What happens if someone steals one of my additional domain controllers? What information could an attacker get from my domain controller?


Your domain controller needs to be able to authenticate users. So it needs to be able to verify user/password combinations. Thus it needs to store password information.

This is not stored in plain text, but worst case people will eventually crack those.
Having an DC get stolen is therefor a bad thing.

The DC will also contains lots of other information, such as computer IDs, security groups, membership to security groups, DL list, ... All things which you might not intend to share but not as bad as the [domain admin] passwords.

| improve this answer | |
  • So ... if I notice such a theft in due time and imediately change all Administrator and high-privilege passowrds, and urge all users to change their passwords asap, the situation id not that bad? Won't computer accounts pose a problem (after all those are also authenticated against AD)? Especially those of my remaining DCs? – Hagen von Eitzen May 27 '15 at 16:42
  • Not sure. I would not feel safe, since the thief would indeed have the computer accounts and the SID of the domain (all domain controllers share that). But I think that there is also a time limited encoding. However for this I am out of my depth. – Hennes May 27 '15 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.