What Is Active Directory?

Active Directory (AD) is Microsoft's directory service that stores information about network resources — users, computers, groups, printers, and shared folders — in a hierarchical, searchable database, and provides the authentication and authorization services that let those resources securely interact. Instead of managing local accounts on every machine individually, administrators create one AD account per user that grants sign-in and access rights across the entire domain, following the principle of centralized identity management.

The Active Directory Domain Services (AD DS) role is the Windows Server component that actually implements the directory. It stores every object — user accounts, security groups, computer accounts, group policy objects — in a database file called ntds.dit, and exposes that data over the Lightweight Directory Access Protocol (LDAP) on port 389 (or 636 for LDAPS). Administrators and applications query and modify AD using LDAP distinguished names such as CN=Jane Doe,OU=Sales,DC=contoso,DC=com, which encode an object's exact position in the directory hierarchy.

A domain controller (DC) is a server running AD DS that holds a writable copy of the directory database for its domain. AD uses multi-master replication, meaning every DC (except read-only domain controllers, or RODCs) can accept changes, which then propagate to other DCs via the Knowledge Consistency Checker (KCC) using Remote Procedure Calls (RPC) over IP, following an automatically generated replication topology. This design means there's no single point of failure — if one DC goes offline, others still authenticate users and process changes, and updates like a password reset made on one DC eventually converge across the whole site.

AD DS uses Kerberos as its default authentication protocol. When a user logs in, the Key Distribution Center (KDC) service running on every DC issues a Ticket Granting Ticket (TGT), which the client then presents to request service tickets for specific resources like a file server or SQL instance, without ever transmitting the password itself. NTLM (NT LAN Manager) is an older, weaker challenge-response protocol AD still supports for backward compatibility, but it lacks mutual authentication and is more vulnerable to relay and pass-the-hash attacks, so modern hardening guidance pushes organizations to disable NTLM wherever Kerberos is viable.