DAY 1: Active Directory + Okta (Part 1: Active Directory fundamentals)
1. What is Active Directory?
Active Directory Domain Services (AD DS) is Microsoft’s directory service for managing users, computers, groups, authentication, and access to resources in a Windows domain. It stores information about these objects and provides ways to authenticate users and control access.
Imagine a company has 5,000 employees. Each employee needs a Windows login, and employees need different access to shared folders, applications, printers, and servers.
Without centralized directory management, administrators would have to manage accounts and permissions separately across many systems.
Active Directory centralizes much of this management.
OVERVIEW:
“Active Directory is Microsoft’s directory service used to centrally manage users, computers, groups, and resources in a Windows domain. It supports authentication, access control, and policy-based administration. In an Okta-integrated environment, AD can also serve as a source of identity information and credentials.”
Remember: AD manages directory identities and Windows domain resources; Okta extends identity management and access to cloud applications.
2. Understand these 12 core terms
1. Domain: A logical administrative boundary containing users, computers, groups, and other directory objects.
Example: corp.example.com
2. Domain Controller (DC): A server running AD DS. It stores directory data and handles authentication requests and directory operations.
Example: DC01 authenticates an employee's domain login.
3. Organizational Unit (OU): A container for organizing objects and applying delegated administration or Group Policy.
Example: OU=Employees,DC=corp,DC=example,DC=com
4. User object: A directory object representing an individual account, with attributes such as name, username, email and account status.
5. Group: A collection of accounts used to manage access and permissions collectively.
Example: Finance-Share-Access
6. Group Policy (GPO): A mechanism for applying settings to users and computers, such as password-related settings, security configurations and desktop restrictions.
7. Forest: The top-level AD structure containing one or more domains that share a common schema and configuration.
8. Tree: One or more related domains organized in a contiguous DNS namespace.
9. DNS: Helps computers locate domain controllers and other services.
10.LDAP: A protocol used to query and modify directory information.
11.Kerberos: A ticket-based authentication protocol commonly used in AD environments.
12.Replication: The process that distributes directory changes between domain controllers.
Get Sarika Reddy’s stories in your inbox
Join Medium for free to get updates from this writer.
Microsoft documents these as core parts of AD DS, including its directory structure, replication, DNS integration, and authentication capabilities.
Quick memory trick
- Domain = administrative boundary
- DC = server that runs AD DS
- OU = organizes objects
- Group = groups users for access management
- GPO = applies configuration
- DNS = locates services
- LDAP = reads and modifies directory data
- Kerberos = authenticates using tickets
- Replication = synchronizes directory changes
3. How does a Windows domain login work?
Suppose an employee starts their laptop and enters:
- Username:
sarika - Password: their domain password
The simplified process is:
Important distinction: successful authentication does not automatically grant access to every resource. Authorization and resource permissions still apply.
What can go wrong?
If the user cannot sign in, possible causes include:
- Incorrect password
- Locked or disabled account
- Network or VPN connectivity problem
- DNS failure
- Domain controller unavailable
- Kerberos/time synchronization problem
- Computer trust relationship issue
A good support engineer determines which layer is failing instead of immediately resetting the password.
What’s next :- Part 2: Active Directory administration
