A domain controller is a server that runs Active Directory Domain Services and authenticates users and computers, stores their accounts and enforces security policies across a Windows domain.
How a domain controller works
A domain controller (DC) holds a copy of the Active Directory database, the NTDS.dit file, with all user, group and computer accounts and their password hashes. It acts as the Key Distribution Center for Kerberos, answers LDAP queries, distributes Group Policy and replicates changes to the other domain controllers. Larger organisations run several DCs for redundancy.
Why domain controllers are a prime target
Controlling a domain controller means controlling every account and machine in the domain, which is why attackers aim for it during lateral movement. Common techniques include:
- DCSync (MITRE ATT&CK T1003.006) – abusing replication rights to request password hashes of any account, including krbtgt.
- NTDS.dit theft (T1003.003) – copying the database with tools such as ntdsutil or volume shadow copies.
- Golden Ticket attacks – forging Kerberos tickets with the stolen krbtgt hash.
- Exploiting vulnerabilities – Zerologon (CVE-2020-1472) allowed an attacker on the network to take over a DC without any credentials.
Once inside, ransomware operators often use Group Policy on the domain controller to push their encryptor to every computer at the same moment.
How to protect domain controllers
- Patch DCs promptly and do not run other applications on them.
- Keep the number of Domain Admins minimal and use a tiered administration model with dedicated admin workstations.
- Monitor for replication requests from non-DC systems and other suspicious events.
- Back up Active Directory offline and practise forest recovery.
