Active Directory Fundamentals

Active Directory Domain Services is Microsoft's directory service built into Windows Server. It stores user accounts, computer objects, and groups in a hierarchical database and provides authentication, authorization, and policy enforcement for Windows-based networks.

itWindows and Microsoft infrastructure

Don't Panic — Active Directory Fundamentals

Active Directory Domain Services, or AD DS, is the directory service built into Windows Server. It keeps track of users, computers, groups, and other network objects, then lets Windows systems use that information for sign-in, access, administration, and policy. Before that shared directory exists, the same identity decisions must be repeated system by system. That gets old with impressive speed.

The important shape is a forest, which contains one or more domains. A domain partitions directory data. Inside it, an organizational unit, or OU, is a container for delegated administration and Group Policy. That is a useful boundary, but it is not a magic security moat. Forest administrators remain forest administrators, which is exactly why forest design is a trust decision rather than a filing exercise.

Domain controllers make the directory available. They authenticate identities, answer queries, and replicate changes. Replication means another controller can serve the directory when one is unavailable. It does not mean a mistaken deletion becomes a charming historical artifact. A bad change can replicate too, so backups and recovery tests remain firmly employed.

The surprise is that DNS is not scenery. A domain member uses DNS service records to find a suitable domain controller. When that path breaks, authentication, Group Policy, replication, and queries can all appear to be separate problems. They are often the same problem wearing several hats, none of them especially flattering.

After a sign-in, Windows builds an access token from the identity and its group SIDs. A resource compares that token with its ACL. This is why authentication and authorization are separate: a valid sign-in does not grant access to a file share. Groups express reusable access intent. OUs express administration and policy scope. Keeping those jobs separate prevents the directory from becoming an archaeology project.

Read the intro for the complete control-plane map and its boundaries with Microsoft Entra ID. Use the slides when the forest, domain, OU, site, and domain-controller relationships need a picture. Keep the cheatsheet nearby for group scopes, operations master roles, and health signals. The practice reference and exercise turn the group model into a contained lab, where the consequences are educational rather than expensive.

Don't Panic — Active Directory Fundamentals

Relevant careers