# Why would a normal workstation connect to the domain controller at night?

Most workstation traffic to a domain controller is harmless: logins, group policy, time synchronisation and name resolution happen around the clock, at night too. What is not normal is a workstation opening an interactive remote session to the domain controller, such as remote desktop or remote management, or using administrative shares on it, especially from a computer that belongs to someone outside IT and at an hour when nobody works. That is a typical step before an attacker takes over the directory, creates accounts or pushes ransomware everywhere. Restrict administrative access to domain controllers to a few dedicated administration machines. NetSenX flags such new host-to-host administrative sessions as lateral movement on every plan, and from the Pro plan links them with the scanning that often comes first.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/why-would-a-workstation-connect-to-the-domain-controller-at-night

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is ARP spoofing, and how do we detect it on a small office network?](https://netsenx.com/en/faq/what-is-arp-spoofing-and-how-to-detect-it)
- [Can someone on our Wi-Fi read other users' traffic?](https://netsenx.com/en/faq/can-someone-on-our-wi-fi-read-other-users-traffic)
- [How much time do we have once ransomware starts touching file shares?](https://netsenx.com/en/faq/how-much-time-once-ransomware-touches-file-shares)
- [Can we see which program on a server made a large upload?](https://netsenx.com/en/faq/can-we-see-which-program-made-a-large-upload)
- [What is a supply chain attack?](https://netsenx.com/en/faq/what-is-a-supply-chain-attack)