A domain controller is a Windows Server computer with Active Directory Domain Services (AD DS) installed. Domain controllers store the AD DS database and provide the services that let an organization manage its servers, workstations, users, and applications.
What a domain controller stores
By default, a domain controller stores the directory partition for its own domain, plus the schema and configuration partitions for the whole forest. Every domain controller in a domain holds a complete copy of that domain's directory data. A change made on one is replicated to all the others.
AD DS stores user account information such as names and passwords. The Kerberos Key Distribution Center runs on every domain controller and uses the AD DS database as its account database.
A domain controller designated as a global catalog server also holds a partial, read-only replica of every other domain in the forest. AD DS directs searches to global catalog servers by default. The first domain controller in a forest becomes a global catalog server automatically.
Active Directory is a multi-master database: changes can be processed at any domain controller. Updates to certain objects are processed by a single domain controller to prevent conflicts. These are the five operations master (FSMO) roles: schema master, domain naming master, RID master, PDC emulator, and infrastructure master. A forest has one schema master, and each domain has one RID master.
Read-only domain controllers
A read-only domain controller (RODC) holds read-only partitions of the AD DS database. Microsoft introduced it in Windows Server 2008 for locations where physical security cannot be guaranteed, such as branch offices.
By default, an RODC stores no user or computer credentials except its own computer account and its own krbtgt account. A Password Replication Policy sets which other credentials it may cache. If an RODC is stolen, only the credentials cached on it can potentially be cracked.
Why attackers target them
A domain controller can read from and write to anything in the AD DS database. Privileged access to one lets an attacker modify, corrupt, or destroy that database and every system and account Active Directory manages.
Microsoft says a compromised forest can never be considered trustworthy again unless it is recovered from a known good backup and the gaps that allowed the compromise are closed. It says the damage can be done in minutes or hours.
Microsoft recommends securing domain controllers separately and more stringently than other infrastructure. Its guidance says no web browser should be used on a domain controller. It says internet access to and from domain controllers should be strictly controlled. It recommends considering separate patching for domain controllers.
Domain controllers and Microsoft Entra ID
Microsoft Entra ID is Microsoft's cloud identity and access management service. Microsoft encourages organizations to migrate from Active Directory to Entra ID. Most organizations run a hybrid identity model during that transition, with part of their on-premises Active Directory synchronized through Microsoft Entra Connect.
Entra Connect can synchronize a hash of each user's on-premises AD password to Entra ID. Microsoft names Microsoft Entra Cloud Sync as the replacement for Entra Connect.
Sources
Checked November 5, 2026.
- Microsoft Learn, Domain Controller Roles
- Microsoft Learn, Active Directory Domain Services overview
- Microsoft Learn, Kerberos authentication overview
- Microsoft Learn, Active Directory FSMO roles in Windows
- Microsoft Learn, AD DS: Read-Only Domain Controllers
- Microsoft Learn, Securing Domain Controllers Against Attack
- Microsoft Learn, What is Microsoft Entra Connect