Domain Controller

Synopsis

A Domain Controller honeypot is not a device type — it is a set of protocol honeypots deployed together under one shared identity. Configured this way, the host answers the entire Active Directory discovery chain consistently: DNS returns the DC-locator records, Kerberos answers as a KDC for the realm, LDAP answers RootDSE and directory searches as a Domain Controller, and SMB exposes SYSVOL and NETLOGON. An attacker following the standard reconnaissance path never encounters a contradiction, and every stage is logged.

Each entry remains an ordinary device with its own identifier, status, health, and statistics, so any service can be enabled, disabled, or omitted independently.

Composition

The bundle is seven device entries across five device types:

Name	Type	Port	Distinguishing properties	What it captures
dc-dns	dns	53	dc_ip	DC-locator SRV and A queries
dc-kerberos	kerberos	88	dns_domain	AS-REQ and TGS-REQ principals
dc-ldap	ldap	389	emulate_dc	Bind credentials, directory searches
dc-ldaps	ldap	636	emulate_dc, tls.status	The same, over implicit LDAPS
dc-gc	ldap	3268	emulate_dc	Global Catalog queries
dc-smb	smb	445	emulate_dc, browsable	Net-NTLMv2 hashes, share and file access
dc-winrm	winrm	5985	os_flavor	NTLM and Basic credentials

The three LDAP entries are the same device type on three ports, matching how a real Domain Controller exposes LDAP, LDAPS, and the Global Catalog. dc-winrm is optional — remove it if the remote-management surface is not wanted.

Shared Identity

Four values tie the entries together. Keep them consistent across every entry, or the emulation becomes inconsistent and an attacker can detect it:

Value	Example	Used by	Purpose
domain	CORP	ldap, smb	NetBIOS domain name advertised in NTLM challenges
dns_domain	corp.local	dns, kerberos, ldap, smb	DNS domain; the Kerberos realm is its uppercase form, CORP.LOCAL
computer_name	DC01	dns, ldap, smb	Domain Controller host name
dc_ip	the host's reachable address	dns	Address returned in A records and as the SRV target

Set dc_ip to the address on which the other listeners in the bundle are reachable. It is what makes the chain work: a client that resolves the DC name is directed to the host actually running the Kerberos, LDAP, and SMB honeypots.

warning

The WinRM honeypot reads no domain, dns_domain, or computer_name properties. Its advertised identity comes solely from os_flavor, so dc-winrm presents the preset's workgroup and computer name — WORKGROUP and WIN-SRV2019 for server2019 — while every other entry presents CORP and DC01. This inconsistency is visible to an attacker who compares them. Omit dc-winrm when that matters more than the extra coverage.

note

computer_name is accepted by the Kerberos honeypot and a change to it reloads the device, but it does not affect any Kerberos response — only dns_domain does, by way of the realm. It is kept in the bundle for consistency.

Configuration

The following fields are used to define the bundle:

devices:
  - id: 720000001
    name: dc-dns
    description: DC honeypot - DNS locator
    type: dns
    status: false
    properties:
      address: "0.0.0.0"
      port: 53
      dns_domain: corp.local
      computer_name: DC01
      dc_ip: "10.0.0.10"
      timeout: 15

  - id: 720000002
    name: dc-kerberos
    description: DC honeypot - Kerberos KDC
    type: kerberos
    status: false
    properties:
      address: "0.0.0.0"
      port: 88
      dns_domain: corp.local
      computer_name: DC01
      timeout: 15

  - id: 720000003
    name: dc-ldap
    description: DC honeypot - LDAP
    type: ldap
    status: false
    properties:
      address: "0.0.0.0"
      port: 389
      emulate_dc: true
      domain: CORP
      dns_domain: corp.local
      computer_name: DC01
      timeout: 20

  - id: 720000004
    name: dc-ldaps
    description: DC honeypot - LDAPS
    type: ldap
    status: false
    properties:
      address: "0.0.0.0"
      port: 636
      emulate_dc: true
      domain: CORP
      dns_domain: corp.local
      computer_name: DC01
      tls:
        status: true
      timeout: 20

  - id: 720000005
    name: dc-gc
    description: DC honeypot - Global Catalog
    type: ldap
    status: false
    properties:
      address: "0.0.0.0"
      port: 3268
      emulate_dc: true
      domain: CORP
      dns_domain: corp.local
      computer_name: DC01
      timeout: 20

  - id: 720000006
    name: dc-smb
    description: DC honeypot - SMB (SYSVOL)
    type: smb
    status: false
    properties:
      address: "0.0.0.0"
      port: 445
      emulate_dc: true
      browsable: true
      domain: CORP
      dns_domain: corp.local
      computer_name: DC01
      timeout: 20

  - id: 720000007
    name: dc-winrm
    description: DC honeypot - WinRM
    type: winrm
    status: false
    properties:
      address: "0.0.0.0"
      port: 5985
      os_flavor: server2019
      timeout: 20

Each entry is documented in full on its own page. Only the properties that make the bundle cohere are described here.

Details

Discovery Chain

The entries answer the stages of Active Directory discovery in the order an attacker walks them:

Stage	Entry	What the attacker learns
1. Locate the DC	dc-dns	SRV records name a Domain Controller and resolve it to dc_ip
2. Probe the KDC	dc-kerberos	The realm exists and responds like a KDC
3. Enumerate the directory	dc-ldap, dc-gc, dc-ldaps	RootDSE naming contexts and a Domain Controller computer object
4. Reach the shares	dc-smb	SYSVOL and NETLOGON exist and are browsable

Because each stage confirms what the previous one implied, tooling that would abandon an inconsistent target keeps going — and each additional step produces another logged event.

Ports and Privileges

DNS (53), Kerberos (88), LDAP (389), LDAPS (636), and SMB (445) are all below 1024, so the service must run with sufficient privileges to bind them. Where it cannot, change the ports to high ports — but note that moving them off the real ports weakens the emulation, since a client following the SRV records expects the standard ports. The Global Catalog (3268) and WinRM (5985) ports are already above 1024.

Independent Operation

Nothing links the entries at runtime. There is no dc device type, no parent object, and no shared state — the coherence comes entirely from the property values matching. Each device reports its own health and statistics and can be enabled or disabled on its own, so a subset is a valid deployment: DNS plus LDAP alone still presents a credible directory target.

Examples

The following are commonly used configuration types.

Minimal Directory Target

Standing up just the locator and the directory, without the Kerberos or SMB surfaces...

devices: - id: 730000001 name: dc-dns type: dns properties: port: 53 dns_domain: corp.local computer_name: DC01 dc_ip: "10.0.0.10" - id: 730000002 name: dc-ldap type: ldap properties: port: 389 emulate_dc: true domain: CORP dns_domain: corp.local computer_name: DC01

Unprivileged Ports

Running without privileges to bind ports below 1024, at the cost of a weaker emulation...

devices: - id: 740000001 name: dc-ldap-alt type: ldap properties: port: 1389 emulate_dc: true domain: CORP dns_domain: corp.local computer_name: DC01 - id: 740000002 name: dc-smb-alt type: smb properties: port: 1445 emulate_dc: true browsable: true domain: CORP dns_domain: corp.local computer_name: DC01

With Pre-Processing

Attaching one pipeline across the bundle so every stage of the chain is enriched identically...	devices: - id: 750000001 name: dc-kerberos type: kerberos pipelines: - honeypot_enrichment properties: port: 88 dns_domain: corp.local computer_name: DC01 - id: 750000002 name: dc-smb type: smb pipelines: - honeypot_enrichment properties: port: 445 emulate_dc: true browsable: true domain: CORP dns_domain: corp.local computer_name: DC01
A Kerberoasting attempt against the emulated realm produces a tgs_req event...	{ "timestamp": "2026-08-03T09:14:22.481937204Z", "event_type": "tgs_req", "source_ip": "203.0.113.44", "source_port": "51422", "local_addr": "10.0.0.10:88", "transport": "tcp", "msg_type": "TGS-REQ", "username": "svc_sql", "realm": "CORP.LOCAL", "principals": ["svc_sql", "CORP.LOCAL", "MSSQLSvc/db01.corp.local:1433"] }