A domain controller is a server that responds to authentication requests and verifies users on computer networks. Domains are a hierarchical way of organizing users and computers that work together on the same network. The domain controller keeps all of that data organized and secured.
The domain controller (DC) is the box that holds the keys to the kingdom- Active Directory (AD). While attackers have all sorts of tricks to gain elevated access on networks, including attacking the DC itself, you can not only protect your DCs from attackers but actually use DCs to detect cyberattacks in progress.
Get the Free Pen Testing Active Directory Environments EBook
What is The Main Function of a Domain Controller?
The primary responsibility of the DC is to authenticate and validate user access on the network. When users log into their domain, the DC checks their username, password, and other credentials to either allow or deny access for that user.
Microsoft Active Directory or Microsoft AzureAD are the most common examples, while Samba is the Linux based equivalent DC.
Why is a Domain Controller Important?
Domain controllers contain the data that determines and validates access to your network, including any group policies and all computer names. Everything an attacker could possibly need to cause massive damage to your data and network is on the DC, which makes a DC a primary target during a cyberattack.
Domain Controller vs. Active Directory
ACTIVE DIRECTORY : DOMAIN CONTROLLER :: car : engine
Active Directory is a type of domain, and a domain controller is an important server on that domain. Kind of like how there are many types of cars, and every car needs an engine to operate. Every domain has a domain controller, but not every domain is Active Directory.
Do I Need a Domain Controller?
In general, yes. Any business – no matter the size – that saves customer data on their network needs a domain controller to improve security of their network. There could be exceptions: some businesses, for instance, only use cloud based CRM and payment solutions. In those cases, the cloud service secures and protects customer data.
The key question you need to ask is “where does my customer data live and who can access it?”
The answer determines if you need a domain – and DC – to secure your data.
Benefits of Domain Controller
- Centralized user management
- Enables resource sharing for files and printers
- Federated configuration for redundancy (FSMO)
- Can be distributed and replicated across large networks
- Encryption of user data
- Can be hardened and locked-down for improved security
Limitations of Domain Controller
- Target for cyberattack
- Potential to be hacked
- Users and OS must be maintained to be stable, secure and up-to-date
- Network is dependent on DC uptime
- Hardware/software requirements
How to Set Up a Domain Controller + Best Practices
- Configure a stand-alone server for your domain controller.
- If you are using Azure AD as your domain controller you can ignore this step.
- If not, your DC should act exclusively as a DC.
- Limit both physical and remote access to your DC as much as possible.
- Consider local disk encryption (BitLocker)
- Use GPOs to provide access to the SysAdmins in charge of administering Active Directory, and allow no other users to log in, either on the console or via Terminal Services.
- Standardize your DC configuration for reuse
Setting up a secure and stable DC doesn’t not mean you are secure forever. Attackers will still try to hack into your DC to escalate privileges or enable lateral movement throughout your network. Varonis monitors AD for out-of-policy GPO changes, Kerberos attacks, privilege escalations, and more.
Want to see how it works? Get a personalized 1:1 demo to how Varonis protects DCs and Active Directory from cyberattacks.
Michael Buckbee Michael has worked as a sysadmin and software developer for Silicon Valley startups, the US Navy, and everything in between.
