DomainController

A domain controller is a server that runs directory service software to manage domain security and identity within a Windows network. It hosts Active Directory Domain Services (AD DS) and is responsible for authenticating users and computers, authorizing access to resources, and applying security policies within a domain.

Domain controllers store the AD DS database, including user and computer accounts, group memberships, passwords, and policy data. They provide directory services to clients through protocols such as LDAP for directory lookups and Kerberos for authentication, with DNS integration to locate services. Domain controllers also enforce Group Policy objects to apply security settings, software installations, and configuration changes across devices in the domain.

In typical deployments, multiple domain controllers exist in a domain to provide fault tolerance and load distribution. They replicate directory data to keep information consistent across the domain and forest. Some domain controllers may function as Global Catalog servers, supporting fast searches across multiple domains. The forest’s specialized coordination tasks are governed by Flexible Single Master Operations (FSMO) roles, including the PDC Emulator, which are assigned to one or more domain controllers.

Security and maintenance considerations include restricting physical and network access to domain controllers, applying updates promptly, backing up the AD DS database, and monitoring replication health. Administrators manage domain controllers using administrative tools and interfaces, and promoting servers to or removing them from the domain requires appropriate privileges and careful planning.