Scan All TCP and UDP (AD)
checklist
Walkthrough
Scan the full TCP range plus the top UDP ports so no AD service is missed. Open ports like 88, 389, 445, and 5985 confirm a domain controller and your enumeration vectors.
Commands
bash
nmap -p- -sU --top-ports 100 <IP>