Active Directory

Active Directory, usually abbreviated AD, is the Microsoft directory service that stores objects such as users, computers, groups and policies in a hierarchical, replicated database and provides central authentication and authorization for Windows networks. In Windows administration, the term most often means Active Directory Domain Services (AD DS), the role that turns Windows Server machines into domain controllers.

AD combines three established technologies: LDAP for directory access, Kerberos for authentication and DNS for locating services. It has been the backbone of on-premises Windows networks since Windows 2000 Server and remains widely deployed alongside cloud identity services.

How Active Directory is structured

Active Directory organizes objects into a logical hierarchy that is independent of the physical network. The largest boundary is the forest, and the smallest administrative container is the organizational unit.

The physical side is described by sites, which map to IP subnets with good connectivity. Sites control replication schedules between locations and help clients find the nearest domain controller.

Each domain controller holds a writable copy of its domain partition in the database file NTDS.dit and replicates changes to the others using multi-master replication. A read-only domain controller holds a non-writable copy for branch offices with weak physical security.

Permissions are normally granted to security groups, not to individual users. Groups have a scope, domain local, global or universal, which determines where they can be used and which members they may contain. Domains inside one forest trust each other automatically through transitive two-way trusts, while links to other forests require explicitly configured forest or external trusts.

Active Directory also gives its name to related server roles that solve different problems: AD Certificate Services issues certificates, AD Federation Services provides claims-based single sign-on, and AD Lightweight Directory Services offers a standalone LDAP directory without domain functions.

Authentication and core protocols

When a user signs in to a domain-joined computer, the client locates a domain controller through DNS service records and requests a Kerberos ticket. That ticket then grants access to file shares, applications and other resources without sending the password again.

NTLM remains available as a fallback for older systems and IP-based access, but it is weaker than Kerberos. Microsoft has announced the gradual retirement of NTLM, so auditing where it is still used is part of modern AD hygiene.

Operations masters and functional levels

Although most changes can be written on any domain controller, a few operations must be performed by exactly one server. These are the five FSMO roles, also called operations master roles.

Functional levels define which features a domain or forest can use, and they require every domain controller to run at least the matching Windows Server version. Raising the level is a one-way decision in practice, so administrators confirm that all controllers are upgraded first.

Active Directory compared with Microsoft Entra ID

Microsoft Entra ID, formerly Azure Active Directory, shares part of the name but is a different service. It is a cloud identity platform built around web protocols, not a cloud-hosted copy of AD DS.

Many organizations run a hybrid identity model: users are created in AD DS and synchronized to Entra ID with Entra Connect or cloud sync. Devices can be hybrid joined to both during a migration toward cloud-only management.

Security risks and administration practice

Because AD controls access to almost everything, it is a primary target for attackers. Compromise of one domain admin account or one domain controller usually means compromise of the whole domain.

• Kerberoasting extracts service tickets for accounts with service principal names and cracks weak service passwords offline.
• Golden ticket attacks forge Kerberos tickets after theft of the krbtgt account key, which is why that key must be reset twice after a breach.
• Privilege sprawl in groups such as Domain Admins enlarges the attack surface; a tiered administration model separates admin accounts by sensitivity.
• Local administrator passwords that are identical across machines enable lateral movement; Windows LAPS rotates them per device.
• Unmonitored replication rights allow DCSync attacks that pull password hashes from a domain controller.

Day-to-day management uses consoles such as Active Directory Users and Computers and Active Directory Administrative Center, and the ActiveDirectory PowerShell module for automation. Regular system state backups of at least two domain controllers and a tested forest recovery plan are basic requirements.

The simple explanation

Active Directory is like the front desk and staff directory of a large office building. It knows every employee, every computer and which rooms each person may enter.

When you sign in at work, your computer asks Active Directory who you are. Once it confirms your identity, it hands you a kind of badge that opens the right doors, such as shared folders or printers, without asking for your password at each one.

How it is used in practice

A company with 600 employees in three cities runs one AD forest with a single domain and two domain controllers per site. Administrators create organizational units for each department and link Group Policy objects that map network drives, enforce screen locks and deploy printers automatically.

When a new accountant joins, the help desk creates one account and adds it to the Finance group. Within minutes, the accountant can sign in on any office PC and reach the finance share, while access to HR folders stays blocked. When the person leaves, disabling that single account removes access everywhere, and the change replicates to every site within the configured replication interval.