list domains in an ActiveDirectory forest

to list all available domains in an AD forest (e.g. to figure out their NetBIOS names and/or map them to DNS-FQDN), have a look at the search base “CN=Partitions,CN=Configuration,“, e.g.:

ldapsearch -x \
    -b “CN=Partitions,CN=Configuration,dc=my,dc=domain,dc=local” \
    -D “ldap@my.domain.local” \
    -h my.domain.local  \
    -W “(name=*)”

Note: accessing the global catalog (see ActiveDirectory and the global catalog) of your AD using port 3268 will return the domain-partitions, but the important attributes like “nETBIOSName” and “dnsRoot” will be missing there!