What signs suggest that a machine is a Domain Controller?


Given a group of machines, knowing only that they run Windows with Active Directory, being at the initial recon phase, what are some signs that would strongly suggest a machine is a Domain Controller?

(I’m thinking of checking the basic things, such as services from nmap.)