PlatformMicrosoftMature
Active Directory
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
Technology explained
What is Active Directory?
Active Directory is Microsoft's directory service for centrally managing Windows identities, computers, groups, policy and access within an organisation.
Active Directory Domain Services stores directory objects and uses DNS, Kerberos, LDAP and multi-master replication to provide authentication and authorisation across domain-joined environments. Its forests, domains, organisational units and trust relationships form the administrative and security boundary.
Primary purpose
Provide central identity, authentication, policy and resource access for Windows-centric estates.
Typical environments
Windows ServerCorporate NetworksHybrid Cloud
Typical use cases
- Centralized identity management
- Domain-joined device management
- Access control via Group Policy
Technology map
Explore related technologies
Sub-technologies
Related technologies
Connected knowledge
18+ resources for Active Directory
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Technology journey
Learn and operate with Active Directory
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Systems Engineering(2)
Learn the architecture, concepts and engineering context.
- Preventing DNS Split-Brain in Hybrid Azure/ADA technical guide to eliminating DNS split-brain in hybrid Azure/AD environments using NRPT, GPO policy and Azure Private DNS Resolver architecture. Open
- Visualising AD Replication Latency & TombstonesCharting AD replication latency against tombstoneLifetime, using USN vectors and repadmin data to catch lingering objects before they reanimate. Open
Graduate Learning(1)
Build practical knowledge and hands-on skills.
Config Traps(12+)
Recognise and avoid known failure modes.
- Removed Authenticated Users From a GPO's Security Filter and Broke Policy DeliveryRemoving Authenticated Users from a GPO's security filter to scope delivery silently blocks policy application on computers unless the replacement group explicitly holds Apply Group Policy rights. Open
- Unconstrained Kerberos Delegation on a Service Account Grants Domain-Wide ImpersonationAn Active Directory service account marked for unconstrained Kerberos delegation caches the TGT of any authenticating user, turning a routine legacy compatibility setting into a domain-wide impersonation risk. Open
- AdminSDHolder Protection Silently Skips Groups Nested Below Domain AdminsA group nested two levels below Domain Admins in Active Directory can lose its inherited privileged ACL silently, because AdminSDHolder's SDProp protection does not reliably extend to that nesting depth. Open
- Allowing Nonsecure Dynamic Updates Lets Any Host Hijack an AD-Integrated DNS ZoneAn AD-integrated DNS zone left on Nonsecure and secure dynamic updates accepts unauthenticated record writes from any reachable host, letting rogue devices silently hijack names used by domain controllers and services. Open
- Nested Membership in Domain Admins Escapes AdminSDHolder ProtectionNesting a group inside Domain Admins grants Domain Admin-equivalent rights to its members, but AdminSDHolder only protects direct membership, leaving the nested group and its members unflagged, unaudited and easy to miss. Open
- AdminSDHolder's Automatic ACL Reset Silently Restores Revoked Access to Domain AdminsCleaning a suspicious permission off Domain Admins looks successful until it silently comes back, because AdminSDHolder, not the group itself, is the real source of truth SDProp keeps re-applying. Open
- SYSVOL's Broad Read Access Exposes Legacy GPP PasswordsSYSVOL's required broad-read design silently exposes legacy Group Policy Preferences credentials to every domain user. Here is how to find, fix and prevent the trap. Open
- msDS-SupportedEncryptionTypes Left Unset Lets Kerberos Silently Issue RC4 TicketsA domain-wide GPO enforcing AES-only Kerberos does not retroactively set the per-account msDS-SupportedEncryptionTypes attribute, leaving specific accounts still issuing RC4 tickets undetected. Open
- Disabling SID Filter Quarantine on a Forest Trust Reopens SIDHistory EscalationA trust-wide fix for broken migrated access silently removes the boundary control that stops SIDHistory-based privilege escalation between forests. Open
- An Extra ACE on AdminSDHolder Silently Grants Control Over Every Protected AD AccountAn ACE added to AdminSDHolder for a low-privilege automation account was propagated by SDProp to every protected AD group member, granting silent domain-wide admin control. Open
- Enabling DNS Aging Without Server-Level Scavenging Never Removes Stale Active Directory RecordsZone-level DNS aging and server-level scavenging are independent switches in Active Directory DNS. Enabling one without the other leaves stale records silently in place. Open
- A WMI Filter That Fails to Evaluate Silently Skips GPO EnforcementWhen a WMI filter can't be evaluated on a client, Group Policy quietly skips the linked GPO instead of applying it — and nothing in the standard GPMC view shows the difference. Open
Incident Runbooks(2)
Stabilise, recover and validate during incidents.
- Active Directory Domain Controller Replication FailureDiagnose Active Directory domain controller replication failure with Repadmin, DCDiag, event IDs, DNS, RPC and time evidence; avoid forest-wide repadmin /syncall until topology knowledge is consistent and the exact error is resolved. Open
- Active Directory Kerberos Logons Fail Because a Member Server Clock Is SkewedDiagnose Kerberos authentication failures caused by clock skew on a Windows member server and safely restore time synchronization before validating logons. Open