So what is a domain controller?
A domain controller is a server that stores a copy of the address directory database or NTD as the did
file.
And it also stores a copy of the SES file folder.
All domain controllers except raw disease store read, write copy of both entities.
The date and this well folder entity as the date is a database itself, and the Cicero folder contains
all the templates, settings and files for GPOs or group policy objects.
Domain controllers view the Multi Master replication process to copy data from one domain controller
to another.
This means that for most operations, data can be modified on any domain controller except foreign roads.
See the ads Replication service then synchronizes the changes to the AIDS database with all the other
domain controllers in the domain and Windows Server 2016 and higher.
You can use only distributed file system or DFS replication to replicate this useful folders.
Earlier versions of Windows Server use the file replication service or freeze to replicate the folders,
but if address is replaced for several versions of Windows Domain, controllers host several other services
related to Active Directory.
This includes the Kerberos Authentication Service, which user and computer accounts use for signing
authentication and the key distribution Center or KDC, which issues the ticket grant and ticket to
an account that signs into the Active Directory domain.
Optionally, you can configure domain controllers to host a copy of the Global catalog.
All users in an Active Directory domain exist in the Active Directory database.
If the database is unavailable for any reason, all the operations that depend on domain based authentication
will fail.
So as a best practice and AIDS domain should have at least two domain controllers, this makes the database
more available and spreads the authentication load during peak signing times.
So when planning your infrastructure, please consider two domain controllers as the absolute minimum
for most enterprises to ensure high availability and performance.
Now when you deploy domain controller in a branch office where physical security is less than optimal,
you can use additional measures to reduce the impact of a breach of security.
One option is to deploy an raw DC or redundant the domain controller, which was created exactly for
these purposes.
The RTC contains a read only copy of the ated database and by default it does not cache any user passwords.
You can configure the row DC to cache the passwords for users in the branch office, but again, it's
not by default.
Even raw DC is compromised.
The potential loss of information is much lower than with a full read write domain controller.
Another option here is to use Bitlocker drive encryption to encrypt the domain controllers hard drive.
If someone steals the hard drive, Bitlocker will help to ensure that the malicious hacker has difficulty
getting any useful information from it.
Please know that Bitlocker is a drive encryption feature that is available for Windows Server operating
systems and certain Windows client operating systems.
Bitlocker encrypts the entire drive to help prevent the computer from starting unless it receives a
private key and optionally passes an integrity check.
A hard drive remains encrypted even if you transfer it to another computer.