Configuring a DC as a Terminal Server requires you to grant "Log on locally" permissions on your domain controller to any user who needs to use the TS service. The escalation of privilege attack whereby a user with log on locally on a DC can elevate their own privileges to that of a Domain Admin is well-known, published, and trivial.
If you make your DC a Terminal Server, then you have effectively made every Terminal Server user in your organization a Domain Admin.
Main Topics
Browse All Topics
by: tsmvpPosted on 2008-01-30 at 06:33:50ID: 20777233
Many reasons for not doing this:
1. As you pointed out, Microsoft Office does not like Microsoft Exchange when they are both on the same box for many reasons (certain DLLs will get overwritten and troubles will come from that).
2. Security: to logon to the domain controller locally you will need to 'relax' security at the DC level what will open doors for users doing things they are not supposed to to on this DC and possibly on the second one that runs Oracle.
3. Performance: with all these other services running, TS performance will suffer.
4. All eggs in one basket: Microsoft taught us a lesson over the years that when you patch something you may break something else. This means if this machine becomes a TS and a critical patch is released to fix the TS portion, you may break something else like Active Directory, Exchange, etc. So terrible idea.
Resuming, terrible idea and highly not recommended.
Claudio Rodrigues
Microsoft MVP
Windows Server - Terminal Services