Domain control is a high-privilege state in a Windows environment where an attacker can influence authentication, administration, and policy across an entire domain. In practice, this often means control over Active Directory objects such as users, groups, computers, domain controllers, and Group Policy. Once an attacker reaches this level, they can often create or elevate accounts, change passwords, alter trust relationships, and push configuration changes to many systems at once.
This matters because a domain is the trust core of many enterprises. If an intruder steals privileged credentials, compromises a domain controller, or abuses directory replication and delegation, they can turn a single foothold into broad control. Defenders reduce this risk by limiting privileged access, protecting administrative accounts, monitoring directory and authentication changes, segmenting tiered admin roles, and hardening internet-facing systems that can serve as entry points into the domain.