How do we protect our domain controller or directory server?

Treat it as the most valuable system you have, because whoever controls it controls every account. Limit who can log in to it: only a few personal admin accounts with phishing-resistant MFA, used from a dedicated admin workstation and never for e-mail or browsing. Keep it patched, run nothing else on it, block its internet access except for what it needs, and let ordinary PCs reach it only on the ports that authentication requires, not for remote desktop or admin shares. Keep an offline, tested backup of the directory and a documented recovery plan, because rebuilding a directory under pressure is hard. Review admin group membership regularly, and watch the directory's own security logs with a tool that reads them. On the network, NetSenX flags new sessions to the domain controller that do not match a host's normal, such as a marketing PC opening a remote session at night, as lateral movement, on every plan. It does not read the directory's logs.

← All 45 questions on Zero trust, identity and segmentationAll topics