what security measure can do on domain controller which has PDC emulator?

Question

Assume only domain controller 2 is PDC emulator

1. what security measure can do on domain controller which has PDC emulator?
2. what network restriction and group policy can further do more on this PDC emulator domain controller than first domain controller and other domain controller ? such as block 443, 80 , 53, and only allow specified ports for PDC emulator? do all domain controllers need endpoint encryption?

Answer 1

Hello 2AI,

Thank you for posting in Microsoft Community forum.

1. what security measure can do on domain controller which has PDC emulator?

A1: Usually, you do not need to do other security protection measure on only PDC.

2. what network restriction and group policy can further do more on this PDC emulator domain controller than first domain controller and other domain controller ? such as block 443, 80 , 53, and only allow specified ports for PDC emulator? do all domain controllers need endpoint encryption?
A2: Group policy settings on all DCs (including PDC) are the same, because they will replicate between AD replication and SYSVOL replication.
No specific network restriction on this PDC emulator domain controller.

For securing AD or DC, you can read links below.

Best Practices for Securing Active Directory | Microsoft Learn

Securing Domain Controllers Against Attack | Microsoft Learn

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,

Daisy Zhou