Introduction#
Active Directory (AD) is a directory service developed by Microsoft.
What does that mean?
→ It means that it organizes and stores information about every user, computer, and resource in a domain along with their properties.
→ When all these objects are neatly catalogued in one place, you can manage them centrally from a Domain Controller. This is especially useful in large environments with thousands of users and computers — saving you time and effort compared to managing each device individually.
→ But there’s more. When a computer joins a domain, it gains several additional benefits. Active Directory is a key component of Active Directory Domain Services (AD DS), which also includes tools like Group Policy Management.
==Combine them, and you get:==
→ Robust control over remote devices, simplified application deployment, and the enforcement of consistent settings across your network.
→ Ever wonder why company devices often have identical settings, wallpapers, and features?
That’s because they’re joined to a Domain Controller.
Core Components#
1. Domain Controllers (DCs)#
A Domain Controller (DC) is a Windows Server running AD DS. It authenticates users, enforces policies, and manages security.
At least one DC is required, but having two or more is recommended for fault tolerance.
Each DC stores a replicated copy of the AD database to ensure redundancy.
2. NTDS Database & SYSVOL#
When AD DS is installed, two key directories are created:
NTDS Database (NTDS.DIT) → Stores all Active Directory objects (users, groups, computers, etc.).
→ Location:C:\Windows\NTDS(hidden by default).SYSVOL Directory → Stores Group Policy Objects (GPOs), scripts, and security policies.
→ Location:C:\Windows\SYSVOL.
Setting Up Active Directory#
1. Prerequisites#
Before installing AD DS, ensure:
Windows Server OS is installed (Windows Server 2016/2019/2022).
NTFS Partition is used for storing AD data (FAT32 is not supported).
Registered Domain Name (e.g.,
yourcompany.local).Static IP Configuration:
→ Set static IP, subnet mask, and default gateway.
→ DNS must point to the server itself (e.g.,127.0.0.1or its static IP).
→ DNS Server Role must be installed alongside AD DS.
2. Installation Steps#
Install AD DS Role via Server Manager.
Promote the server to a Domain Controller:
→ Choose “Add a new forest” for the first DC.
→ If adding to an existing domain, replicate from another DC.Post-Installation Tasks:
→ Ensure at least two DCs for redundancy.
→ Configure secondary DCs to use the primary DC’s DNS IP.
Key Features & Benefits#
1. Single Sign-On (SSO)#
Log in once to access shared resources like file shares, Microsoft 365 (Outlook, Teams), and internal applications.
2. Centralized Authentication & Security#
Account Lockout Policies: Prevent brute force attacks by limiting failed login attempts.
Password Expiration & Complexity Rules: Enforced via Group Policy.
Role-Based Access Control (RBAC): Manage permissions with security groups.
3. Group Policy Management (GPOs)#
Apply security settings, software installations, and device restrictions.
Example: Enforce password policies, disable USB drives, or set corporate wallpapers.
GPOs apply at user or computer level:
User Policies: Control login scripts, desktop restrictions.
Computer Policies: Enforce firewall settings, disable external devices.
Common Admin Tasks#
1. Managing Users & Groups#
Create, reset, disable accounts via Active Directory Users & Computers (ADUC).
Assign permissions using Security Groups.
Use Attribute Editor for advanced settings (e.g.,
employeeID,homeDirectory).
2. Remote Management Tools#
RSAT (Remote Server Administration Tools): Manage AD from a Windows 10/11 PC.
CmRcViewer: Remote control tool for SCCM-managed devices.
3. Troubleshooting & Commands#
gpresult /r→ View applied Group Policies.net user [username] /domain→ Check password expiration.net accounts→ View lockout and password policies.
Advanced Features#
1. AD Recycle Bin#
Allows recovery of accidentally deleted objects.
Enabled via Active Directory Administrative Center.
2. Organizational Units (OUs)#
Organize users, computers, and groups.
Apply specific Group Policies to each OU.
3. Trusts & Forests#
Domains: Logical boundary for resources.
Forests: Collection of domains that trust each other.
Trusts: Enable cross-domain authentication (e.g., Parent-Child, External Trusts).
4. Read-Only Domain Controllers (RODCs)#
- Deployed in branch offices for security (stores read-only copies of AD data).
Best Practices for AD Administration#
Deploy multiple Domain Controllers for redundancy.
Use AD Recycle Bin to recover deleted objects.
Regularly audit Group Policies to ensure compliance.
Limit Domain Admin accounts to reduce security risks.
Monitor AD logs for security threats.
Conclusion#
Active Directory is the backbone of modern IT environments, providing secure authentication, centralized management, and policy enforcement. By mastering AD DS installation, user management, Group Policies, and troubleshooting techniques, you can maintain an efficient and secure IT infrastructure.
