Nbtstat or how I came to love NetBIOS....

When working on a script this past week I came across a problem when trying to discover a servers domain when not being afforded access permissions. In my case my usual steps all came back with non-usable information.  All FQDN names were exactly the same for the computers on the our "test" domain as well as our "active" domain. All powershell scripts failed to run, due to my permissions, and without a major call to our service desk's API there seemed to be no other viable option for pulling this information. That's when I came across an older operation that fit the bill perfectly.

Nbtstat, according to Microsoft's technet library

is designed to help troubleshoot NetBIOS name resolution problems. When a network is functioning normally, NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses.

Long story short (this explanation doesn't seem short...I think you mean long story longer..I'm so clever -ed.) the TCP/IP stack doesn't understand "flat names" so Windows relies on an application called NetBIOS-Over-TCPIP (NBT) to handle them. When I refer to flat names I'm referring to the friendly names assigned to the computer aka Computer Name.

The NetBIOS-Over-TCPIP (NBT) "registers" the computers name upon Windows startup. This process makes sure that the computers name is unique and doesn't conflict with any other computers on the network. This registration process records this name in a WINS server on the network or by broadcasting the information out and waiting for other computers to complain that the name is being used. The NetBIOS-Over-TCPIP (NBT) also "resolves" other computers names to IP addresses to help with routing in the environment. For my needs it supplied me with the computers domain that I was searching for when running the command nbtstat -a [servername] (See Boxed content - ed.)

As with all things scripting you can easily find the entire list of variables for the command by running nbtstat -? 

This information can be used however you would like. For my purposes I used regular expressions and Powershell to pipe the information into a variable and used that to verified information for several different functions.