Inside Out Security Blog   /  

What is a Domain Controller, When is it Needed + Set Up

What is a Domain Controller, When is it Needed + Set Up


    A domain controller is a server that responds to authentication requests and verifies users on computer networks. Domains are a hierarchical way of organizing users and computers that work together on the same network. The domain controller keeps all of that data organized and secured.

    The domain controller (DC) is the box that holds the keys to the kingdom- Active Directory (AD). While attackers have all sorts of tricks to gain elevated access on networks, including attacking the DC itself, you can not only protect your DCs from attackers but actually use DCs to detect cyberattacks in progress.

    Get the Free Pen Testing Active Directory Environments EBook

    What is The Main Function of a Domain Controller?

    domain controller use

    The primary responsibility of the DC is to authenticate and validate user access on the network. When users log into their domain, the DC checks their username, password, and other credentials to either allow or deny access for that user.

    Microsoft Active Directory or Microsoft AzureAD are the most common examples, while Samba is the Linux based equivalent DC.

    Why is a Domain Controller Important?

    Domain controllers contain the data that determines and validates access to your network, including any group policies and all computer names. Everything an attacker could possibly need to cause massive damage to your data and network is on the DC, which makes a DC a primary target during a cyberattack.

    Domain Controller vs. Active Directory


    Active Directory is a type of domain, and a domain controller is an important server on that domain. Kind of like how there are many types of cars, and every car needs an engine to operate. Every domain has a domain controller, but not every domain is Active Directory.

    Do I Need a Domain Controller?

    In general, yes. Any business – no matter the size – that saves customer data on their network needs a domain controller to improve security of their network. There could be exceptions: some businesses, for instance, only use cloud based CRM and payment solutions. In those cases, the cloud service secures and protects customer data.

    The key question you need to ask is “where does my customer data live and who can access it?”

    The answer determines if you need a domain – and DC – to secure your data.

    domain controller benefits and limitations

    Benefits of Domain Controller

    • Centralized user management
    • Enables resource sharing for files and printers
    • Federated configuration for redundancy (FSMO)
    • Can be distributed and replicated across large networks
    • Encryption of user data
    • Can be hardened and locked-down for improved security

    Limitations of Domain Controller

    • Target for cyberattack
    • Potential to be hacked
    • Users and OS must be maintained to be stable,  secure and up-to-date
    • Network is dependent on DC uptime
    • Hardware/software requirements

    How to Set Up a Domain Controller + Best Practices

    best practices for setting up a domain controller

    • Configure a stand-alone server for your domain controller.
      • If you are using Azure AD as your domain controller you can ignore this step.
      • If not, your DC should act exclusively as a DC.
    • Limit both physical and remote access to your DC as much as possible.
      • Consider local disk encryption (BitLocker)
      • Use GPOs to provide access to the SysAdmins in charge of administering Active Directory, and allow no other users to log in, either on the console or via Terminal Services.
    • Standardize your DC configuration for reuse

    Setting up a secure and stable DC doesn’t not mean you are secure forever. Attackers will still try to hack into your DC to escalate privileges or enable lateral movement throughout your network. Varonis monitors AD for out-of-policy GPO changes, Kerberos attacks, privilege escalations, and more.

    Want to see how it works? Get a personalized 1:1 demo to how Varonis protects DCs and Active Directory from cyberattacks.

    What you should do now

    Below are three ways we can help you begin your journey to reducing data risk at your company:

    1. Schedule a demo session with us, where we can show you around, answer your questions, and help you see if Varonis is right for you.
    2. Download our free report and learn the risks associated with SaaS data exposure.
    3. Share this blog post with someone you know who'd enjoy reading it. Share it with them via email, LinkedIn, Twitter, Reddit, or Facebook.

    Get a free Risk Assessment

    You can't protect what you don't know is vulnerable.

    Give us 90-minutes of your time, and we'll create a Free Risk Assessment that will open your eyes to your unknown weak spots—fast, and without adding work to your plate.

    Start Your Risk Assessment