Complete guide to design, deploy, and manage Microsoft Active Directory — from concept to production-ready architecture.
Microsoft's directory service that stores information about objects on a network and makes this information available to users and administrators.
Centralized identity management for users, computers, and services across the enterprise network.
Hierarchical database of network resources following LDAP (Lightweight Directory Access Protocol) standards.
Group Policy Objects (GPOs) enable centralized configuration of computers and user settings.
Kerberos and NTLM protocols provide secure Single Sign-On (SSO) authentication.
Active Directory introduced as part of Windows 2000 Server, replacing Windows NT domain model.
Forest and domain functional levels introduced. Cross-forest trusts and improved replication.
Read-Only Domain Controllers (RODC), fine-grained password policies, AD Recycle Bin preview.
Dynamic Access Control, AD Recycle Bin GUI, Kerberos armoring, Virtualization-safe replication.
Privileged Access Management (PAM), Azure AD integration, just-in-time administration.
Enhanced hybrid cloud support, Security improvements, Azure Arc integration capabilities.
Secured-core server, TLS 1.3, SMB AES-256 encryption, advanced threat protection built-in.
Azure Active Directory rebranded to Microsoft Entra ID — cloud-native identity platform at scale.
Microsoft Active Directory comes in multiple service types, each designed for specific use cases and deployment scenarios.
The core Active Directory service. Stores directory information and manages communication between users and domains, including user logon processes, authentication, and directory searches.
Cloud-based identity and access management service. Not a direct replacement for AD DS but complements it for cloud and hybrid scenarios. Supports OAuth 2.0, OIDC, SAML 2.0.
Creates a Public Key Infrastructure (PKI) for issuing and managing digital certificates. Enables secure communications, code signing, smart card logon, and data encryption.
Provides federated identity and Single Sign-On for web-based applications across organizational boundaries. Enables claims-based authentication using SAML 2.0, WS-Federation, OAuth 2.0.
Provides LDAP directory services for directory-enabled applications without requiring a full AD DS deployment. Runs as a non-OS service, allowing multiple instances per server.
Information protection technology that works with RMS-enabled applications to help safeguard digital information from unauthorized use. Controls access to documents, email, and web content.
Choosing the right Windows Server edition is critical for cost optimization and feature requirements.
| Feature | Essentials 2022 | Standard 2022 | Datacenter 2022 |
|---|---|---|---|
| Max Processors | 1 | Unlimited | Unlimited |
| Max RAM | 128 GB | 24 TB | 24 TB |
| User Limit | 25 users | Unlimited | Unlimited |
| Domain Controller | ✅ | ✅ | ✅ |
| CALs Required | ❌ No | ✅ Yes | ✅ Yes |
| VMs per License | 1 VM | 2 VMs | Unlimited |
| Hyper-V | ❌ | ✅ | ✅ |
| Storage Spaces Direct | ❌ | ❌ | ✅ |
| Shielded VMs | ❌ | ✅ | ✅ |
| Storage Replica | ❌ | Limited | ✅ |
| Network Controller | ❌ | ❌ | ✅ |
| Approx. License Price | ~$501 | ~$1,069 | ~$6,155 |
Small businesses with up to 25 users. Simple file/print sharing, basic domain services. No VM stacking.
Medium to large environments. Supports 2 VMs per license. Ideal for non-heavily virtualized DCs.
Highly virtualized datacenters. Unlimited VMs. Required for SDN, Storage Spaces Direct, Shielded VMs.
Step-by-step guide to deploying Active Directory in your organization.
Document existing users, computers, groups, applications, and network topology.
Determine number of forests, domains, domain names (use .local vs routable DNS suffix).
Design OU structure based on administrative delegation, not org chart. Reflect GPO application needs.
Map physical locations to AD Sites. Plan site links and replication schedule.
Minimum: 2 vCPU, 4 GB RAM, 60 GB disk per DC. Recommended: 4 vCPU, 8 GB RAM, 100 GB.
Static IP for all DCs. Configure DNS to point to itself (first DC) or other DCs. Ensure ports open: TCP/UDP 88, 389, 636, 3268, 3269, 445, 49152-65535.
Install Windows Server, apply all updates. Rename server before promotion. Join to workgroup (not another domain yet).
# Step 1: Install AD DS role
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
# Step 2: Import ADDSDeployment module
Import-Module ADDSDeployment
# Step 3: Promote to Domain Controller (New Forest)
Install-ADDSForest `
-DomainName "contoso.com" `
-DomainNetbiosName "CONTOSO" `
-DomainMode "WinThreshold" `
-ForestMode "WinThreshold" `
-DatabasePath "C:\Windows\NTDS" `
-LogPath "C:\Windows\NTDS" `
-SysvolPath "C:\Windows\SYSVOL" `
-InstallDns:$true `
-SafeModeAdministratorPassword (ConvertTo-SecureString `
"P@ssw0rd123!" -AsPlainText -Force) `
-Force:$true
# Server will automatically restart after promotion# Install AD DS role on second server
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
# Promote as additional DC in existing domain
Install-ADDSDomainController `
-DomainName "contoso.com" `
-InstallDns:$true `
-Credential (Get-Credential "CONTOSO\Administrator") `
-SafeModeAdministratorPassword (ConvertTo-SecureString `
"P@ssw0rd123!" -AsPlainText -Force) `
-Force:$trueBuild OU hierarchy. Delegate control to appropriate admin teams. Move default computer/user objects.
Create baseline GPOs: Password Policy, Account Lockout, Security Baseline, Software Deployment.
Bulk create users from HR data. Implement RBAC with security groups. Apply least privilege.
Run netdom query fsmo to confirm role placement. Plan FSMO distribution across DCs.
# Create OU structure
New-ADOrganizationalUnit -Name "Corp" -Path "DC=contoso,DC=com"
New-ADOrganizationalUnit -Name "Users" -Path "OU=Corp,DC=contoso,DC=com"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=Corp,DC=contoso,DC=com"
New-ADOrganizationalUnit -Name "Groups" -Path "OU=Corp,DC=contoso,DC=com"
New-ADOrganizationalUnit -Name "Servers" -Path "OU=Corp,DC=contoso,DC=com"
# Create user accounts in bulk from CSV
Import-Csv "C:\users.csv" | ForEach-Object {
New-ADUser `
-Name "$($_.FirstName) $($_.LastName)" `
-GivenName $_.FirstName `
-Surname $_.LastName `
-SamAccountName $_.Username `
-UserPrincipalName "$($_.Username)@contoso.com" `
-Path "OU=Users,OU=Corp,DC=contoso,DC=com" `
-AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) `
-Enabled $true `
-ChangePasswordAtLogon $true
}
# Verify FSMO roles
netdom query fsmo
# Check AD replication
repadmin /replsummary
repadmin /showreplSync on-premises identities to Microsoft Entra ID. Choose sync method: Password Hash Sync, Pass-Through Auth, or Federation.
Set up Entra ID Conditional Access policies. Require MFA for cloud applications. Enable risk-based policies.
Reference architectures for small, medium, and enterprise-scale Active Directory deployments.
Controls all changes to the AD schema. Only one per forest. Keep on a secure, well-maintained DC.
Controls addition/removal of domains in the forest. Must be a Global Catalog server.
Allocates pools of relative identifiers (RIDs) to DCs, ensuring unique SIDs for all objects.
Password changes, account lockouts, time synchronization, legacy client support. Most sensitive role.
Updates cross-domain group-to-user references. Should NOT be on a GC server (unless all DCs are GCs).
Estimate your Active Directory implementation costs based on your organization's requirements.
⚠️ Estimates are based on MSRP pricing. Actual costs vary by region, volume licensing agreements, and negotiated discounts. Software Assurance may add 25-29% annually but includes upgrade rights.
One-time purchase. Requires CALs. SA optional for upgrades. Best for stable, long-term deployments.
Enterprise Agreement. Covers all servers + CALs. Includes Software Assurance. 3-year commitment.
Service Provider License Agreement. Per-user monthly billing. Best for MSPs and cloud deployments.
Security hardening, operational excellence, and maintenance guidelines for Active Directory.
Frequently asked questions about Active Directory implementation and management.
At minimum, deploy 2 DCs per domain for redundancy. A general guideline is 1 DC per 1,000-2,000 users, plus at least 1 DC per site/location. For branch offices with fewer than 50 users and limited physical security, consider a Read-Only Domain Controller (RODC) to reduce risk.
Use a routable DNS suffix (e.g., corp.contoso.com or contoso.local is no longer recommended). Microsoft recommends using a subdomain of your public domain (e.g., corp.contoso.com) or a completely separate routable domain. The .local suffix causes issues with mDNS/Bonjour, macOS clients, and hybrid Azure AD scenarios.
AD DS is the traditional on-premises directory service using Kerberos/NTLM, LDAP, Group Policy, and OUs. Microsoft Entra ID is a cloud-based identity platform using OAuth 2.0, OIDC, SAML 2.0 — built for internet-scale and SaaS applications. They are complementary, not interchangeable. Most enterprises use hybrid identity: AD DS on-premises synced to Entra ID via Azure AD Connect.
Use the "introduce new, transfer roles, decommission old" method: (1) Add new WS2022 DCs to the existing domain, (2) Let replication sync fully, (3) Transfer FSMO roles to new DCs using Move-ADDirectoryServerOperationMasterRole, (4) Raise Domain/Forest Functional Level after removing all old DCs, (5) Decommission old DCs using dcpromo /forceremoval and clean up metadata.
Yes — this is the standard approach today. Key considerations: (1) Use VM Generation ID aware hypervisors (Hyper-V, VMware 5.5+), (2) Never snapshot/restore DCs — it causes USN rollback, (3) Don't co-locate all DC VMs on a single physical host (anti-affinity rules), (4) Ensure DCs have sufficient dedicated resources and are not overprovisioned. The AD Recycle Bin is a better option than VM snapshots.
| Port | Protocol | Service |
|---|---|---|
| 53 | TCP/UDP | DNS |
| 88 | TCP/UDP | Kerberos |
| 135 | TCP | RPC Endpoint Mapper |
| 137-138 | UDP | NetBIOS (legacy) |
| 389 | TCP/UDP | LDAP |
| 445 | TCP | SMB (SYSVOL, NETLOGON) |
| 636 | TCP | LDAPS (LDAP over SSL) |
| 3268 | TCP | Global Catalog |
| 3269 | TCP | Global Catalog SSL |
| 49152-65535 | TCP | RPC Dynamic Ports |
AGDLP = Accounts → Global groups → Domain Local groups → Permissions. Place user accounts in Global security groups (organized by role/department). Nest Global groups into Domain Local groups. Assign resource permissions to Domain Local groups. This allows cross-domain membership while keeping permission management simple and scalable.
Official AD DS documentation, deployment guides, and troubleshooting resources from Microsoft.
Microsoft Security Compliance Toolkit — download recommended GPO baselines for Windows Server.
Microsoft's Active Directory Health Assessment helps identify security and operational health issues.
RSAT: Active Directory Domain Services and Lightweight Directory Services Tools — essential for management.