title: How to get FQDN of a Target User's (Different) Domain?
body: <p>How can I get the Fully Qualified Domain Name (FQDN) for a user on a different, trusted domain?</p>
  
  <p>Normally, I would ask said user to take any one of the approaches outlined <a href="http://help.migraven.com/en/find-fqdn/" rel="nofollow noreferrer">here</a> (e.g. <code>whoami /fqdn</code> or <code>echo %userDNSdomain%</code>), but if this approach isn't available for whatever reason (e.g. the account is a proxy account that I am unable to log in with interactively, the company I'm working for was acquired and the new owners aren't as forthcoming, etc.), is there a way I can get this different user account's FQDN?</p>
  
  <p>Alternatively, taking the approach of "emulating" the FQDN being returned by my user credentials is also prone to error.  Take for example the output of running <code>whoami /fqdn</code> as my user:</p>
  
  <pre><code>C:\Users\john.eisbrener&gt;whoami /fqdn
  CN=John M. Eisbrener,OU=Standard Users,OU=Resources,DC=CONTOSO,DC=COM
  </code></pre>
  
  <p>I <em>could</em> conceptually adjust the <code>CONTOSO</code> Domain Component to the other, trusted domain, with the expectation that it follows the same structure, but that would be short sighted as not all domains follow the same naming convention.  I've seen too many trusted domains using <code>.org</code> or including additional domain prefix or suffixes within their LDAP root path.</p>
  
  <p>The main driver to all of this is that I need to pass the proper Domain Components to the following PowerShell queries which I rely on when trying to find what user groups and user names may need to be added to certain security groups, file paths, etc.</p>
  
  <pre><code>## List Groups for a Username
  $domainName = 'CONTOSO'
  $domainSuffix = 'COM'
  $username = 'john.eisbrener'
  (New-Object System.DirectoryServices.DirectorySearcher((New-Object System.DirectoryServices.DirectoryEntry("LDAP://dc=$($domainName),dc=$($domainSuffix)")), "(&amp;(objectCategory=User)(samAccountName=$($username)))")).FindOne().GetDirectoryEntry().memberOf | % { (New-Object System.DirectoryServices.DirectoryEntry("LDAP://"+$_)) } | Sort-Object sAMAccountName | SELECT @{name="Group Name";expression={$_.Name}},@{name="Group sAMAccountName";expression={$_.sAMAccountName}}
  
  
  ## List Members in a Group
  $domainName = 'CORP'
  $domainSuffix = 'ORG'
  $groupname = 'RemoteUsers'
  (New-Object System.DirectoryServices.DirectoryEntry((New-Object System.DirectoryServices.DirectorySearcher((New-Object System.DirectoryServices.DirectoryEntry("LDAP://dc=$($domainname),dc=$($domainSuffix)")), "(&amp;(objectCategory=Group)(name=$($groupname)))")).FindOne().GetDirectoryEntry().Path)).member | % { (New-Object System.DirectoryServices.DirectoryEntry("LDAP://"+$_)) } | Sort-Object sAMAccountName | SELECT @{name="User Name";expression={$_.Name}},@{name="User sAMAccountName";expression={$_.sAMAccountName}}
  </code></pre>
  
  <p>Why can't I install any other components or modules?  The computer I'm using is pretty vanilla and doesn't have any extra PowerShell modules or mmc snapins (e.f. <code>dsa.msc</code>) available because my user account doesn't have sufficient privileges to install software.  </p>
  
  <p>My current approach to get the FQDN of this other user's domain is to setup a Windows Scheduled Task running as said user, saving the output of the aforementioned <code>whoami /fqdn</code> or <code>echo %userDNSdomain%</code> commands to a text file, but this seems a bit kludgy and I was hoping for a simple one-liner that I could run from the command prompt or a PowerShell prompt.  Any suggestions would be appreciated.</p>
  
  <p>Final note, my apologies if my terminology is incorrect or leading to confusion.  I'm open to any edits to this from someone that understands what I'm asking.</p>