howITwork

Active Directory explained for beginners

Active Directory (AD) is how almost every Windows office manages who can sign in, and to what. This guide explains what it is, how it is organised, and the everyday tasks a new IT admin does with it, with the PowerShell commands.

The problem Active Directory solves

Without a central system, each PC keeps its own user accounts. In an office of fifty computers, a new starter needs an account created on every machine they use, and when they leave someone has to remember every place they had access.

Active Directory gives each person one account, stored centrally. It works on any company PC, for shared folders and printers, with the same username and password. When they leave, you disable that one account and their access is gone everywhere.

What it actually is

  • A directory service from Microsoft: a database of every user, computer and group in the organisation, plus the rules about who can do what.
  • It runs on domain controllers: Windows servers with the Active Directory Domain Services role installed and promoted.
  • Run at least two. Domain controllers copy changes to each other (replication), so if one fails people can still sign in.

How it is organised

  • Forest: the outer container. Most small and medium companies have one forest.
  • Domain (for example howitwork.local): the security boundary. Its users and computers trust the same domain controllers.
  • Organisational units (OUs): folders you design, usually by office or department (Lahore, Karachi; Finance, HR).
  • Objects: the user accounts, computer accounts and groups inside the OUs.

The three things you will manage

  • Users: one account per person, with a username, password and details such as department and manager.
  • Computers: an account is created when a PC joins the domain; that is what lets you manage it centrally.
  • Groups: collections of users. Give permissions to groups, never to individual people, then access is simply a matter of group membership.

How sign-in works

At sign-in the PC asks a domain controller to check the password using Kerberos. If it is correct the user gets a ticket, and that ticket (not the password) is shown to file servers and other services.

Active Directory depends on DNS. Computers find domain controllers through DNS records, so most “cannot join the domain” errors are DNS problems. Point PCs’ DNS at your domain controllers, not at the internet router.

Group Policy

A Group Policy Object (GPO) is a set of settings you create once and link to an OU; every user or computer in that OU receives it. Typical uses: password rules, mapped drives, the company wallpaper, blocking USB storage. This is why OU design matters: shape OUs around how policies should apply.

Everyday tasks in PowerShell

These use the ActiveDirectory module (included with RSAT on Windows 10/11, and on domain controllers).

# Look up a user, including whether the account is locked
Get-ADUser -Identity ahmed.khan -Properties LockedOut, Department

# Create a user in the right OU (asks for the starting password)
New-ADUser -Name "Sara Ali" -SamAccountName sara.ali `
  -Path "OU=Lahore,DC=howitwork,DC=local" `
  -AccountPassword (Read-Host -AsSecureString) -Enabled $true

# Unlock a locked account (the most common help-desk call)
Unlock-ADAccount -Identity ahmed.khan

# Give access by adding the user to a group
Add-ADGroupMember -Identity "Finance" -Members sara.ali

Four beginner mistakes

  1. Using a Domain Admin account for daily work. Use a normal account day to day and a separate admin account only when needed.
  2. Running a single domain controller. If it fails, nobody can sign in.
  3. Giving permissions to individual users. Use groups, or within months nobody knows who can access what.
  4. No tested backup. Back up domain controllers including the system state, and test a restore at least once.

Active Directory and Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud identity service for Microsoft 365, Teams and cloud apps. Despite the old name it is a different product, without OUs and Group Policy in the same form. Many companies run both and synchronise them with Microsoft’s Entra Connect tools, so each person has one identity everywhere.

Practise for free

Install the free Windows Server evaluation in a virtual machine, add the AD DS role and promote it to a domain controller, then join a Windows 11 VM to the new domain. Try each command above against your lab.

More IT guides · howITwork on YouTube