The Tale of Active Directory Domain Sabotage: Architect Plants DNS-Killing Task on Departing Branch Controllers

In a medium-complexity case study originally posted on Habr, an architect recounts events from an old Windows Server 2003 Active Directory domain that spanned 15–20 regional branches, each equipped with its own domain controller linked to headquarters via VPN tunnels, sometimes using GSM modems.

When two branches prepared to split off, the architect was asked by senior management to implement a discreet mechanism that would disrupt operations if the separation occurred. The solution involved placing a monitoring script deep in the file system of the branch controllers and scheduling it via Task Scheduler under an innocuous foreign name.

The script used alive.exe to ping a headquarters IP address twice daily. Successful pings reset a hidden registry counter; repeated failures incremented the counter. A second scheduled task running every 10–15 days checked the counter and, once it exceeded 15, executed net stop dns, causing the domain to become unusable for branch users arriving at work the next morning.

To reduce forensic traces, the architect created a temporary task running as SYSTEM that relocated the scripts, recreated the scheduled tasks under SYSTEM ownership, and then deleted the original task. After the branches departed, the DNS service was observed stopping three times; the local network engineer restarted it each time before finally calling the architect.

The architect concluded that Active Directory becomes inoperable the moment the DNS service stops and that the domain administrator is the single greatest danger to the domain’s existence because of the breadth of privileges available.