Microsoft® Windows® Security Resource Kit, Second Edition

Threats to Domain Controllers

Windows domain controllers are likely targets of attacks that attempt to compromise user and computer accounts, as well as other objects stored within Active Directory. Specifically, Windows 2000 and Windows Server 2003 domain controllers face the following threats:

• Modification or addition of Active Directory objects

• Password attacks

• Denial-of-service attacks

• Replication prevention attacks

• Exploitation of known vulnerabilities

Modification or Addition of Active Directory Objects

If attackers can compromise a domain controller, they can effectively make any changes or additions they want to Active Directory. This includes the deletion or modification of existing objects and the creation of new objects in Active Directory. ...