The retired machine can be found here. Official write-up can be downloaded here. I started with some basic scanning with nmap that found that most likely this machine was a Domain Controller, since it had all the required ports open. $ nmap -sC -sV 10.10.10.169 -Pn 53/tcp