Searching for assets not in your AD domain

To search for assets in an Active Directory domain other than the expected domain, you can use the ntlmssp.dnsDomain attribute.

For example, this query will search for all active assets which have a domain, but the domain is not example.com:

alive:t and has:ntlmssp.dnsDomain and not ntlmssp.dnsDomain:example.com