Active Directory
Active Directory
Microsoft's central directory for users, computers, groups and access control in a Windows domain.
In everyday business: One staff account can be managed centrally instead of separately on every PC.
WINDOWS SERVER
Windows Server, Active Directory, DNS and Group Policy Playbook
How a modern Windows domain works and how to build one without turning the domain controller into an all-purpose server.
Book 3 | Chapter 4
Chapter opening
Chapter 4 moves from the course overview into windows server, active directory, dns and group policy. The aim is not to memorise product menus or commands. The reader should understand what problem the technology solves, how it fits into the wider servers and virtualization technical textbook, what normal operation looks like, and how to prove the result in the field.
The previous chapter introduced virtual machine networking and storage playbook. This chapter continues the sequence by focusing on windows server, active directory, dns and group policy playbook, so the reader can connect the architecture to a more specific operational problem.
Learning objectives
- Explain the main purpose of Windows Server, Active Directory, DNS and Group Policy in plain language.
- Explain how domain controllers, DNS, users, groups, OUs and Group Policy fit together.
- Use evidence to separate a design problem from a configuration or physical fault.
- Describe the business impact of a failure and the evidence required for handover.
Why this matters in a real company
For a company, this is about controlling who can sign in, which computers are trusted and what staff are allowed to access. A clean identity design reduces password chaos, orphaned accounts and uncontrolled administrator access.
PLAIN ENGLISH
Technical terms used in this chapter
You do not need to memorise the jargon first. Understand what each term does and why somebody running a company would care about it.
AD DS
Active Directory Domain Services
The Windows Server role that provides the Active Directory directory and domain authentication.
In everyday business: It gives the company one managed identity system for people and computers.
DNS
Domain Name System
The service that translates names into IP addresses and helps Windows domain clients find services.
In everyday business: People and applications can use names instead of remembering network numbers.
GPO
Group Policy Object
A set of centrally managed Windows settings that can be applied to users or computers.
In everyday business: IT can enforce security and configuration settings across many PCs at once.
PAT
Port Address Translation
A form of NAT that lets many internal connections share one public address by tracking transport ports.
In everyday business: Hundreds of users can browse the Internet through one public IPv4 address.
RPO
Recovery Point Objective
How much recent data the business can afford to lose.
In everyday business: It determines how often backups or replication need to run.
BUSINESS TRANSLATION
What this means outside the server room
This topic affects the systems staff depend on for sign-in, files, applications and business continuity. The technical design determines how easy the environment is to manage and how painful a failure becomes.
Active Directory
What it means: Active Directory centrally manages users, computers, groups and access in a Windows domain.
In normal business language: Think of it as one employee identity system for the company instead of separate usernames and passwords on every computer and server.
Why the decision matters: Use it when a company needs central sign-in, consistent permissions, controlled administrator access and easier onboarding/offboarding.
DNS
What it means: DNS translates names into IP addresses and also helps many business services locate each other.
In normal business language: It is the company phonebook for systems. Staff type a name such as fileserver or portal instead of remembering a number.
Why the decision matters: Good DNS design reduces configuration mistakes and is especially important for Windows domains, cloud integrations and internal applications.
Virtual Machine
What it means: A virtual machine is a software-defined computer with its own operating system, memory, CPU allocation, disks and network interfaces.
In normal business language: It behaves like a separate server even though several VMs may share one physical machine.
Why the decision matters: VMs are useful for separating roles such as domain control, file sharing and applications while keeping management and recovery flexible.
Backup
What it means: A backup is an independent recoverable copy of data or system state.
In normal business language: Think of it as having a duplicate of important company records stored safely away from the live filing cabinet.
Why the decision matters: A backup only counts if it can be restored. Test recovery, not just backup completion.
Replication
What it means: Replication copies data or VM state to another system or location.
In normal business language: It is like keeping a second live copy of the filing room at another branch. It can reduce recovery time, but bad changes can also be copied.
Why the decision matters: Replication improves availability and recovery speed, but it does not replace retention and backup.
NAT
What it means: NAT changes IP addresses as traffic crosses a network boundary.
In normal business language: It is similar to a company switchboard: many internal extensions can share one public number.
Why the decision matters: NAT helps with address use and publishing services, but it is not a substitute for firewall security.
Chapter contents
4.1 Active Directory Domain Services
Microsoft describes AD DS as a hierarchical directory that stores network objects such as users, computers and groups and provides centralised identity and authorisation.
Domain controllers
A domain controller hosts AD DS and replicates directory data with other DCs. Microsoft recommends protecting DCs carefully because compromise of a DC can affect the whole AD-managed environment.
DNS is part of AD
AD DS uses DNS to locate domain controllers and services. Domain members should use the organisation's AD-aware DNS infrastructure rather than relying only on public DNS.
OUs and Group Policy
OUs structure objects for administration and policy scope. GPOs centrally configure computer and user settings. Keep the OU design understandable and avoid creating dozens of OUs only to mirror an organisation chart.
corp.example
OU=Users
OU=Workstations
OU=Servers
OU=Service Accounts
OU=Admins
Deployment sequence
- Plan namespace and DNS.
- Install and patch Windows Server.
- Set static IP and DNS settings.
- Install AD DS and DNS.
- Create the forest/domain.
- Create OUs/groups.
- Add a second DC where resilience requires it.
- Create baseline GPOs.
- Join member servers/clients.
- Back up and monitor AD/DNS.
Good practice
- Separate everyday and privileged admin accounts.
- Use least privilege.
- Keep unrelated software off DCs where possible.
- Protect time sync and DNS.
- Document GPO ownership and purpose.
DEEPER TEACHING
Active Directory as the company's identity system
Active Directory becomes easier to understand when you stop thinking of it as "a Windows Server feature" and start thinking of it as the company's identity and policy database.
The directory is a database of objects
Microsoft describes AD DS as a hierarchical directory that stores objects such as users, computers and groups. A domain controller stores the directory and participates in replication with other domain controllers in the domain.
Authentication is not the same as authorisation
Authentication answers "who are you?" Authorisation answers "what are you allowed to do?" A user can authenticate successfully and still be denied access to a Finance share because the user is not a member of the authorised group.
Why DNS is part of Active Directory
Windows domain members use DNS to locate domain controllers and directory services. A workstation pointed only at public DNS may browse the Internet perfectly while domain sign-in, Group Policy and service discovery fail. That is why the client's DNS configuration belongs in the AD design, not as an afterthought.
A clean OU and group strategy
Organisational Units are useful for delegation and Group Policy scope. Security groups are useful for access. Avoid using OU placement as if it were a file-permission system. A practical pattern is to keep computer and user objects in OUs that reflect management needs, then grant resource access through security groups.
Worked onboarding example
- Create the employee account using a standard naming policy.
- Add the account to role-based groups such as Finance-Users or Sales-Users.
- Place the workstation in the correct computer OU.
- Sign in and verify the workstation receives the intended Group Policy.
- Test required file/application access with the employee account.
- Record exceptional access separately instead of burying it in broad groups.
Group Policy processing
Microsoft documents GPOs as centrally managed policy collections that can be linked to sites, domains and OUs. The computer and user determine which GPOs are in scope. The important operational lesson is to troubleshoot scope and processing rather than repeatedly editing the GPO itself.
gpupdate /force
gpresult /r
gpresult /h C:\Temp\gp-report.html
These commands are useful because they show what actually applied. "The GPO exists" is not proof that the target computer received it.
Two-domain-controller reasoning
A second domain controller can improve resilience, but only if replication, DNS and backup are healthy. It is not useful to have two servers that both depend on one failed switch, one failed storage system or one incorrect DNS configuration.
WORKED BUSINESS SCENARIO
Scenario: a growing company adds ten new staff
A company has grown from 12 to 45 employees. Each workstation used to have local user accounts and shared passwords. New starters now need access to the same files, printers and applications, while former staff must lose access immediately.
What the chapter teaches us: The problem is not simply password management. The business needs one identity system, controlled group membership, central computer policy and reliable DNS so sign-in and service discovery work consistently.
Think it through
- Which parts of the problem belong to identity, which belong to DNS, and which belong to file permissions?
- What would make onboarding and offboarding repeatable instead of manual?
- Which failure would stop users signing in even if their passwords were correct?
PRACTICAL WORK
Hands-on lab
Build a small lab domain with one DC and one client. Create two OUs, two security groups and two users. Join the client, then prove which DNS server it uses and which GPOs apply.
Troubleshooting exercise
A user can sign in locally but cannot sign in with the domain account. Check DNS, network reachability, time, domain membership and DC service health in that order.
Chapter field checklist
- I can explain the subject without relying only on acronyms.
- I can draw or describe the main traffic, storage, power or service path.
- I know what normal operation should look like.
- I know which logs, counters or test results prove the result.
- I can explain the business impact if this component fails.
- I would document the final configuration and evidence at handover.
Chapter summary
Windows Server, Active Directory, DNS and Group Policy Playbook should now be understood as a business service with a technical implementation, not simply a collection of commands or product names. The important habit is to know the purpose, understand the dependencies, measure the result and document what was proven.
END OF CHAPTER
Review questions
- Explain the subject in plain language to a business owner.
- List the main dependencies that must be healthy before this service can work.
- Describe one realistic failure and the first three pieces of evidence you would collect.
- Explain what should be documented at handover.
- Why is DNS central to a Windows domain?
- Why should normal user work not be performed with highly privileged domain accounts?
A good answer should explain the reason, not only repeat a product name or command.