It's been many, many years since I earned my MCSx certs and, fortunately, I rarely touch a Windows box these days so I am very likely wrong... but it seems to m

It's been many, many years since I earned my MCSx certs and, fortunately, I rarely touch a Windows box these days so I am very likely wrong... but it seems to me that the following scenario is possible. A domain controller also acts as a DNS server. "Forwarders" can be configured, or the DC can "go direct" and perform (recursive) resolution on a client's behalf. A client that could be convinced (should be relatively easy?) to issue a certain DNS request (which would be sent to the DC) would cause a malicious response (assuming a malicious authoritative DNS server) to be sent to the DC. In the case where the DC is an affected (unpatched) Windows 2012 server, this would result in a compromise of the DC. Sounds feasible, in theory. I don't know enough about this issue to say for certain, though.