What Is Active Directory? Meaning, How It Works, and AD DS Explained

What is Active Directory? Active Directory (AD) is Microsoft’s directory service for centrally managing users, computers, authentication, authorization, and policy in Windows networks. In Windows infrastructure, “Active Directory” usually means Active Directory Domain Services (AD DS), the on-premises service that stores directory objects on domain controllers and uses technologies such as DNS, Kerberos, LDAP, and Group Policy to connect users and devices to network resources.

In simple terms, the Active Directory meaning is a central directory that knows every user and computer in the organization, checks who they are when they sign in, and decides what they can access, instead of each machine keeping its own separate accounts.

This guide covers what is Active Directory and how it works, what it’s used for, and how domains, domain controllers, and forests fit together. Deployment and post-installation procedures are covered separately in How to Install Active Directory on Windows Server 2025.

What Is Active Directory?

Active Directory is the name of a family of Microsoft identity services, but in everyday use it refers to one of them: Active Directory Domain Services. The definition that matters for most Windows environments is this: Active Directory is the directory and domain service that holds the accounts for users, computers, and groups, authenticates them, and applies policy to them from a central place.

The other members of the family share the name but solve different problems: Active Directory Certificate Services (AD CS) issues certificates, Active Directory Federation Services (AD FS) handles federated sign-in, and Active Directory Lightweight Directory Services (AD LDS) provides a standalone LDAP directory without domains. When people ask “what is Microsoft Active Directory” or “what is AD Active Directory,” they almost always mean AD DS, and the rest of this article does too.

What Is Active Directory Domain Services (AD DS)?

AD DS provides the centralized identity layer behind a traditional Windows domain. It stores directory objects such as users, computers, groups, and service accounts, authenticates users and devices, and provides the policy and authorization framework used by domain resources. Microsoft’s own overview is available on Microsoft Learn: Active Directory Domain Services Overview.

AD DS does more than store user accounts. It also functions as an identity store, a Kerberos authentication service, an LDAP directory, and a Group Policy distribution mechanism. Treating it as “just a user database” is a common misconception, and it can send troubleshooting in the wrong direction because authentication, replication, DNS, and policy application are separate layers with different failure modes.

What Is Active Directory Used For?

In practice, what Active Directory does is give an organization one place to create accounts, control access, and push configuration to every domain-joined machine. Typical uses:

• Centralized user and account management
• Computer and domain membership
• Authentication of users and devices
• Authorization through security groups
• Single sign-on across domain resources
• Group Policy configuration at scale
• Centralized administration and delegation
• Access to Windows-based resources and AD-integrated applications

What Is Active Directory and How It Works

The core sequence, from credential entry to resource access:

1. A domain-joined client uses DNS to locate an appropriate domain controller.
2. The client contacts the DC.
3. Kerberos authenticates the user or computer.
4. The KDC issues a Ticket Granting Ticket (TGT) when authentication succeeds.
5. The client requests service tickets for resources.
6. The resource evaluates the user’s authorization context against its permissions.
7. Group Policy and directory lookups use AD services as needed.

On a healthy network these steps run in the background at sign-in and resource access, so users don’t see them. That is how Active Directory works from the user’s side: one sign-in, then access to every resource their groups allow.

Domain Controllers

A Domain Controller (DC) is a Windows Server with the AD DS role installed and promoted to a domain controller. It hosts a copy of the AD database, processes authentication requests, serves LDAP queries, stores and distributes Group Policy and SYSVOL content, and replicates directory data with other DCs; when that replication breaks, see Active Directory replication troubleshooting. Standard writable DCs can accept directory changes; Read-Only Domain Controllers (RODCs) host read-only replicas. Production domains normally use multiple DCs for redundancy.

DNS and Domain Controller Discovery

Clients locate domain controllers through DNS SRV records, so domain members need DNS servers that can correctly resolve the AD DNS zones and SRV records. Pointing clients only at a router, ISP resolver, or public DNS service prevents normal AD service discovery unless that resolver can resolve the internal AD namespace. DNS problems can break DC discovery, domain join, new authentication, and Group Policy retrieval, though cached logons and existing Kerberos tickets can keep working for a while after DNS resolution fails. Diagnosing those failures is covered in Active Directory DNS troubleshooting.

Kerberos Authentication

Kerberos handles authentication – proving identity – and has been the default protocol since Windows 2000. NTLM exists as a legacy fallback and should be restricted rather than relied on. Once the KDC issues a Ticket Granting Ticket (TGT) at logon, the client can use that TGT to request service tickets for domain resources without asking the user to re-enter credentials. That is the basis of Kerberos single sign-on in an AD environment, not a separate product. Microsoft documents the model at Microsoft Learn: Kerberos Authentication Overview.

LDAP Directory Queries

LDAP (Lightweight Directory Access Protocol) is the directory access protocol used by applications and administrative tools to search, read, and work with directory objects and attributes. Kerberos proves identity; LDAP provides access to directory data.

Authorization and Security Groups

Authentication and authorization are different steps. Authentication confirms identity; authorization decides what that identity can access. Once a user has a service ticket, the resource evaluates the security identifiers in the user’s authorization context – typically the user’s own SID and relevant security-group SIDs – against its access control list to grant or deny access.

Group Policy

Group Policy Objects (GPOs) centrally configure domain users and computers. GPO metadata is stored in Active Directory, file-based policy content is stored in SYSVOL, and clients process the applicable settings locally at logon and refresh. See Group Policy in Active Directory for scope and processing details, or Microsoft’s Group Policy overview documentation for the underlying mechanism.

What Does Active Directory Store and Manage?

• User accounts and credentials
• Computer accounts – every domain-joined machine has one
• Security groups and distribution groups
• Organizational Units (containers for delegation and GPO targeting)
• Group Policy Objects
• Service accounts
• Trust relationships between domains and forests

What Is an Active Directory Domain?

An Active Directory domain is a logical group of users, computers, groups, and OUs that share one directory database and one set of domain controllers. Every DC in the domain holds a copy of that domain’s directory partition and replicates changes with the others. The domain has its own DNS namespace, such as ad.example.com, which is how clients find its DCs. It is also the scope for domain authentication and for domain-level policy, such as the default password policy. A domain is always part of a forest, even when the forest contains only that one domain.

What Is an Active Directory Forest?

An Active Directory forest is the top-level logical boundary of an AD environment. It contains one or more domains that share a single schema, a single configuration partition, and a forest-wide Global Catalog. Domains in the same forest trust each other automatically through two-way transitive trusts, so a user from one domain can be granted access to resources in another. The forest, not the domain, is the security boundary: administrators of the forest root have control over every domain in it.

The difference between a forest and a domain in Active Directory comes down to scope. A domain is an administrative, authentication, and replication unit for its own directory partition. A forest is the container that holds one or more domains together under one schema and configuration. Domains that share a contiguous DNS namespace, such as example.com and emea.example.com, form a tree, and a forest can hold one tree or several. Most SMB environments run a single forest with a single domain.

Core Components of Active Directory

NTDS.dit is the database file that stores the directory data held by a domain controller. The schema defines what object types and attributes AD can store; it’s forest-wide, and extensions apply to every domain in the forest. A Global Catalog server holds a full copy of its own domain plus a partial, read-only copy of objects from every other domain in the forest, which is what makes forest-wide searches and cross-domain lookups possible.

How Active Directory Is Organized

See Active Directory Structure for the full forest, domain tree, domain, and OU hierarchy, with diagrams and a worked example.

Active Directory vs Local Accounts

Local accounts work fine for isolated machines with no shared resources. AD becomes useful once centralized identity, policy, resource access, delegation, or lifecycle management start to matter, regardless of exact environment size.

Active Directory vs Microsoft Entra ID

AD DS is an on-premises directory and domain service; Microsoft Entra ID (formerly Azure AD) is a cloud identity platform. They solve related problems but aren’t interchangeable. Entra ID isn’t a drop-in replacement for infrastructure that depends on LDAP, classic Kerberos or NTLM, traditional Group Policy, or AD-integrated server applications – those dependencies still need AD DS. Cloud-native environments built around Entra Join, Conditional Access, and SaaS authentication may not need traditional AD DS at all. Hybrid environments can run both: AD DS on-premises with identities synchronized to Entra ID through Microsoft Entra Cloud Sync or Entra Connect Sync.

Frequently Asked Questions

What is Active Directory in simple terms?

A Microsoft directory service that stores users, computers, and groups, and handles authentication, authorization, and policy centrally instead of managing each machine separately.

What is Active Directory used for?

Active Directory is used for centralized identity management, authentication, authorization through groups, device management, Group Policy, and access to Windows-based and AD-integrated resources.

How does Active Directory work?

DNS locates a domain controller, Kerberos authenticates the user or computer, the client gets a service ticket for the resource it needs, and the resource authorizes access based on the user’s authorization context.

What is the difference between Active Directory and a domain controller?

Active Directory Domain Services is the directory service – the database, authentication framework, and policy mechanism. A domain controller is the Windows Server that hosts and runs it.

Does Active Directory require DNS?

Yes. Normal Active Directory service discovery depends heavily on DNS, especially SRV records used to locate domain controllers and Kerberos services. DNS problems can break DC location, domain joins, new authentication, Group Policy processing, and replication.

What is the difference between Active Directory and Microsoft Entra ID?

AD DS is an on-premises directory and domain service. Entra ID is a cloud identity platform. They can run side by side in a hybrid setup, but Entra ID doesn’t replace every AD DS dependency on its own.

Is Active Directory still used?

Yes. AD DS remains a standard identity platform for on-premises Windows infrastructure. AD DS and Entra ID can also be used together in a hybrid setup.

Bottom Line

Active Directory Domain Services is the identity and policy foundation for Windows infrastructure: a directory of users, computers, and groups, tied together by DNS-based discovery, Kerberos authentication, LDAP queries, and Group Policy distribution. The core concepts – domain controllers, Kerberos authentication, LDAP directory access, DNS-based service discovery, and Group Policy – have remained recognizable across Windows Server generations, which is why understanding how these pieces fit together carries over from one version to the next.

Deployment and the full forest, domain, and OU hierarchy are covered in the guides linked above.