Hey guys. I was wondering if you could give me any help on how to find out which of numerous servers in a network is actually the domain controller. That is, I need to find out which server actually has the user accounts, which is apparently not necessarily the same server that hosts all of the file folders for the user accounts. The mapped network folders when you logon to the domain are all on \\red, but apprently the actual user accounts are not on \\red. Is there any way I can find out which server is controlling the domain without already knowing?

logically it'd probably be the first (or towards the first) IP in the subnet

OK. That would make sense. So an address like 10.1.1.1 be the server? \\RED is 10.1.1.10
Also, some of the IP stuff seems to have slipped my mind. Is subnet determined by the first number? Are 10.1.30.195 and 10.1.1.1 in the same subnet?

Here on my network my dns server is the first ip in the block (.1), my secondary router for my vonage line is next (.2); generally admin's will do this as to know percisely where everything is... So you think, start with everything moving up, router 1 (.1), router 2 (.2) etc; eventually you'll make it up to 10 (myself I start private blocks here at .10 while leaving any single digit as network resources)

Use Cain & Abel for network enumeration. It can differentiate between normal client computers, and various important servers, including the domain controller.

The simplest way to find the DC's (Domain Controllers) is to use the 'nltest' utility from the resource kit for the OS that you will be using to make the query - just google for 'nltest' and your host OS, though they are usually on the Windows CD.

Once you have nltest, assuming you are looking for the 'EXAMPLE' domain:

Find all DC's : nltest.exe /dclist:example
Find primary DC : nltest.exe /dcname:example

It has a ton of other options, go play

Ah...ok. Thanks for the replies. I figured out about Cain&Abel's "Domain Controllers" list. Apparently there were three on this particular network (two replicating). Just for reference, the I.P. of the main DC was a .1.14 address. That seems a little strange, but I guess it is a pretty low address. The other two were .1.39 and .1.110 (turns out this was actually red, I got 10 and 110 mixed up) . Turns out my first post was incorrect anyway. red was a domain controller. gold was hosting the files (the network was using kerberos authentication). Thanks.
P.S. it was fairly odd, with apparently one of the color names being the gateway server (i believe this one was .1.10), and a ton of the low numbers being routers.