Active Directory Administration

Active Directory administration is the day-to-day management of Microsoft's directory service for Windows networks. It covers creating and organizing user accounts, groups, and computer objects, delegating permissions, applying Group Policy settings, and maintaining domain controllers so that authentication and authorization work reliably across the organization.

itWindows and Microsoft infrastructure

Don't Panic: Active Directory Administration

Active Directory Domain Services, or AD DS, is a shared address book that also gets to decide who may open the filing cabinet. It keeps users, computers, groups, and resources in one directory, then uses that directory for sign-in, access checks, and configuration. Before this arrangement, each server kept its own list of accounts, which is a reliable way to turn one departing employee into ten forgotten passwords.

The trick is that the address book is copied. A domain controller is a server with a writable copy of the domain's directory, and several domain controllers replicate changes between themselves. This makes the directory less fragile than one central server, but it does mean a change does not appear everywhere by telepathy. A site tells AD DS which networks are well connected, so replication can be quick nearby and more deliberate across a slower link. Networking has opinions, and AD DS has learned to respect them.

The structure looks grander than it is. A forest is the top-level collection that shares a schema, configuration, and global catalog. Inside it sit domains, where accounts and authentication live; inside those sit OUs, where delegated administration and Group Policy tend to happen. Group Policy is the mechanism for applying a named set of settings to a site, domain, or OU. Its two halves live in the directory and SYSVOL, because one storage location was apparently not enough excitement.

Authentication is mostly Kerberos. A domain controller's KDC gives a signed-in user tickets for other services, so every file share does not ask for a password again. Groups then make authorization manageable: grant access to a group once instead of conducting a small ceremony for every account. Five FSMO roles stand apart from ordinary replication for the few decisions where two writers would cause genuine trouble.

Start with the Intro for the logical model, trusts, and the reason DNS is non-negotiable. The Slides turn those relationships into a map. The Cheatsheet is the fast lookup for scopes, FSMO roles, and the GPO split. The Field Notes are for the awkward operational consequences that diagrams politely leave out.

Don't Panic: Active Directory Administration

Relevant careers