What Is Active Directory? How AD Works, Domains & DCs

This is a working reference on Active Directory — the material our Windows Server administration support team uses when assessing domain environments. It covers what Active Directory is, the core objects (forests, domains, OUs, domain controllers), how authentication works, the standard management tools, how AD relates to Group Policy and to Microsoft Entra ID, and the basics of keeping a domain healthy.

What is Active Directory

Active Directory is a directory service: a hierarchical database that stores information about objects on a network — user accounts, computer accounts, groups, printers, shared resources — and makes that information available to users and administrators. The server role that provides it is Active Directory Domain Services (AD DS), installed on Windows Server. A server running the AD DS role is called a domain controller. Microsoft's AD DS overview is the canonical description.

Beyond storing objects, AD DS enforces a schema (the rules defining which object classes and attributes exist), maintains a global catalog (a searchable index of every object in the forest), and runs a replication service that copies directory changes between domain controllers so each one holds a complete, current copy of its domain's data. Security is built in: a single username and password authenticates a user to every resource in the domain that they have permission to access, and access control lists on each object determine who can read or change it.

AD DS first shipped with Windows 2000 Server and remains a core role in every Windows Server release since; the product history is documented on Wikipedia's Active Directory entry. The AD DS role is installed through Server Manager or PowerShell; our step-by-step guide to installing Active Directory on Windows Server covers the promotion process.

Core concepts: forest, domain, OU, DC

A small business typically runs a single forest with a single domain and two domain controllers. Multi-domain forests and forest trusts appear in larger organizations, after mergers, or where a legal or administrative boundary requires separate domains.

How authentication works: Kerberos and NTLM

Kerberos is the default authentication protocol in Active Directory domains. When a user signs in, the client requests a ticket-granting ticket (TGT) from a domain controller's Key Distribution Center (KDC), proving identity with a key derived from the password. To reach a server, the client presents the TGT and receives a service ticket for that specific server, which the server validates without contacting a DC for every request. Tickets are time-limited, which is why Kerberos fails when clocks drift more than five minutes apart. The protocol is documented in the Kerberos authentication overview.

NTLM is the older challenge-response protocol that predates Active Directory. The server sends a challenge, the client answers with a hash computed from the password, and the server forwards the exchange to a domain controller for verification. NTLM remains as a fallback — used when a client addresses a server by IP address, when no DC is reachable, or with legacy applications — but it is weaker than Kerberos and Microsoft is deprecating it; the NTLM overview describes its status and the audit settings for finding remaining NTLM traffic.

Management tools

Three tools cover most day-to-day administration:

• Active Directory Users and Computers (ADUC) — the MMC snap-in (dsa.msc) for creating and managing users, groups, computers, and OUs. Installed with the RSAT tools on a workstation or present on any DC.
• Active Directory Administrative Center (ADAC) — the newer management console, built on PowerShell, which adds interfaces for the AD Recycle Bin and fine-grained password policies.
• The ActiveDirectory PowerShell module — the scripting interface, installed with RSAT or the AD DS role. Typical cmdlets: Get-ADUser -Filter * -SearchBase "OU=Staff,DC=corp,DC=example,DC=com" to list users in an OU, New-ADUser to create accounts, and Get-ADDomainController -Filter * to enumerate the DCs in a domain.

Bulk operations — onboarding from an HR export, group membership audits, stale-account cleanup — are PowerShell work; the graphical tools do not scale past a handful of objects at a time.

Active Directory and Group Policy

Group Policy is the configuration-management system layered on top of AD DS. Group Policy objects (GPOs) are stored in the domain and linked to sites, domains, or OUs; every computer and user in the linked scope applies the settings at startup, logon, and on a refresh interval. Password policy, drive mappings, software restrictions, and security hardening baselines are all delivered this way. The OU design of a domain is, in practice, driven mostly by how Group Policy needs to be targeted. How GPO processing, precedence, and filtering work is covered in our Group Policy reference.

Active Directory vs. Microsoft Entra ID

Microsoft Entra ID (renamed from Azure Active Directory in 2023) is a separate product, not a cloud version of AD DS. The differences are structural:

Most organizations run both in a hybrid configuration: Microsoft Entra Connect synchronizes on-premises AD accounts into the Entra tenant so one identity covers domain resources and Microsoft 365. The sync topology and password hash synchronization options are described in the Microsoft Entra Connect documentation. AD DS is not deprecated; environments with on-premises servers, printers, and line-of-business applications still require it, and Entra ID does not answer Kerberos or LDAP requests from those systems.

AD health basics

Four things account for most Active Directory stability: replication, backups, time, and DNS.

• Replication. Every writable DC must replicate with its partners on schedule. repadmin /replsummary reports per-DC replication status and largest deltas; failures older than a few hours need investigation, not waiting. Concepts are documented in the AD replication concepts reference.
• Diagnostics. dcdiag /v runs the standard battery of DC health tests — connectivity, advertising, services, FRS/DFSR, DNS. Run it on each DC after any change and on a routine schedule.
• Backups. AD is backed up via System State on a domain controller, using Windows Server Backup or a product that performs a supported System State backup. Snapshot-only "backups" of DC virtual machines are not a substitute; restores must go through supported restore paths to avoid USN rollback.
• Time sync. Kerberos tolerates five minutes of skew by default. The PDC emulator should sync from a reliable external source and every other machine should follow the domain hierarchy; w32tm /query /status shows the current source and offset on any member or DC.

Common failure scenarios

Broken replication. A DC that cannot replicate — firewall change, DNS misregistration, decommissioned partner still in the topology — serves increasingly stale data. Logons still work, so the failure is silent until password changes and group updates stop propagating.

Tombstone expiration. Deleted objects are kept as tombstones for the tombstone lifetime (180 days on current defaults). A DC that has not replicated for longer than that is quarantined by its partners and cannot be brought back by simply reconnecting it; it must be demoted, cleaned out of the directory, and re-promoted.

FSMO holder loss. If a DC holding FSMO roles fails permanently, the roles must be seized to a surviving DC with ntdsutil or the Move-ADDirectoryServerOperationMasterRole cmdlet with the force option. After a seizure, the original holder must never return to the network in its old state.

Single-DC environments. One domain controller means authentication, DNS, and Group Policy all stop when that machine does. Two DCs, each also running AD-integrated DNS, is the practical minimum for any production domain.

FAQ

What is Active Directory used for?

Centralized authentication and authorization on a Windows network: one account per user, sign-on to every permitted resource, group-based access control, and policy-based configuration of domain-joined machines through Group Policy.

Is Active Directory the same as a domain controller?

No. Active Directory Domain Services is the directory service; a domain controller is a Windows Server that runs it. A domain normally has two or more DCs holding replicated copies of the same database.

Is Active Directory being replaced by Entra ID?

No. Entra ID handles cloud and SaaS identity; AD DS handles on-premises Kerberos, LDAP, and Group Policy. Organizations with on-premises servers run both, synchronized through Microsoft Entra Connect.

How many domain controllers does a domain need?

At least two, so that authentication and DNS survive the loss of one. Additional DCs are placed per site where a WAN outage would otherwise leave a location unable to log on.