Domain Controller Security: Hardening & Attacks

Domain controller security refers to the set of technical controls, attack surfaces, and defensive measures specific to Active Directory domain controllers. A domain controller is the authoritative server for authentication, authorization, and group policy distribution across a Windows environment. Compromising a domain controller grants an attacker complete control over every object in the domain. This makes domain controllers the highest-value target in most enterprise networks. Attacks targeting domain controllers exploit Kerberos weaknesses, LDAP misconfigurations, replication protocols, and weak credential storage. DCSync abuses the Directory Replication Service to extract password hashes without touching NTDS.dit directly. Golden Ticket attacks forge Kerberos TGTs using the KRBTGT account hash, enabling persistent, nearly invisible access. Silver Ticket attacks forge service tickets for specific SPNs. ZeroLogon (CVE-2020-1472) exploits a cryptographic flaw in Netlogon to reset the domain controller machine account password. Understanding these attack primitives is foundational for both Red Team operators and defenders building resilient Active Directory architectures.

Detecting domain controller compromises requires monitoring several specific event sources. Event ID 4662 logs access to AD objects and is critical for catching DCSync attempts. A non-domain-controller account requesting replication rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) is a strong DCSync indicator. Event ID 4769 and 4768 track Kerberos ticket requests. Anomalous TGT requests with RC4 encryption from accounts normally using AES128 or AES256 suggest a Golden Ticket. Event ID 4776 covers NTLM authentication attempts against the domain controller. Monitoring LDAP query volumes via ETW traces or Windows LDAP diagnostic logging helps detect AD enumeration from tools like BloodHound or ldapdomaindump. Netlogon logs and LSASS memory access events (Event ID 10 in Sysmon, targeting lsass.exe) help surface credential dumping activity. NTDS.dit shadow copy creation via vssadmin or wmic should trigger alerts. Deploying Microsoft Defender for Identity or a SIEM with AD-specific detection rules covering lateral movement toward domain controllers is essential for any mature SOC.

Red Team operators targeting domain controllers follow structured attack paths. Initial access typically starts with credential theft via LLMNR/NBT-NS poisoning using Responder, followed by Pass-the-Hash or Pass-the-Ticket lateral movement. Mimikatz remains the primary tool for extracting NTLM hashes and Kerberos tickets from LSASS memory. Impacket's secretsdump.py performs DCSync remotely using stolen replication credentials. BloodHound maps attack paths to domain controller compromise by identifying misconfigured ACLs, unconstrained delegation, or overprivileged accounts. Hardening countermeasures include enabling Protected Users security group membership for privileged accounts, disabling NTLM where possible, enforcing Kerberos AES encryption, and implementing Credential Guard to isolate LSASS. Tiered administration models prevent admin credentials from tier-0 assets like domain controllers from being used on lower-trust systems. NTDS.dit should be protected via DSRM password hardening and restricted VSS access. Privileged Access Workstations dedicated to domain controller administration reduce the lateral movement surface significantly. Regular audits of replication rights, AdminSDHolder permissions, and SPN configurations are mandatory maintenance tasks.