Take the 2-minute tour ×

Let's say I have a Windows 2008 (or a Windows 2003) Domain Controller (With DNS, etc.) in a remote office that is (of course) part of a much larger domain in a primary location (it's in a separate site).

What happens if someone breaks in and steals that machine? What sorts of things should I do to my main network or domain (if anything?). The VPN etc. is keyed off of the IP address of the network so there's nothing that would allow them to gain remote access to the primary network. I assume, at a minimum, I'd want everyone to change their passwords, but what else?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

Microsoft has some recommendations for what to do if a read-only DC is stolen. I don't think they go far enough, though. I lean more toward the approach described here. The big enchilada IMHO is to make sure that you immediately force password changes for all domain accounts; that will go a long way towards reducing the impact.

share|improve this answer
+1 - I take Joe's opinions (the guy Paul linked to) under very serious advisement and I'd recommend you do as well. I recall that post going by in my feed reader. I just checked and I see that I "starred" it there. It's good stuff. –  Evan Anderson Jul 20 '09 at 20:37
Looks great, thanks! –  Matt Rogish Jul 20 '09 at 20:43

Like the person said, change all passwords immediately. Also use NTDSUTIL and forcibly remove all traces of it from your AD. It may sound a bit extreme, but changing the site in question to a different IP subnet might not be a bad idea too.

share|improve this answer

If you are using a pretty standard password policy then your users change their passwords every 30 days, so that shouldnt be a problem.

I'd change all the Administrator passwords, and like you already have: make sure that the VPN isnt re-initated from a rogue site.

Other than that I don't think there is much to do.

share|improve this answer

Your Answer


