Skip to content
Dispatching · New York Metro
(347) 262-9435
Field guide · Networking & wireless

Active Directory

Active Directory is the directory service a Windows network runs on — the forest and domain structure that holds every user, computer, and policy, and the roles and protocols that make a login work. This walks all of it interactively: explore the logical and physical structure, click through the five FSMO roles, see how Group Policy is applied, and step through the Kerberos exchange behind a single sign-on.

Plate 01Diagram

Forests, domains, roles, and how a login really works.

View

Forest → domains → OUs → objects: the structure you administer.

contoso.comForest

The forest — the top of the structure and the real security boundary.

A forest is the outermost container and the true security boundary of Active Directory: everything inside shares one schema, one configuration, and a global catalog, and every domain in it trusts every other automatically. You do not cross a forest without an explicit trust. The first domain created becomes the forest root.

  • One shared schema and configuration
  • Automatic two-way transitive trust between its domains
  • The security boundary — not the domain
Fig. 01Switch between the logical structure you administer and the physical structure replication runs on, then click any node to see what it is and why it exists.
Plate 02FSMO roles

The five single-master roles

Active Directory is multi-master, except for five jobs that would break if two servers did them at once. Two are held per forest, three per domain — click each for what it does and what its loss costs you.

Forest-wide · one per forest
Domain-wide · one per domain

Move a role gracefully with a transfer; when the holder is gone for good, seize it with ntdsutil — and never bring the old holder back.

PDC EmulatorDomain-wide

The busiest role: time, passwords, lockouts, GPOs.

The PDC Emulator is the one that actually matters hour to hour. It is the authoritative time source for the domain (Kerberos fails if clocks drift more than five minutes), it is where password changes and account lockouts are checked first, and it is the default target when you edit Group Policy. One per domain.

If the holder is down

Its outage is felt fast — time drift, password and lockout problems — so it is the role you transfer first.

Plate 03Group Policy

How Group Policy is applied

Every user and computer gets the GPOs linked above it, in a fixed order — Local, Site, Domain, OU — with the last one winning, unless Enforced or Block Inheritance changes the rules.

Processed top to bottom — last one wins

The mnemonic is LSDOU — Local, Site, Domain, OU.

OUstep 4 of 4

Finally the OUs, from the top of the tree down to the OU that directly contains the object. Because this is last, the GPO on the OU closest to the object normally wins — which is exactly why a good OU design is what makes Group Policy manageable.

The rules that bend it
Later wins
On a conflicting setting, the GPO applied later overrides the earlier one — so OU beats Domain beats Site beats Local.
Inheritance
An object receives every GPO linked above it, all the way up the tree, not just the nearest one.
Enforced
A link marked Enforced cannot be overridden by anything lower and cannot be blocked — it flips the 'later wins' rule for itself.
Block Inheritance
An OU can block inherited GPOs from above — but Enforced links still get through.
Security filtering
A GPO only applies to the users and computers it is filtered to; by default that is Authenticated Users.
Plate 04Kerberos

What happens at logon

Behind a single sign-on is a six-message exchange between the client, the KDC on a domain controller, and the service. Step through it to see how the password is proven once and then never sent again.

Clientthe user's PC
KDCon a domain controller
Servicefile, web, SQL…
AS-REQClientKDC1 / 6

I am j.smith — here is proof.

The client asks the KDC's Authentication Service for a ticket-granting ticket. It proves who it is with pre-authentication: a current timestamp encrypted with the key derived from the user's password. Only the real user (and the KDC) can produce it, and the password itself never crosses the wire.

Plate 05Questions
Questions people actually ask
What is the difference between a forest and a domain in Active Directory?
A domain is a single administrative and replication partition — its own users, password policy, and object database. A forest is the outer container that can hold several domains sharing one schema and a global catalog, and it is the real security boundary: every domain in a forest trusts every other automatically, so crossing forests takes an explicit trust.
What are the five FSMO roles?
The Flexible Single Master Operations roles handle the few jobs that cannot run multi-master. Two are held once per forest — Schema Master and Domain Naming Master — and three once per domain — RID Master, PDC Emulator, and Infrastructure Master. The PDC Emulator, which handles time, passwords, and lockouts, is the one whose loss is felt fastest.
What is an Organizational Unit (OU)?
An OU is a container inside a domain used for two things: delegating administration to the right people and scoping Group Policy to the right objects. OUs are invisible to users and are not security groups — you do not grant permissions with an OU, you grant them with groups.
In what order is Group Policy applied?
Local, then Site, then Domain, then OU — the mnemonic is LSDOU. Settings applied later override earlier ones, so the GPO linked to the OU closest to the object normally wins. Two overrides bend that: an Enforced link cannot be overridden or blocked, and Block Inheritance stops inherited GPOs except Enforced ones.
How does Kerberos authentication work?
The client proves its identity to the KDC once and receives a ticket-granting ticket. It then trades that TGT for a service ticket to each resource it reaches, and presents the service ticket directly to the service, which validates it with its own key without ever contacting the KDC. The password is proven once and never sent again.
What is the Global Catalog in Active Directory?
The Global Catalog is a partial, read-only copy of every object in the forest, held on selected domain controllers. It lets forest-wide searches and universal-group membership resolve without querying every domain, which is why at least one Global Catalog per site keeps logons fast.
Plate Other guides

The rest of the section

Free guidesNo sign-upNothing trackedWritten on the job
Rather it was just done

We do this work
as well as document it

Anyone learning Active Directory for a role or a cert, or mapping what they half-remember onto the parts that matter.

Or call and speak to someone who does the work(347) 262-9435inquiries@jcitsystems.com