Hi Y'all,

I am interested in learning about your thougts on protecting domain controllers (DCs), in particularly in determining whether should be placed in separate server rooms.

Currently all our DCs reside in the data center along with other web, database and application servers and the entire datacenter is managed by a team of IT server operators (about 30 or so) all of whom have equal access to all servers including all DCs. Not all of them are Domain Admins though, but I believe they are all part of the Server Operators Builtin group in our domain.

As we evaluate the security of our environment, the question of whether to move all DCs into a separate room, and under the administration of only a handful of Domain Admins came up, and thus my question.

Are we taking on any additional risk by letting them be in the data center, or should be moving  them to a special designated room?

Thanks,