Domain controller

A server that runs Active Directory and handles sign-ins, security policies and permissions for the computers and users on a Windows business network.

When an employee logs in to a company Windows computer joined to a domain, the domain controller checks their credentials and applies the settings and permissions assigned to them. It also stores the Active Directory database that defines users, groups and computers. Many organizations run two or more domain controllers so that one failure does not prevent everyone from signing in.

Because a domain controller holds the keys to the whole network, attackers who gain control of it can usually access everything. In many ransomware incidents, criminals work their way to the domain controller and use it to push malware to every computer at once. Older, unpatched domain controllers are a particular concern for small businesses that set up a server years ago and have not revisited it.

Practical tip: keep domain controllers fully patched and running a supported Windows Server version, limit who can sign in to them, never use them for browsing or email, and make sure they are included in your tested backups.