERR_WkstaNotStarted:
            wprintf(L"NERR_WkstaNotStarted\n");
            break;
        case RPC_S_SERVER_UNAVAILABLE:
            wprintf(L"RPC_S_SERVER_UNAVAILABLE\n");
            break;
        case RPC_E_REMOTE_DISABLED:
            wprintf(L"RPC_E_REMOTE_DISABLED\n");
            break;
        default:
            wprintf(L"Other error, see Winerror.h or lmerr.h)\n");
            break;
        }
    }

    return nStatus;
}

我只注释掉了命令行参数以将它们保持为 NULL：

    // lpServer = argv[1];
    // lpDomain = argv[2];

指向指定 DNS 或 NetBIOS 名称的常量字符串的指针 执行函数的远程服务器。 如果这样 参数为NULL，使用本地计算机。

指向指定域名称的常量字符串的指针。 域名必须是 NetBIOS 域名（例如， 微软）。 NetGetDCName 不支持 DNS 样式名称（对于 例如，microsoft.com）。 如果该参数为NULL，函数 返回主域的域控制器的名称。

我得到的错误：

NERR_DCNotFound

为什么命令行参数给了我一个域名，但是 WinAPI 失败了，或者它们是两个不同的东西，名字相似？

谢谢！

Answer 1

您可以先调用LsaQueryInformationPolicy 和PolicyDnsDomainInformation 或PolicyPrimaryDomainInformation 来获取计算机primary domain。

如果POLICY_DNS_DOMAIN_INFO 或POLICY_PRIMARY_DOMAIN_INFO 的Sid 成员（主域的SID）为0 - 这意味着系统没有主域。在这种情况下，我们需要查询account domain：

在不属于网络的系统上，因此没有主系统 域，帐户域用于容纳所有提供 访问计算机。

为此，我们需要使用PolicyAccountDomainInformation 调用LsaQueryInformationPolicy 并获得POLICY_ACCOUNT_DOMAIN_INFO 结构

#include <Ntsecapi.h>

NTSTATUS PrintDomainName()
{
    LSA_HANDLE PolicyHandle;

    static LSA_OBJECT_ATTRIBUTES oa = { sizeof(oa) };

    NTSTATUS status = LsaOpenPolicy(0, &oa, POLICY_VIEW_LOCAL_INFORMATION, &PolicyHandle);

    if (LSA_SUCCESS(status))
    {
        union {
            PPOLICY_DNS_DOMAIN_INFO ppddi;
            PPOLICY_ACCOUNT_DOMAIN_INFO ppadi;
        };

        if (LSA_SUCCESS(status = LsaQueryInformationPolicy(PolicyHandle, PolicyDnsDomainInformation, (void**)&ppddi)))
        {
            if (ppddi->Sid)
            {
                DbgPrint("DnsDomainName: %wZ\n", &ppddi->DnsDomainName);
            }
            else
            {
                DbgPrint("%wZ: not domain controller !!\n", &ppddi->Name);
                status = -1;
            }

            LsaFreeMemory(ppddi);

            if (0 > status)
            {
                if (LSA_SUCCESS(status = LsaQueryInformationPolicy(PolicyHandle, PolicyAccountDomainInformation, (void**)&ppadi)))
                {
                    DbgPrint("DomainName: %wZ\n", &ppadi->DomainName);
                    LsaFreeMemory(ppadi);
                }
            }
        }

        LsaClose(PolicyHandle);
    }

    return status;
}

我得到了下一个输出：

WORKGROUP: not domain controller !!
DomainName: DESKTOP-2N5ODLB