Nltest

nltest.exe is a signed Windows built-in (living-off-the-land) used to map trust relationships and locate domain controllers from an existing foothold, with no third-party tooling dropped to disk. /domain_trusts /all_trusts lists every trust relationship in the forest, and /dclist:<domain> enumerates the DCs for a domain - both useful for planning cross-domain and cross-forest movement. It runs in the current user's context on any domain-joined host. Command Reference: Domain: test.local

# List all trust relationships in the forest
nltest /domain_trusts /all_trusts
# Enumerate domain controllers for the domain
nltest /dclist:test.local

Evidence

Upstream reference

Environment

Active Directory

Native

Discovery, Enumeration

MITRE

T1482

Requires

Shell

Services

LDAP, Kerberos

Refs

learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)

attack.mitre.org/techniques/T1482/

book.hacktricks.xyz/windows-hardening/active-directory-methodology