It was, but Active Directory wasn't. If you put your DCs on the Internet you're asking to get hacked.