Each domain has its own Kerberos server, which shares the database used by Active
Directory. This means that the Kerberos server must execute on the domain-controller
machine and, like the Active Directory server, it can be replicated within a domain.
Every user who wants to securely access remote services must log on to a Kerberos
server. Figure 15.9 shows the path followed by a request from an application to a service
provided on the network.