August 29, 2025

Tracking Rogue Domain Controllers in Active Directory (Detection + Response Playbook) A rogue domain controller (DC) is any system that is acting as a DC or participating in DC trust/replication without being approved, expected, and controlled. In practice, “rogue DC” includes: An attacker-promoted DC in a compromised domain An unauthorized (shadow IT) DC spun up by an admin or a…