I spent an hour learning about Microsoft Active Directory (AD) and focused on understanding what it actually is rather than simply memorizing terminology.
My initial understanding was that Active Directory is a directory on Windows Server that stores information about users, computers, devices, and policies. As I explored the concepts further, I developed a clearer understanding of how Active Directory Domain Services (AD DS), Domain Controllers, DNS, Kerberos, LDAP, and Group Policy work together to provide centralized identity and management within an enterprise Windows environment.
The biggest takeaway is that Active Directory is not simply "a database of users." It is a directory service and centralized identity infrastructure that allows organizations to manage users, computers, groups, authentication, authorization, and policies across a domain.
What I Learned
1. Active Directory / AD DS
Active Directory is a directory service used to centrally organize and manage information about objects within an organization's domain.
These objects can include:
Users
Computers
Groups
Organizational Units (OUs)
Other directory objects and resources
A useful mental model I developed is:
Active Directory
│
├── Users
├── Groups
├── Computers
├── Organizational Units
└── Other directory objectsRather than treating AD as simply a normal database or folder, I now understand it as a centralized directory service that stores and organizes information about an organization's identity and computing environment.
2. Domain Controller
A Domain Controller (DC) is a Windows Server computer running Active Directory Domain Services (AD DS).
The Domain Controller provides the services that allow computers and users to interact with the domain and its directory.
A simplified model is:
Windows Server
│
└── AD DS
│
└── Domain Controller
│
└── Active DirectoryThis helped me correct an earlier assumption.
Instead of thinking:
"Active Directory is the server."
I now think:
A Windows Server can become a Domain Controller by installing and configuring AD DS, and that Domain Controller provides Active Directory services to the domain.
3. Authentication
I initially thought that "Active Directory performs authentication."
That is broadly correct from a high-level perspective, but I learned that the components should be distinguished.
When a user logs into a domain-joined computer:
User
↓
Windows Computer
↓
Domain Controller
↓
Active Directory / AD DS
↓
Authentication
↓
Access grantedThe Domain Controller provides the authentication service using information from the Active Directory environment.
I also learned that Kerberos is the primary authentication protocol used in an Active Directory domain.
A simplified view is:
User
↓
Domain Controller
↓
Kerberos authentication
↓
Authentication ticket
↓
Access to domain resourcesThis gave me a better understanding of what it actually means when people say that "Active Directory handles authentication."
4. DNS
I learned that DNS is extremely important to Active Directory.
A computer on a domain needs to be able to locate domain services, including its Domain Controller.
Conceptually:
Computer
↓
DNS
↓
"Where is the Domain Controller?"
↓
Domain ControllerThis made me realize that Active Directory is not an isolated Windows feature. It depends on several other network services to function properly in a domain environment.
5. LDAP
LDAP (Lightweight Directory Access Protocol) provides a way to interact with and query directory information.
For example, an application could query the directory for information about a user or determine which groups a user belongs to.
Application
↓
LDAP
↓
Active Directory
↓
User / Group informationMy current understanding is:
LDAP is a protocol used to query and interact with directory information.
6. Group Policy
I learned that Group Policy is used to centrally configure and enforce settings for users and computers.
Examples include:
Password requirements
Account policies
Security settings
Firewall configuration
Other Windows configuration settings
Conceptually:
Domain
↓
Group Policy
├── User settings
├── Security settings
├── Password policies
├── Firewall settings
└── Computer configurationThis demonstrated another major advantage of Active Directory: administrators don't necessarily have to configure every machine individually.
7. Active Directory and Network Resources
I also clarified my understanding of resource sharing.
Active Directory isn't necessarily the system that physically stores shared files. A file server can host the actual resources, while Active Directory can provide the identity and access-control information needed to determine who is allowed to access them.
For example:
User
↓
Authentication through AD
↓
Group membership
↓
Access decision
↓
Windows File Server
↓
Shared ResourceThis helped me distinguish between providing a resource and managing who is allowed to access it.
My Current Mental Model
After studying Active Directory for roughly an hour, this is the architecture I currently understand:
DOMAIN CONTROLLER
Windows Server / AD DS
│
┌────────────┼────────────┐
│ │ │
Active Directory DNS Group Policy
│
Users / Groups /
Computers / OUs
│
│
┌──────┴──────┐
│ │
Windows PC Windows PC
│
└── Kerberos authentication
│
↓
Access domain resources
│
LDAP
(directory queries)The most important thing I learned is that Active Directory is not one isolated feature. It is part of an ecosystem of services and protocols that work together to provide centralized identity, authentication, management, and access control.
Key takeaway: I only spent about an hour studying Active Directory, but understanding the relationship between AD DS → Domain Controller → DNS → Kerberos → LDAP → Group Policy gave me a much deeper foundation than simply memorizing what Active Directory is.
What's next: Setting up my own Active Directory Home Lab.