Active Directory Basics

Active Directory Domain Services (AD DS) is the beating heart of a Microsoft enterprise network. It is a centralized database that stores information about all the users, computers, and groups in your company, and acts as the ultimate authority for authentication.

Without AD, an IT admin would have to manually create a user account on every single laptop in the office. With AD, you create the account once on the Domain Controller, and that user can log into any PC in the building.

The Logical Structure of AD

To administer AD, you must understand its hierarchy:

1. The Domain: A logical boundary of objects (users, computers, groups) that share the same database and security policies. E.g., hq.gtarsenals.com.
2. The Tree: A collection of one or more domains that share a contiguous namespace. E.g., sales.hq.gtarsenals.com and hq.gtarsenals.com.
3. The Forest: The highest level of the AD hierarchy. A forest can contain multiple domain trees that don’t share the same naming structure, but do share a global catalog and trust relationship.
4. Organizational Units (OUs): Container objects within a domain used to organize users and computers. OUs are critical because you apply Group Policy (GPOs) directly to them. (e.g., An OU for “HR Department” and an OU for “Engineering”).

What is a Domain Controller (DC)?

A Domain Controller is a Windows Server that holds a copy of the Active Directory database.

When a user sits at their desk and types their password into Windows 11, that computer sends a Kerberos authentication request across the network to the Domain Controller. The DC verifies the password and grants them a “Ticket” to access the network.

For high availability, enterprises always deploy at least two Domain Controllers. They replicate their databases to each other constantly.

Verification & Troubleshooting

As a network engineer, you will often need to troubleshoot if a PC can actually reach the Domain Controller.

# 1. Verify what domain the computer is currently joined to
echo $env:USERDOMAIN

# 2. Look up the IP address of the Domain Controller using DNS
nslookup hq.gtarsenals.com

# 3. Check the secure channel connection to the Domain Controller
Test-ComputerSecureChannel -Verbose