Limiting Domain Controller Attack Surface: Why Less…

This TrustedSec blog provides guidance for limiting and approving software on Active Directory Domain Controllers (DCs) to reduce attack surface and risk. It covers approval questions, risk acceptance considerations, required privileges and exposures (e.g., SYSTEM services, kernel drivers, LSASS interaction), maintenance and recovery recommendations, and recommends annual reviews and careful patch management for Tier 0 assets.