PowerView Get-NetDomain

Import-Module .\PowerView.ps1; Get-NetDomain

Gets current domain information (name, SID, DCs, policy) using PowerView.

Initial AD recon phase from a compromised Windows machine. Get-NetDomain gives you domain context: name, SID, controllers, and policy time. It's the first step for any AD enumeration.

If you already know the domain info or if you're on Linux, use ldapsearch or BloodHound.py.