ldapsearch anonymous bind

ldapsearch -x -H ldap://<dc-ip> -s base namingcontexts

Anonymous LDAP query to retrieve naming contexts (domains) from a domain controller.

When you have network access to a DC and want to verify if it allows anonymous queries (rare in modern configurations). If it works, you can obtain the base DN of the domain, which is the first step to enumerate users and groups without authentication.

Most modern DCs have anonymous queries disabled by default (since Windows Server 2003 SP1). Don't waste time if you suspect it's well-configured; go straight to authentication.