3.2Active Directory basics & the domain
The essentials in 30 seconds
- Active Directory is a central directory: a single identity per person, valid across the whole fleet, managed from a single point.
- The domain is the administered perimeter; the domain controller (DC) hosts the directory and authenticates connections.
- Objects (users, computers, groups, printers) are organised into organisational units (OUs); the cloud version is Entra ID (formerly Azure AD).
Running mini-case — Sofiane structures the SME's directory
Sofiane's distribution SME, in Algiers, has grown: managing each workstation with its local account has become untenable. Sofiane deploys Active Directory. He creates a domain for the company, plans two domain controllers for redundancy, and draws a tree of organisational units that reflects the real organisation: departments (accounting, shipping, HR) and sites. He files the objects there — users, computers, groups, printers. The benefit is immediate: a single identity per person, the same across the whole fleet. He notes the reflex: structure the OUs like the company and never depend on a single controller.
Standalone case for this section: it returns in the lesson, the diagram, the script and the 48h challenge of section 3.2.
1. The problem Active Directory solves
Managing 5 workstations “each in its own corner” remains possible; managing 200 that way becomes impossible. Active Directory (AD) is a central directory: a single identity per person, valid across the whole fleet. The user logs on to any workstation of the domain with the same account, and the administrator manages everything from a single point. Sofiane measures the leap in complexity as soon as the SME goes beyond a handful of workstations.
2. Domain and domain controller
The domain is the perimeter managed by AD. The domain controller (DC) is the server that hosts the directory and authenticates connections. It stores objects: users, computers, groups, printers, organised into organisational units (OUs) that reflect the company (departments, sites). Sofiane makes sure to plan at least two domain controllers to avoid a single point of failure.
3. What AD makes possible
Thanks to AD: single sign-on, centralised management of accounts and groups, application of rules via GPOs (next section) and delegation of administration. It is the backbone of most corporate Windows fleets. Its cloud version is Entra ID (formerly Azure AD): many companies run both side by side during their transition.
🔎 Concrete example — 🔎 Concrete example — Logging on everywhere with the same account
In Sofiane's SME, once the domain is in place:
Karim logs on to the reception PC -> OK (same account)
Karim moves to another workstation, another floor -> OK (same account)
His password changes once -> valid everywhere at onceReading: the domain controller authenticates; the workstation no longer has an isolated local account.
Lesson: a central identity = simplified and consistent management at scale.
Section vocabulary
- Active Directory (AD)
- Microsoft's central directory for managing the identities and resources of a Windows fleet.
Simple example: Sofiane manages the whole SME's accounts and groups there.
What it is not: a mere inventory of machines without authentication.
Reflex: centralised identities → AD.
- Domain
- Perimeter administered by AD, with a common identity base.
Simple example: The employee logs on to any workstation of the domain.
What it is not: an isolated workstation with only its local account.
Reflex: common perimeter → domain.
- Domain controller (DC)
- Server that hosts the AD directory and authenticates connections.
Simple example: The DC validates each user's logon.
What it is not: a plain file server without a directory role.
Reflex: authenticate → the domain controller.
- Organisational unit (OU)
- Container that organises AD objects (by department, site…).
Simple example: Sofiane files the shipping accounts in a dedicated OU.
What it is not: an alphabetical list with no business logic.
Reflex: organise a fleet → OUs.
- Entra ID
- Cloud version of Microsoft's identity directory (formerly Azure AD).
Simple example: Sofiane synchronises identities with Microsoft 365 via Entra ID.
What it is not: the AD directory strictly on-premises.
Reflex: directory in the cloud → Entra ID.
In practice — In practice — Modelling a simple domain
- Draw a small company with its departments and its sites, like Sofiane.
- Propose a tree of organisational units (OUs) that reflects this organisation.
- Place a few users, computers and groups in the OUs.
- Explain what the company gains compared with isolated local accounts.
Step-by-step script — describing the SME's domain like Sofiane (4 min)
1) List the company's departments and sites. 2) Draw the OU tree that reflects them. 3) Place a few objects (users, computers, groups) in the right OUs. 4) Name the role of the domain controller: host the directory and authenticate. 5) Plan at least two DCs for redundancy.
Keep this diagram: section 3.3 (GPO) will build on it, since a policy links to a domain, a site or an OU.
Copy-paste template — my domain map
Domain : pme-example.local (perimeter managed by AD)
Domain controller(s) : DC1 + DC2 (redundancy)
OU tree : Departments / Sites
Objects : users, computers, groups, printers
Cloud : Entra ID (formerly Azure AD), often synchronised
Rule : a single identity, valid across the whole fleetA new employee
Sofiane creates a single account in the directory: the person then logs on anywhere in the domain.
A change of floor
The employee changes workstation: same account, no local profile to recreate.
A DC outage
A domain controller goes down: the second keeps authenticating, without interruption.
Towards the cloud
Sofiane considers Entra ID to synchronise identities with Microsoft 365.
✓ Best practices
- Structure the OUs like the company (departments, sites).
- Centralise identities and groups in AD.
- Plan the redundancy of domain controllers.
✗ Common pitfalls
- Multiplying local accounts instead of using AD.
- Creating an inconsistent OU tree.
- Having only a single DC (single point of failure).
Key takeaways
- AD is a central directory: one identity per person, across the whole fleet.
- The domain is the perimeter; the domain controller authenticates.
- Objects (users, PCs, groups) are organised into OUs.
- AD enables single sign-on and centralised management; its cloud version is Entra ID.
48h challenge — apply it tomorrow
Like Sofiane, draw the domain of an imaginary company: the domain controller, a tree of OUs that reflects its departments and sites, and a few objects filed inside. Then write in one sentence what the company gains compared with isolated local accounts on each workstation.
- I can explain the role of Active Directory and of the domain.
- I can place the domain controller and the organisational units.
- I know what AD brings: single sign-on and centralised management.
Frequently asked questions
Are AD and Entra ID the same thing?
They are cousins: AD is the historic “on-premises” directory, Entra ID (formerly Azure AD) is the cloud identity service (Microsoft 365). Many companies use both, synchronised, during their transition to the cloud.
Do you need several domain controllers?
Yes, as soon as authentication is critical: with a single DC, its failure prevents any logon. You deploy at least two for redundancy.
What is the main role of Active Directory?