Module 1: Active Directory Overview & Installation

← Course Index

Module 1 of 8

Module 2: Users & Groups →

🎯 AD Administration Course · Module 1 of 8

Active Directory Overview & Installation

📂 Course: Active Directory Administration
📦 Module: 1 of 8
🎯 Exam: AZ-800
⏱ Read time: ~25 min
AZ-800
AZ-800 Exam Alignment
AZ-800

Deploy and manage Active Directory Domain Services: Understand the core logical structure of AD DS, install the AD DS role on Windows Server, promote a server to domain controller, and configure domain and forest functional levels.

  • Know the difference between domain, tree, forest, OU, schema, and global catalog
  • Understand what happens during DC promotion and which DNS SRV records are created automatically
  • Know that PowerShell is the preferred promotion method for Server Core environments
  • Understand that raising domain/forest functional levels is a one-way irreversible operation
Exam Tip: AZ-800 tests the global catalog role heavily — know that it stores a partial replica of all objects in the forest and is required for Universal Group membership resolution in multi-domain forests. Also know that dcpromo.exe was deprecated in Windows Server 2012 — promotion is now done via Server Manager or PowerShell.
Active Directory Domain Services (AD DS) is Microsoft’s on-premises directory service — the backbone of enterprise identity management in Windows environments. It manages authentication, authorisation, and resource access across an organisation’s network. Understanding its architecture is fundamental before you administer, troubleshoot, or secure any Active Directory environment.

🌎 AD DS Logical Structure

Active Directory organises resources using a hierarchical logical structure. These components are the foundation of every design and administration decision.

Component Definition Key Facts
Domain The basic administrative and security unit of AD DS — a collection of objects sharing a common directory database and policies. Has its own domain controllers, Group Policy, and trust boundary. Each object has a unique Distinguished Name (DN).
Forest The outermost security boundary of AD DS — one or more domains sharing a common schema, global catalog, and configuration partition. All domains in a forest automatically trust each other (two-way transitive). One schema per forest.
Tree A hierarchical collection of domains sharing a contiguous DNS namespace within a forest. Example: techcareers.local, uk.techcareers.local, and us.techcareers.local form a tree.
OU An Organizational Unit — a container within a domain used to organise objects and apply Group Policy. The only container type to which GPOs can be directly linked. Can be nested. Used for delegation of control.
Schema The forest-wide blueprint defining every object class and attribute that can exist in AD DS. Forest-wide — one schema per forest. Schema changes are permanent. Requires Schema Admin role.
Global Catalog A DC that stores a full copy of all objects in its home domain plus a partial read-only replica of all objects in every other domain in the forest. Required for Universal Group membership resolution, UPN logon across domains, Exchange, and AD Connect. First DC in a forest is GC by default.

⚠️ Domain is the Security Boundary — Not the OU

The domain is the security boundary in AD DS. OUs are administrative containers for delegation and GPO application only. A Domain Admin has authority over all objects in the domain, regardless of OU structure. Enterprise Admins (in the forest root domain) have authority over all domains in the forest.

🔧 Installing AD DS and Promoting a Domain Controller

Promoting a server to a domain controller is a two-step process: install the AD DS role, then run the AD DS Configuration Wizard or PowerShell promotion cmdlets.

Server Manager › Add Roles and Features › Role-based installation › Active Directory Domain Services
AD
Active Directory Users and Computers
|
techcareers.local
📄 Active Directory Users and Computers
🌎 techcareers.local
📁 Builtin
💻 Computers
🏗️ Domain Controllers
👤 Users
📁 Managed Service Accounts
📁 HR
📁 IT
📁 Finance

Domain Controllers
Name Type Site
DC01 Domain Controller (GC) Default-First-Site
DC02 Domain Controller (GC) Default-First-Site
ⓘ Both DCs are global catalog servers. AD DS database (NTDS.dit) stored at C:\Windows\NTDS on each DC.

PowerShell — Install AD DS Role + Promote to First DC in New Forest

# Step 1: Install the AD DS role and management tools
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Step 2: Promote to the first DC in a new forest
Install-ADDSForest `
    -DomainName 'techcareers.local' `
    -DomainNetbiosName 'TECHCAREERS' `
    -DomainMode 'WinThreshold' `
    -ForestMode 'WinThreshold' `
    -InstallDns `
    -Force

# After reboot - query the domain and forest
Get-ADDomain | Select-Object DNSRoot,NetBIOSName,DomainMode,PDCEmulator
Get-ADForest | Select-Object Name,ForestMode,SchemaMaster,DomainNamingMaster

# Add a second DC to an existing domain
Install-ADDSDomainController `
    -DomainName 'techcareers.local' `
    -InstallDns `
    -Credential (Get-Credential) `
    -Force

📊 Domain and Forest Functional Levels

Functional Level Minimum DC OS Key Features Unlocked
Windows Server 2012 R2 Windows Server 2012 R2+ Protected Users security group, Authentication Policies and Silos, DC Cloning
Windows Server 2016 Windows Server 2016+ Privileged Access Management (PAM) with time-bound membership, DC cloning improvements
Windows Server 2019 / 2022 Windows Server 2019+ AES Kerberos enforcement, improved security defaults. Forest/domain mode = WinThreshold for 2016+

🛠️ AD DS Management Tools

Tool Command Best Used For
ADUC dsa.msc Day-to-day management of users, groups, computers, OUs. Most commonly used GUI tool.
ADAC dsac.exe Fine-grained password policies, AD Recycle Bin, PowerShell History Viewer (shows PS commands behind each GUI action).
ADSI Edit adsiedit.msc Low-level attribute editing. View schema, configuration, and application partitions. Use with extreme caution.
GPMC gpmc.msc Creating, linking, and managing Group Policy Objects.
Sites and Services dssite.msc Managing AD sites, subnets, site links, and replication topology.
AD PowerShell Module Import-Module ActiveDirectory Scripted management, bulk operations, automation on DCs and RSAT workstations.

💡 Best Practices

  • Always deploy at least two domain controllers per domain — a single DC is a single point of failure for the entire domain
  • Store the AD database (NTDS.dit), log files, and SYSVOL on separate volumes from the OS for performance and recoverability
  • Enable the AD Recycle Bin immediately after forest creation — it cannot recover objects deleted before it was enabled
  • Use WinThreshold functional level for new forests (Windows Server 2016+) to get all modern AD DS security features from day one
  • Install DNS Server on the first DC and use AD-integrated DNS zones for automatic replication and secure dynamic updates
  • Make all domain controllers global catalog servers in most environments — this eliminates GC availability as a logon dependency

🎓 Interview Q&A

Q: What is a global catalog server and why is it critical for user logon?
A global catalog (GC) server stores a full replica of all objects in its own domain and a partial read-only replica of all objects in every other domain in the forest. It is critical for logon because Windows must resolve Universal Group membership during the logon process — and Universal Groups can contain members from any domain in the forest. Without a reachable GC, the DC cannot build the user’s complete access token, so logon fails. Additional GC uses include: UPN logon across domains, Exchange address book lookups, and Azure AD Connect synchronisation.

Q: What is the difference between a domain and a forest in Active Directory?
A domain is the basic administrative and security unit — containing objects (users, computers, groups), managed by domain controllers, with its own Group Policy and replication scope. A forest is the outermost security and replication boundary, consisting of one or more domains that share a common schema, global catalog, and configuration partition. All domains in the same forest automatically trust each other transitively. The forest root domain houses the Schema Master and Domain Naming Master FSMO roles. Separate forests are isolated by default and require explicit external or forest trusts to share resources.

Q: What is stored in NTDS.dit and why is it a critical security target?
NTDS.dit is the Active Directory database file stored on every domain controller at C:\Windows\NTDS\ntds.dit. It stores all AD DS objects and attributes including user accounts, computer accounts, groups, and — critically — password hashes (NTLM and Kerberos keys) for all accounts. Because it contains the credential material for every account in the domain, extracting NTDS.dit (combined with the SYSTEM hive for the boot key) allows offline password cracking of all domain accounts. This is why domain controllers are the highest-priority servers to secure — physical access to a DC must be tightly controlled.

🎯 AZ-800 Mock Test
Module 1 — AD Overview & Installation
5 questions · Scenario-based · Pass mark: 70%

Question 1 of 5

Your organisation has a single AD forest with three domains. Users in domain-a.local report intermittent logon failures even though their local domain controller is online. Investigation shows all global catalog servers are offline. What is the most likely cause of the logon failures?

AThe Kerberos KDC service is only hosted on global catalog servers
BDNS cannot resolve domain names without a global catalog server
CUniversal Group membership cannot be resolved without a GC, so the domain controller cannot build a complete access token for logon
DUser password hashes are only stored on global catalog servers

Question 2 of 5

An administrator needs to promote a Server Core installation of Windows Server 2022 to a DC in an existing domain. Which is the correct approach?

ARun dcpromo.exe — it is the only promotion tool available on Server Core
BInstall-WindowsFeature AD-Domain-Services, then use Install-ADDSDomainController via PowerShell
CInstall Desktop Experience first — AD DS promotion requires the GUI wizard
DUse ADUC on a remote workstation — remote promotion is only possible via ADUC

Question 3 of 5

Before raising the Forest Functional Level from Windows Server 2012 R2 to Windows Server 2016, what must be true?

AAll DCs in all domains in the forest must be running Windows Server 2016+, and all Domain Functional Levels must already be at Windows Server 2016
BOnly the forest root domain DCs need to be running Windows Server 2016
CA full AD backup must be taken before the operation — the FFL can then be raised immediately
DThe Schema Master must be upgraded to Windows Server 2016 and the schema extended first

Question 4 of 5

Which Active Directory management tool displays the PowerShell commands executed behind each GUI action — making it valuable for learning automation?

AActive Directory Users and Computers (ADUC / dsa.msc)
BADSI Edit (adsiedit.msc)
CGroup Policy Management Console (gpmc.msc)
DActive Directory Administrative Center (ADAC / dsac.exe)

Question 5 of 5

Which of the following is the correct statement about Organizational Units (OUs) in Active Directory?

AOUs are a security boundary — a delegated admin in one OU cannot access objects in another OU by default
BOUs can contain objects from multiple domains in the same forest
COUs are the only AD container type to which Group Policy Objects can be directly linked (along with the domain and site)
DOUs automatically create a security boundary isolating objects from Domain Admins



🔒

This module is locked — Complete the previous module and pass its mock test to unlock this one.
Complete the quiz above (70%+) to unlock Module 2: Managing Users, Groups & Computer Accounts