Active Directory Guide

Table of Contents

• Introduction to Active Directory
• Core Concepts
• Architecture
• Key Components
• Management and Administration
• Security Best Practices
• Tools and Utilities
• Troubleshooting

Introduction to Active Directory

Active Directory (AD) is Microsoft's directory service for Windows domain networks. It's a centralized and standardized system that automates network management of user data, security, and distributed resources, and enables interoperability with other directories.

Core Concepts

Domain Controllers

Domain Controllers (DCs) are servers that host Active Directory and manage authentication and authorization requests within a Windows domain network.

Objects and Attributes

AD stores information about network resources as objects with associated attributes:

• Users
• Computers
• Groups
• Organizational Units (OUs)
• Printers
• Shared folders

Forest and Domain Structure

The AD hierarchy consists of:

• Forests - Collection of domains sharing the same schema
• Trees - Collection of domains sharing a contiguous namespace
• Domains - Administrative boundary for objects
• OUs - Containers for organizing objects

Architecture

Physical Architecture

Components that make up the physical structure:

• Domain Controllers
• Global Catalog Servers
• Read-Only Domain Controllers (RODCs)
• Sites and Site Links

Logical Architecture

The logical structure includes:

• Schema - Defines object types and attributes
• Configuration - Replication topology and site information
• Domain - Contains users, computers, and groups

Key Components

LDAP

Lightweight Directory Access Protocol (LDAP) is the protocol used to communicate with Active Directory.

DNS

Domain Name System (DNS) is crucial for AD operation, providing name resolution and service location.

Management and Administration

Administrative Tools

Common tools for managing AD:

• Active Directory Users and Computers (ADUC)
• Active Directory Sites and Services
• Active Directory Domains and Trusts
• Group Policy Management Console (GPMC)

PowerShell Management

# Example: Get AD User
Get-ADUser -Identity "username"

# Create new AD User
New-ADUser -Name "John Doe" -SamAccountName "jdoe" -UserPrincipalName "jdoe@domain.com"

# Add user to group
Add-ADGroupMember -Identity "Sales Department" -Members "jdoe"
    

Security Best Practices

Account Security

• Implement strong password policies
• Use least privilege principle
• Enable account lockout policies
• Regular security audits

Group Policy

Use Group Policy Objects (GPOs) to:

• Enforce security settings
• Configure system settings
• Deploy software
• Map network drives

Tools and Utilities

Built-in Tools

• Active Directory Administrative Center
• ADSI Edit
• LDP.exe
• Repadmin.exe

Third-party Tools

• Active Directory Explorer
• AD Info
• AD FastReporter
• AD Tidy

Troubleshooting

Common Issues

• Replication problems
• Authentication failures
• DNS issues
• Group Policy application problems

Diagnostic Tools

# Check AD replication status
repadmin /replsummary

# Verify DC health
dcdiag /v

# Test DNS resolution
nltest /dsgetdc:domain.com