You find below a bunch of commands to help you in some tasks. I have a A LOT more commands in my bag, so, feel free to ask me in the comments if you need something related to AD/Windows.
wmic computersystem get Model,Name,Manufacturer,SystemType,TotalPhysicalMemory,PrimaryOwnerName
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers
(Get-ADForest).Domains | %{ Get-ADDomainController -Filter * -Server $_ } | Select Name
Get-WmiObject Win32_LogicalDisk -ComputerName remotecomputer -Filter "DeviceID='C:'" | Foreach-Object {$_.Size,$_.FreeSpace}
[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().GlobalCatalogs.Name
nslookup -querytype=SRV _gc._tcp.<domain.com>
(Get-ADForest domain.com).GlobalCatalogs
dsquery * "CN=Partitions,CN=Configuration,DC=domain,DC=com" -scope base -attr msDS-Behavior-Version
Compare with https://msdn.microsoft.com/en-us/library/cc223742.aspx
Get-ADForest | Select Name, ForestMode
Compare with https://msdn.microsoft.com/en-us/library/cc223742.aspx
dsquery * "DC=domain,DC=com" -scope base -attr msDS-Behavior-Version ntMixedDomain
Compare with https://msdn.microsoft.com/en-us/library/cc223743.aspx
Get-ADDomain| Select Name, DomainMode
Compare with https://msdn.microsoft.com/en-us/library/cc223743.aspx
dsquery * "CN=Schema,CN=Configuration,DC=domain,DC=com" -scope base -attr objectVersion
orschupgr
Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion
nslookup -querytype=NS <domain.com>
\\live.sysinternals.com\tools\Psinfo.exe -s /accepteula > %userprofile%\Desktop\_psinfo.txt
\\live.sysinternals.com\tools\Psinfo.exe -s /accepteula \\computername > %userprofile%\Desktop\remote_psinfo.txt
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine" | find /i "OU="
runas /netonly /user:domain\administrator "mmc dsa.msc /server=<IPAddress>"
Get-ADObject -SearchBase (Get-ADForest).PartitionsContainer -LDAPFilter "(&(objectClass=crossRef)(systemFlags=3))" -Property dnsRoot, nETBIOSName, whenCreated | Sort-Object whenCreated | Format-Table dnsRoot, nETBIOSName, whenCreated -AutoSize
.\PsExec.exe -accepteula \computer gpresult /R /user:domain\name /p
Note: only the computer gpresult will be returned if you don’t fill the user
certutil -dump
orcertutil -config - -ping
Check the Users\Cert Publishers AD group
Run AD Sites and Services (dssite.msc) > View > Show services node
Then Services > Public Key Services > Certification Authorities
Run adsiedit.msc. Connect to Configuration partition > Services -> Public Key Services -> Enrollment Services
Certutil -view -out "Requesterame,NotAfter,NotBefore,CertificateTemplate"