What does Active Directory mean?

Active Directory (or AD) can be described as a standardized and centralized network system that is deployed in automating networks. AD was developed by Microsoft for Windows-based domain networks; hence, the directory is included in all Windows server operating systems. What’s more, it involves quite a number of processes and services.

Initially, AD was designed to handle centralized domain management. It all started with Windows server 2008 and has since become the base for a wider range of directory-based services. A domain controller is referred to a server running Active Directory. It is the server that authenticates and authorizes.

AD is used in authenticating and authorizes users on computers that are registered on Windows domain networking, thus assigning and enforcing security updates on such computers. When you log onto a computer that is registered under Windows domain, the AD on the computer will check all submitted passwords and check if you are a system administrator or a visiting user. The AD will allow storage and management of information only at the admin level.

Active Directory services are linked with several other services, including:

• Domain services
• Lightweight directory services
• Certificate services
• Rights and management services

Active Directory Domain Services, also known as ACDS, can be referred to as the backbone of every Windows domain network. It simply stores all information about members of a domain which include the users and the devices connected. The ACDS verifies credentials as well as grants or denies rights to use devices with Windows domains.

The domain controller may also be a cluster of different servers and it is the first thing protocol that will be contacted when the user has logged onto the device. Some other active directory domain services include encryption of file system, domain name services, exchanger servers, and SharePoint server.

Lightweight Directory Services is another service rendered under active directory services. Known as ADLDS, it is a lightweight implementation service that runs on identical API. This service does not require the recreation of sub-domains and one of its functions is to provide data storage facilities. Multiple ADLDS can be run on the same server.  Certificate services are available on ADCS are on-premise public key infrastructure. This certificate service can be used to revoke and validate any public key certificate for internal usage within an organization.

Certificate services are used in encrypting files, email, and also used in virtual private networks, transport layer protocol, and other network traffic control systems. ADCS was released before Windows server 2008 and has been used to regulate certificate authentication on the Windows server.

Right Management Services is software information that regulates Windows server’s emails and web pages. This software makes use of form and encryption functionality in denying or limiting access to documents on Windows servers. All corporate emails, Microsoft word documents, and web operations on Windows servers will require authorizes to perform them.

The Logical structure of AD

Being a directive service, AD consists of some databases, as well as executable codes that the service requests. The executable part of the AD is the directory system agent comprises of several Windows services that process and run on Windows 2000 and newer versions.

The objects in these databases are accessed via LDAP and ADSI which are components of object model interface. Other essential components of AD are the API and Security Accounts Manager services.

The AD comprises of “objects” that are used in coding information and these objects are categorized into two: Resources and Security principals. Security objects in AD include printers, while security principal objects include groups and computer accounts. Each object within the AD represents an entity; however, the deployment of the objects can cause a significant disruption to the working of the AD. Fortunately, objects can be created and or deleted from the AD. However, this will require adequate planning.

Active Directory Levels

Active Directories also comprises levels—just as objects—these include the Trees, Forests, and domains. These are the logical divisions of an active directory network. Objects are usually grouped into domains within a deployment, while the objects of single domains are located inside a single database and the database can also be replicated. Domains are usually identified through their active domain names.

The domain in Active Directory is often referred to as the logical group of network objects (objects may include computer devices and users). The objects in the same domain must share the same database within an Active directory (AD).

A tree is referred to as a collection of more than one domain and at the top of the structure of the AD hierarchy, is the “Forest”. A forest is simply a collection of trees of common logical structure or configuration.

The forest is simply a security boundary within which users, groups, and computers can access different objects. Considering the physical structure, AD holds the definitions for all connections and it helps differentiate between low and high-speed network infrastructures.

An example of a low-speed network is the WAN or VPN, while the LAN is a high-speed network. The control of network traffic within the AD is handled by domain controllers. Any network that utilizes AD will usually come with multiple window server computers. It must be noted that domain controllers used in Active Directories must not be allowed to perform other software roles in order to avoid redundancy or slow performance. Domain controllers will allow multiple updates in different sections of the Active Directory.

Similarly, “Trusting” is a process whereby the domain controllers allow users on one domain to access some resources from another domain. When it comes to providing trust services, the AD many allow a user to access resources in certain domains but prevent the user from accessing resources from other domains (this is referred to as one-way trust). A two-way trust is a kind of trust where the AD will allow access to two main domains).