Domain Controller: attacks & hardening

A domain controller is a Windows server running Active Directory Domain Services (AD DS), responsible for authenticating users, enforcing Group Policy, and managing access to all resources within a Windows domain. Every domain controller stores a local copy of the NTDS.dit database, which contains password hashes for every domain account, including privileged ones. Because the domain controller acts as the central trust authority, it is the highest-value target in any Windows enterprise network. Compromising a single domain controller grants an attacker the ability to forge Kerberos tickets, replicate directory data, and pivot to every machine in the forest. The attack surface includes exposed RPC endpoints, replication protocols such as MS-DRSR, and Kerberos itself. Understanding how a domain controller authenticates principals, issues Ticket Granting Tickets, and replicates data between sites is prerequisite knowledge for both offensive operations and defensive architecture decisions in any organization relying on Active Directory.

Detecting attacks against a domain controller requires precise event log monitoring on the domain controller itself. Event ID 4662 logs object access on AD objects; a spike tied to the 'Replicating Directory Changes' extended right indicates a DCSync attempt from a non-DC account. Event ID 4769 captures Kerberos service ticket requests; RC4 encryption type 0x17 in bulk is a strong kerberoasting signal. Event ID 4776 records NTLM authentication failures, useful for detecting password spray activity. Event ID 4624 with logon type 3 from unusual source IPs may indicate pass-the-hash. Windows Defender Credential Guard alerts, Sysmon Event ID 10 targeting LSASS, and ETW traces for suspicious LSASS memory reads all complement log-based detection. Network-level indicators include unexpected replication traffic on port 135 or 389 from workstations, and Bloodhound-style LDAP enumeration bursts visible in LDAP query logs. Forwarding all domain controller security logs to a SIEM and baselining replication partner behavior are essential first steps for any SOC team monitoring an Active Directory environment.

Red team operators target domain controllers through several well-documented attack paths. DCSync abuses the MS-DRSR replication protocol: using Mimikatz 'lsadump::dcsync', an operator with 'Replicating Directory Changes All' rights can extract all password hashes without touching LSASS directly. Kerberoasting requests service tickets for accounts with SPNs set, then cracks the RC4-encrypted blobs offline with Hashcat. A Golden Ticket attack forges a TGT using the KRBTGT hash, granting persistent domain-wide access even after password resets. NTDS.dit extraction via Volume Shadow Copy ('vssadmin create shadow') and subsequent offline parsing with secretsdump.py bypasses live LSASS protections entirely. Hardening measures include tiering administration so Tier 0 accounts only log into domain controllers, enabling Protected Users security group, enforcing AES-only Kerberos encryption, removing unnecessary SPN accounts, and auditing ACLs on AD objects with tools like BloodHound. Restricting 'Replicating Directory Changes' to legitimate DC computer accounts and deploying Microsoft Defender for Identity to detect replication anomalies significantly reduces the attack surface on every domain controller in the forest.