If you have installed the free Microsoft RSAT tools, you have access to the ActiveDirectory module. Here is a simple approach to find all domain controllers in your organization:
#requires -Module ActiveDirectory $filter = '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' Get-ADComputer -LDAPFilter $filter
Basically, you can run any LDAP filter query. Simply choose the appropriate cmdlet, i.e. Get-ADComputer, Get-ADUser, or most generic Get-ADObject.
