I asked myself what tangible artifacts present on a file system can immediately tell us that the server system in place is a Domain Controller and/or DNS server.

I decided to run a simple experiment.

I installed a test version of Windows Server 2022, took a snapshot of the file system, then added DC and DNS capabilities, then took a snapshot of a file system again.

The (slightly edited) diff of these 2 can be found here.