# Active Directory A directory service developed by Microsoft for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. It authenticates and authorizes all users and computers in a Windows domain, assigning and enforcing security policies and managing network resources. **Pronunciation:** AK-tiv di-REK-tuh-ree **Difficulty:** Intermediate **Synonyms:** AD, AD DS **Categories:** Networking, Security, System Administration **Tags:** Microsoft, Directory Service, Identity Management, Authentication, Authorization, Windows Server Canonical: https://scaleengineer.com/glossaries/active-directory --- ## Definitions - **Core Directory Service:** **Active Directory** (**AD**) is a directory service developed by Microsoft for Windows domain networks. It is a central component of the Windows Server operating system that provides a wide range of services related to identity and access management. ### Key Concepts * **Objects:** Entries in the directory, such as users, groups, computers, printers, and applications. Each object has a set of attributes. * **Schema:** A blueprint that defines the types of objects and attributes that can be stored in the directory. * **Domain:** A logical grouping of objects that share a common security database and policies. * **Tree:** A collection of one or more domains with a contiguous DNS namespace. * **Forest:** The highest-level container in an **AD** structure, consisting of one or more trees. It represents the complete directory and security boundary. * **Domain Controller (DC):** A server running the **Active Directory Domain Services** (**AD DS**) role. It stores a copy of the directory database and handles authentication and authorization requests. ### Usage Administrators use **AD** to manage users and computers, enforce security policies through Group Policy, and deploy software across the network. It provides a single point of administration for a vast number of network resources. ### Example When a user logs into their work computer, the computer contacts a Domain Controller. The DC verifies the user's credentials against the information stored in the **Active Directory** database. If the credentials are valid, the user is granted access based on the permissions assigned to their account and group memberships. This entire process is managed by **AD**. ## Etymology The name 'Active Directory' was chosen by Microsoft to reflect its dynamic and active nature. 'Active' signifies that it's a centralized and constantly updated repository of network resources. 'Directory' refers to its function as a directory service, similar to a phone book for network objects. ## First used 1999 ## Historical context Microsoft first introduced **Active Directory** in 1999 with the beta release of Windows 2000 Server, officially launching it in February 2000. It was a significant evolution from the domain model used in Windows NT, which was less scalable and harder to manage in large environments. **AD** was designed to be a hierarchical, multi-master, and scalable directory service based on standards like LDAP (Lightweight Directory Access Protocol), DNS (Domain Name System), and Kerberos for authentication. This standards-based approach made it more interoperable and robust than its predecessors. Over the years, with subsequent releases of Windows Server (2003, 2008, 2012, 2016, 2019, 2022), **Active Directory Domain Services** (**AD DS**) has been enhanced with new features. These include the introduction of functional levels, Read-Only Domain Controllers (RODCs), the Active Directory Recycle Bin, and improved integration with cloud services, most notably Azure Active Directory. ## Q&A - **What is the primary function of Active Directory?:** The primary function of **Active Directory** is to provide centralized authentication and authorization services for a Windows domain network. It acts as a central database and service that stores information about network resources, such as users, computers, printers, and groups, and allows administrators to manage permissions and access to these resources from a single location. - **What is a 'domain' in the context of Active Directory?:** In the context of **Active Directory**, a domain is a logical grouping of network objects, such as users, computers, and devices, that share a common security boundary. All objects within a domain are managed by a set of domain controllers, which store the **AD** database and enforce security policies for that domain. - **What is the difference between Active Directory and Azure Active Directory?:** **Active Directory** (**AD**) is an on-premises directory service designed for managing traditional Windows domain networks. It uses protocols like Kerberos and LDAP for authentication. Azure Active Directory (Azure AD), on the other hand, is a cloud-based identity and access management service. It is designed for web-based services and uses modern authentication protocols like OAuth 2.0, OpenID Connect, and SAML. While they can be synchronized, they are fundamentally different services for different environments. ## Usage examples - The system administrator used **Active Directory** to create a new user account and assign it to the 'Sales' security group. - To enforce a new password policy across the company, we need to configure the Group Policy Objects (GPO) within **Active Directory**. - Our application integrates with **AD** for single sign-on, allowing employees to log in with their existing network credentials. ## Related terms - LDAP - Kerberos - Group Policy - Domain Controller - DNS - Azure Active Directory ## Popular related terms - Group Policy - Domain Controller - Azure Active Directory - LDAP - Kerberos