Why would a normal workstation connect to the domain controller at night?
Most workstation traffic to a domain controller is harmless: logins, group policy, time synchronisation and name resolution happen around the clock, at night too. What is not normal is a workstation opening an interactive remote session to the domain controller, such as remote desktop or remote management, or using administrative shares on it, especially from a computer that belongs to someone outside IT and at an hour when nobody works. That is a typical step before an attacker takes over the directory, creates accounts or pushes ransomware everywhere. Restrict administrative access to domain controllers to a few dedicated administration machines. NetSenX flags such new host-to-host administrative sessions as lateral movement on every plan, and from the Pro plan links them with the scanning that often comes first.