It stores objects such as users, groups, computers, services, and policies, and lets domain controllers provide authentication, directory queries, replication, and authorization data to joined systems and applications.
AD DS organizes objects into domains and organizational units, with one or more domains forming a forest. It relies heavily on the Domain Name System (DNS), uses protocols including Kerberos and the Lightweight Directory Access Protocol (LDAP), and supports policy administration through Group Policy. Because applications and administrators often depend on it, AD DS is part of the organization’s identity control plane.
Key points
Directory structureThe schema defines object types and attributes; domains partition directory data, and domain controllers replicate it.
Trust and delegationForest and domain trusts can extend authentication paths, while groups, access-control lists, and delegated administration influence effective authority.
Operational prioritiesProtect domain controllers and privileged administration, secure backups and recovery, monitor sensitive changes, and retire weak protocols and obsolete dependencies where feasible.
Important limitationCentralization does not make access correct or secure by itself. A compromised domain controller, privileged identity, trust, or replication path can create broad impact, while legacy applications may preserve weaker authentication and excessive privilege.