How can regular domain users obtain DNS records without DNS admin privileges?

Regular domain users can obtain DNS records using two main approaches: first, by querying LDAP for computer names and then resolving their IP addresses via DNS queries (tools like [SharpAdidnsdump](https://github.com/b4rtik/SharpAdidnsdump) and [adidnsdump](https://github.com/dirkjanm/adidnsdump) implement this); second, by directly extracting DNS records from LDAP and decoding the binary data (as done by [dns-dump](/news/domain-penetration-dns-records-and-machineaccount) and PowerView). These methods are covered in detail in the article [Domain Penetration - Obtaining DNS Records with Regular User Privileges](/news/domain-penetration-obtaining-dns-records-with-regular-user-privileges).