Domain controller
noun · also DC · Microsoft Learn: AD DS overview
A Windows server running Active Directory Domain Services: it stores accounts and password hashes and authenticates every sign-in in the domain.
A domain controller (DC) is the heart of an on-premises Active Directory environment. It holds the directory database (NTDS.dit) with every user, computer and group, including password hashes; it runs the Kerberos Key Distribution Center; and it applies Group Policy to the machines in the domain. Organizations run several domain controllers that replicate changes to each other, so the loss of one does not stop sign-ins.
Because a domain controller can authenticate as anyone, control of one means control of the whole domain. Security teams treat domain controllers, and the accounts that can administer them, as Tier 0: the most protected layer, managed only from dedicated, hardened administrative workstations.
Example
An attacker who reaches domain administrator rights does not need to touch every server. They connect to a domain controller, copy the directory database or use replication rights to pull password hashes (a technique called DCSync), and from that moment can impersonate any account in the organization.
Why it matters for a SOC analyst
Domain controller security logs are some of the most important data a SOC collects: Kerberos and NTLM authentication events, changes to privileged groups, replication requests from machines that are not domain controllers, and new services or scheduled tasks on the DCs themselves. Any unexpected interactive logon on a domain controller deserves immediate attention.
Related terms
- Kerberos
The ticket-based authentication protocol used by Active Directory, in which a domain controller issues tickets that prove a user's identity to services.
- NTLM
An older Windows challenge-response authentication protocol, still used as a fallback to Kerberos and a frequent target of relay and pass-the-hash attacks.
- Golden ticket
A forged Kerberos ticket-granting ticket, made with the krbtgt account's key, that lets an attacker impersonate any user in the domain.
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.