Identity resilience glossary
Domain controller
A domain controller (DC) is a server that runs Active Directory Domain Services and hosts directory data for a domain. It provides authentication and supplies information used in access decisions. Multiple domain controllers can hold replicated directory data for the same domain, so directory operation is not necessarily tied to one server.
Why availability depends on more than server health
Users and applications need to reach the appropriate directory services. Domain-controller placement therefore depends on network connectivity, authentication needs, and the locations the organization serves. A healthy controller in a distant datacenter may not meet a branch office's needs if the connection to that datacenter fails. Local expertise and physical security also affect deployment decisions.
Writable and read-only domain controllers
A writable DC can accept directory changes. A read-only domain controller, or RODC, holds read-only directory partitions and does not originate directory updates. That distinction matters when planning changes and recovery. An RODC is not an interchangeable replacement for a writable controller, even though both participate in the same domain's directory infrastructure.
Example: a branch loses connectivity
Consider a hypothetical branch that depends on a controller at headquarters. A network outage can interrupt directory requests even though the headquarters server remains healthy. The useful investigation question is whether the branch can reach the services it needs. Planning may involve local directory services, better connectivity, or both, depending on the branch's requirements.
A replica is not a historical recovery point
Replicated directory data and a recoverable historical backup solve different problems. Another controller can contain the same unwanted changes as the first. Similarly, rolling back a virtual machine requires care because Active Directory maintains replication state as well as object data.
Microsoft documents specific safeguards and recovery requirements for virtualized controllers. A VM snapshot should not be assumed to replace an AD-aware backup and tested recovery process. The method must fit the controller, virtualization platform, and failure being addressed.