#
nslookup.exe
Handy for finding resources on internal/external networks.
#
Find domain controllers:
nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN.COM | awk '{ print $7 }' | sed 's/\.$//g' | sed '/^$/d' | sort > dcs.txt