Skip to content

Domain controller

Also known as DC

A server that holds the Active Directory database and authenticates users and computers in the domain.

Domain controllers hold the credential material for the whole domain. Administrative control of one is effectively administrative control of every domain-joined machine, which is why they are the objective in most internal penetration tests.

They deserve treatment as a separate tier: no general-purpose software, no web browsing, restricted network access, and administration only from dedicated hardened workstations.

Where this comes up

Domain controller sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Identity and access management Ask an engineer

Related terms

Active Directory Microsoft's on-premises directory service, running on domain controllers and governing Windows domain authentication. Kerberoasting Requesting service tickets from Active Directory and cracking them offline to recover service account passwords. Lateral movement The stage where an attacker moves from the machine they first landed on toward the systems they actually want. Tiered administration Separating administrative accounts by the sensitivity of what they manage, so high-value credentials never touch low-trust machines.

More in identity and access

Access reviewBreak-glass accountConditional accessConsent phishingDevice complianceEntra ID P2FIDO2Guest account

Back to the full glossary →

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.