Denial Of Service Attack Prevention. As stated earlier, a requirement of the DTM is that it consumes few enough system resources, such that it does not prevent the system it's protecting from operating normally. If DTM is constantly checking hosts that are trying to join a Trust Domain, then it will be using a lot of CPU time and network bandwidth. Therefore, a compromised host that continuously tries to join a Trust Domain will cause all the systems in the Trust Domain to spend significant amounts of CPU time and network bandwidth needlessly. In order to prevent this, DTM has a set of configurable parameters. These parameters allow the system administrator to specify how many attempts a host can make to join a Trust Domain in an amount of time, such as three attempts in 5 minutes, before additional requests from that host are considered a denial of service attack. Once a request to join a Trust Domain is deemed a denial of service attack, all subsequent requests to join made by that host are ignored for a specified amount of time, which is also configurable by the system administrator.
