Domain Controllers and Their Role Brief
What It Is
A domain controller is a server that runs Active Directory Domain Services and acts as the central authority for authentication, authorization, and policy in a Windows domain. It verifies logins, answers group membership questions, and distributes Group Policy for every computer and user in scope.
Mental Model
Think of a domain controller as the records office and gatekeeper for a large organization at once. Every employee's file, credentials, department, and access level lives in that one office, and every door checks with it before letting someone through instead of keeping its own guest list. Compromise the records office, and you compromise the trust of everything that relies on it.
What a Domain Controller Holds and Runs
- NTDS.dit: the database file holding every AD object, including every account's password hash
- Authentication: verifies credentials for every login in the domain
- Authorization: answers group membership and access questions for applications and services
- Group Policy: stores and distributes GPOs that configure every in-scope computer and user
- DNS: frequently co-located, since AD relies on DNS for clients to locate Kerberos and LDAP
- Redundancy: production domains typically run multiple domain controllers that replicate a full copy of the database to each other
Service Fingerprint on a Scan
- LDAP: 389 (and 636 for LDAP over TLS)
- Kerberos: 88
- Kerberos password change (kpasswd): 464
- DNS: 53
- Also typically present: Microsoft RPC on 135 and SMB on 445
- This combination together is a strong signal you are looking at a domain controller rather than an ordinary member server
Interview Phrasing
A domain controller is the server that hosts Active Directory Domain Services and acts as the central authority for authentication, authorization, and policy in a Windows domain. It stores the AD database, NTDS.dit, which holds every user and computer account along with their password hashes, and it processes login requests, group membership checks, and Group Policy distribution for the entire domain. It is the highest-value target in an AD environment because it centralizes trust: every machine that joins the domain defers its authentication and policy decisions to it instead of maintaining that information locally. You can typically identify one on the network by its service fingerprint: LDAP on 389/636, Kerberos on 88, kpasswd on 464, DNS on 53, alongside RPC and SMB.
Common Pitfalls
- Thinking of the domain controller as just a server that logs people in: it also stores every account's password hash, enforces Group Policy, and holds the schema
- Assuming password hashes are only reachable with physical access: replication protocols can expose the same data remotely to a sufficiently privileged account
- Believing there is exactly one domain controller per domain: production domains typically run several, replicated, so compromising any one is still enough
- Overlooking DNS as part of the job: a domain controller that looks like just a directory server is usually also running the network's name resolution
