Active Directory Administration

Active Directory Domain Services (AD DS) is Microsoft's directory service for Windows networks. It stores information about the objects on a network — user accounts, computer accounts, groups, printers, and shared resources — in a structured, hierarchical database, and it makes that information available to authorized users and administrators. When you sign in to a Windows domain computer, check group membership before opening a file share, or push a security setting to every machine in a department, AD DS is the system answering "who is this, and what are they allowed to do."

The useful mental model is a shared address book with a rulebook attached. The address book holds every user, computer, and group in the organization; the rulebook (security permissions and Group Policy) decides who can read or change each entry and what configuration gets pushed to which machines. Every domain controller holds a full copy of that address book for its domain and keeps it synchronized with every other domain controller, so a change made in one office is visible everywhere else within minutes.

Why AD DS exists

Before directory services, each Windows server kept its own local list of users and passwords. Ten servers meant ten separate accounts to create, update, and disable for every employee — and ten places for a former employee's access to linger. AD DS solves this by centralizing identity: create a user once, and that identity works across every computer, server, and application that trusts the domain. This is why AD DS underpins most on-premises Windows environments and remains the identity backbone that hybrid cloud setups (via Microsoft Entra Connect) synchronize into the cloud.

AD DS combines several pieces into one service:

A structured data store — the directory itself — organized hierarchically so information is easy to find.
The schema, a set of rules defining what classes of objects (users, computers, groups, and more) can exist in the directory, what attributes each object type can have, and the format of their names.
A global catalog, a searchable index containing a subset of every object's attributes across the entire forest, so a query for "find this user" doesn't need to know which domain holds the answer.
A query and index mechanism, so applications and users can search the directory efficiently.
A replication service that copies directory changes to every domain controller in a domain, so any domain controller can answer requests with current data.
Integrated security: a single username and password authenticates a user across the network, and access to directory objects is controlled the same way access to files is controlled — with permissions.

Active Directory Administration

Active Directory Administration

Why AD DS exists

Who administers AD DS, and what they do

Relevant careers