What is a Domain Controller?
A Domain Controller (DC) is a Windows Server running the Active Directory Domain Services (AD DS) role that stores the directory database of a domain, authenticates users and computers, and distributes group policy. Every Active Directory environment runs on at least one domain controller, and should have at least two for availability. Because HMIs, SCADA servers, historians and engineering stations usually run Windows, the domain controller also sits at the heart of many OT networks. Whoever takes over a DC controls the entire domain, which makes it the most critical server in a Windows environment.
🧠 What does a Domain Controller do?
A domain controller combines several tasks that together form the foundation of identity and access management:
- Storing the directory - the NTDS.dit database holds all users, groups, computers and their password hashes. The SYSVOL folder holds the Group Policy files and logon scripts.
- Authentication - at sign-in, the DC checks the password, smart card or Windows Hello key and issues a Kerberos ticket. With that ticket the user signs in to other systems in the domain without entering a password again (single sign-on). The older NTLM method remains only as a fallback.
- Supplying group membership - the Kerberos ticket carries the user’s groups. The server or application the user connects to decides on access based on them. This is the basis for RBAC.
- Distributing policy - computers and users fetch their Group Policy Objects (GPOs) from the DC.
- Name resolution - clients locate a DC through SRV records in DNS. The DNS role therefore often runs on the DC itself.
- Replication - all writable DCs accept changes and replicate them to each other, so that any DC can sign a user in.
Kerberos is sensitive to time differences: by default, a clock may deviate by no more than 5 minutes. The DC holding the PDC emulator role in the forest root domain is therefore the top time source of the forest, and should itself have a reliable NTP source.
🔧 What types of domain controllers and roles exist?
| Type or role | What it is | When to use it |
|---|---|---|
| Writable DC | Full copy of the domain database, accepts changes | Default in the data centre and the central OT zone |
| Read-Only Domain Controller (RODC) | Read-only copy, since Windows Server 2008, stores no passwords by default | Locations with weak physical security, such as an outstation or a small branch |
| Global Catalog | DC holding a full copy of its own domain plus a partial, searchable copy of every object in the other domains of the forest | Needed for sign-in and searches across domains |
| FSMO role holder | DC performing one of the five unique tasks (schema, domain naming, RID, PDC emulator, infrastructure) | The first DC in the forest holds all five; distribute them deliberately |
| Virtualised DC | DC as a virtual machine, with VM-GenerationID protection since Windows Server 2012, provided the hypervisor supports it | Common, provided it runs on separate, well-protected hosts |
Since Windows Server 2012, the old dcpromo has been replaced by Server Manager and PowerShell
(Install-ADDSForest, Install-ADDSDomainController). Windows Server 2025
introduced a new functional level and an optional 32k database page instead of 8k, but that can only be
enabled once every DC in the forest supports it. The cloud service Entra ID (Azure AD until 2023) is not a domain controller: it provides identity for cloud
applications and can synchronise with AD through Entra Connect.
🏭 How are domain controllers used in OT?
In factories, water treatment plants and energy installations, a domain controller provides, among other things:
- Personal accounts on SCADA, HMI and engineering stations instead of a shared operator account, so that logging shows who changed a PLC program.
- Role-based access - many SCADA and DCS packages map operator, engineer and administrator roles to AD groups.
- Uniform hardening through GPOs: blocking USB storage, screen locking, firewall rules and Windows LAPS for unique local administrator passwords.
- Controlled supplier access - supplier accounts active only during maintenance, via a jump server.
- Sign-in events sent to a SIEM or OT SOC for auditing and detection.
The common architecture is a separate OT domain with its own DCs at level 3 (site operations) of the Purdue Model, independent of the IT domain. Extending the IT domain into the OT network, or placing a DC in the IDMZ (the industrial DMZ) that serves both worlds, is a well-known mistake: an attacker with administrator rights in IT then reaches the plant floor directly. Administration runs through a jump server in the IDMZ, and there is preferably no trust relationship between the OT domain and the IT domain.
🔐 Why are domain controllers a prime target?
A DC can read and write anything in the directory. Microsoft states that once a DC is compromised, the forest can never be trusted again unless you recover from a known good backup and close the gap. Well-known attack patterns:
| Attack | What happens | Countermeasure |
|---|---|---|
| Stealing NTDS.dit | Copy of the database via Volume Shadow Copy; all hashes captured. Volt Typhoon did this in critical infrastructure |
No administration from ordinary workstations, monitoring for vssadmin and ntdsutil
|
| DCSync | An attacker with replication rights requests hashes as if it were a DC | Restrict replication rights, detect replication requests from non-DCs |
| Golden Ticket | With the hash of the krbtgt account, an attacker forges Kerberos tickets | Reset the krbtgt password twice, at least 10 hours apart |
| GPO abuse | Ransomware spreads to every machine through a GPO | Restrict edit rights on GPOs, monitor changes |
| Lateral Movement | An administrator sign-in on an infected workstation leaves credentials behind | Tier model: domain admins sign in only on Tier 0 systems |
During NotPetya in 2017, every online DC at Maersk was wiped. Recovery was only possible thanks to a single DC in Ghana that happened to be offline because of a power cut. It shows why an offline or immutable backup of a DC is indispensable.
🛠️ How do you secure a Domain Controller in practice?
A practical approach based on Microsoft guidance and IEC 62443:
- Treat DCs as Tier 0 - together with PKI, AD FS and backup systems. Only administrators with a separate Tier 0 account, from a hardened admin workstation, with MFA or a smart card, and through PAM where possible.
- Minimise the server - Server Core, no extra software, no web browser and no outbound internet traffic. Do not put other roles such as a historian or file server on a DC, and apply the Microsoft Security Baselines.
- Patch separately and quickly - manage DCs apart from general patch management, so that a compromised management tool cannot reach the DCs as well. Critical vulnerabilities such as Zerologon (CVE-2020-1472) must be closed with priority.
- Restrict the network - DCs in their own segment behind a firewall. Clients mainly need: 53 (DNS), 88 (Kerberos), 135 and dynamic RPC, 389/636 (LDAP/LDAPS), 445 (SMB), 464 (password change) and 3268/3269 (Global Catalog).
- Strengthen protocols - enforce LDAP signing and channel binding, enable SMB signing, phase out NTLM and place administrators in the Protected Users group.
- Monitor - forward security events such as 4624, 4672, 4728 and 4769 to the SIEM and alert on changes to administrative groups. Also review the membership of privileged groups periodically (access review).
- Test backup and restore - system state backups of at least two DCs per domain, stored offline. A backup older than the tombstone lifetime (180 days by default) is unusable. Rehearse the restore as part of disaster recovery.
| Setting | Typical value |
|---|---|
| Number of DCs per domain | At least 2, even in a small OT domain |
| Maximum Kerberos clock skew | 5 minutes |
| Kerberos ticket lifetime | 10 hours |
| Tombstone lifetime | 180 days (forests from Windows Server 2003 SP1) |
| Replication between sites | Every 180 minutes by default |
🇪🇺 Why does this matter for NIS2 and the Dutch Cybersecurity Act?
For organisations covered by NIS2 and the Dutch Cybersecurity Act, in force since 15 August 2026, access control, MFA and backup fall under the mandatory duty of care. In practice, auditors ask about the management of privileged accounts, separate OT identities and a tested recovery plan for Active Directory. In IEC 62443-3-3, the requirements for identification and authentication (FR 1) and use control (FR 2) map directly onto a well-configured domain controller. For Compliance and access management, the DC is the evidence: who was allowed to sign in where, and when?
❓ Frequently asked questions
What is the difference between a Domain Controller and Active Directory?
Active Directory is Microsoft’s directory service; a domain controller is the server on which that service runs. An Active Directory domain therefore consists of one or more domain controllers that replicate the same database between them.
How many domain controllers does a domain need?
A domain needs at least two domain controllers, so that sign-in keeps working during maintenance or a failure. Even a small OT domain therefore gets two DCs, preferably on different hosts or at different locations.
Can a Domain Controller run as a virtual machine?
A domain controller can run as a virtual machine; since Windows Server 2012, VM-GenerationID protects against problems when snapshots are restored. Microsoft does advise placing virtual DCs on hosts that are separate from less critical virtual machines.
What is a Read-Only Domain Controller (RODC)?
An RODC is a domain controller with a read-only copy of the database that stores no passwords by default. An RODC suits locations with weak physical security, because theft of the server does not expose every password hash in the domain.
Does a domain controller from the IT domain belong in the OT network?
A domain controller from the IT domain does not belong in the OT network. The common approach is a separate OT domain with its own domain controllers in the OT zone, administered through a jump server in the IDMZ.
What should you do after a Domain Controller is compromised?
After a domain controller is compromised, the whole forest is untrustworthy. Recover from a known good backup, reset the krbtgt password twice at least 10 hours apart and reset all privileged accounts, as set out in the incident response plan.
📌 In summary
- A domain controller stores the Active Directory database, authenticates users with Kerberos and distributes group policy.
- There are writable DCs, RODCs, Global Catalogs and FSMO role holders; every domain needs at least two.
- OT needs a separate OT domain with its own DCs, administered through the IDMZ, without extending the IT domain.
- Protect DCs as Tier 0: minimal installation, separate admin accounts, fast patching, monitoring and tested offline backups.
A Domain Controller is the pivot of access management in a Windows network: whoever controls the DC controls the domain, which is why it deserves the strongest protection in both IT and OT security architecture.