Windows Server and Active Directory

Information Technology (B.E./B.Tech) · Networks and infrastructure · free study notes for exams, placements and interviews

In short

Windows Server is Microsoft's server operating system (current generally available release: Windows Server 2025, with 2019 and 2022 still widely deployed in India), and Active Directory Domain Services (AD DS) is its directory service — a hierarchical, replicated database of users, computers, groups and policies that provides centralised authentication (Kerberos), authorisation and configuration management. One sign-in to a domain gives a user access to file shares, printers, intranet apps and mail across the organisation, while administrators push settings to thousands of machines using Group Policy. This is the backbone of enterprise IT in Indian banks, PSUs, government departments, hospitals, manufacturing plants and every large IT services campus. It is examined in university papers on Network Operating Systems / System Administration and in AICTE-model network-administration labs, and it is the single most asked area in Indian system-administrator, desktop-support L2/L3 and cloud-infrastructure interviews (TCS, Infosys, Wipro, HCLTech, Cognizant, Capgemini, Accenture, LTIMindtree, Tech Mahindra).

Explained

Windows Server: editions, roles and installation options

Editions: *Standard* (most workloads, 2 Hyper-V VMs per licence), *Datacenter* (unlimited VMs, Storage Spaces Direct, software-defined networking), *Essentials*-class small-business SKU, and *Azure Edition* for Azure/Azure Stack HCI.
Licensing model: per physical core (minimum 16 cores per server, 8 per processor) plus Client Access Licences (CALs) per user or per device — a favourite interview question because it affects project cost.
Installation options: *Server with Desktop Experience* (full GUI), *Server Core* (no GUI, managed by PowerShell/RSAT/Windows Admin Center — smaller attack surface, fewer reboots), and *Nano Server* (container image only).
Roles vs features: a role is a primary function (AD DS, DNS, DHCP, IIS, File and Storage Services, Hyper-V, Remote Desktop Services, AD CS, AD FS, WSUS, Print Services); a feature supports roles (Failover Clustering, .NET Framework, BitLocker, Windows Backup).
Management tools: Server Manager, Windows Admin Center (browser-based), RSAT on a Windows client, PowerShell and PowerShell Remoting (WinRM), Hyper-V Manager, Event Viewer, Task Scheduler, Performance Monitor.
Other Windows Server services examined: DHCP (scopes, reservations, relay), DNS (AD-integrated zones), IIS, Failover Clustering, Storage Spaces, Distributed File System (DFS-N and DFS-R), Deduplication, Hyper-V virtualisation, Windows Defender/firewall and Windows Server Update Services.

Active Directory: logical structure

Object: any entity stored in AD — user, computer, group, printer, OU, contact. Each has attributes (sAMAccountName, UPN, mail, memberOf) and a globally unique GUID; security principals also get a SID.
Schema: forest-wide definition of which object classes and attributes may exist. Extending it (e.g. installing Exchange) is permanent and requires Schema Admins rights.
Domain: an administrative and replication boundary with its own name (abl.local, corp.bank.in) and a single account database; it is the boundary for account policies in the classic model.
Organisational Unit (OU): a container used to *delegate administration* and *link Group Policy*. OUs — not groups — are what GPOs attach to.
Tree: one or more domains in a contiguous namespace (abl.local, hr.abl.local) linked by automatic two-way transitive parent–child trusts.
Forest: one or more trees sharing a schema, configuration partition and global catalog; the forest is the true security boundary.
Distinguished Name (DN): full LDAP path, e.g. CN=Ravi Kumar,OU=Finance,DC=abl,DC=local. Relative DN = CN=Ravi Kumar. UPN = ravi.kumar@abl.local.
Partitions (naming contexts): *Domain* (objects of one domain, replicates within it), *Configuration* and *Schema* (replicate forest-wide), *Application* partitions (e.g. DNS zones), plus the Global Catalog — a partial, read-only, searchable replica of every object in the forest.

Physical structure, domain controllers and replication

Domain controller (DC): a server running AD DS holding a writable copy of the domain partition in ntds.dit (default C:\Windows\NTDS). All DCs are peers — multi-master replication — unlike the old NT PDC/BDC model.
SYSVOL: replicated share (\\domain\SYSVOL) holding GPO templates and logon scripts; replicated by DFS-R (FRS is deprecated and removed from modern releases).
Sites and subnets: a *site* is a well-connected group of IP subnets. Intra-site replication is frequent (change notification, ~15 s) and uncompressed; inter-site replication follows a *site link* schedule (default every 180 min) and is compressed. The KCC builds the replication topology; the ISTG handles inter-site bridgeheads.
RODC (Read-Only Domain Controller): writable copy absent, no password caching unless allowed by a Password Replication Policy — designed for branch offices and remote plants with weak physical security.
Replication model: attribute-level, using USNs, high-watermark/up-to-dateness vectors and version numbers; conflicts resolved by version number, then timestamp, then DC GUID. Tombstones/deleted objects handled via the Deleted Objects container and the AD Recycle Bin (needs forest functional level 2008 R2+).
FSMO roles (single-master operations):
- *Forest-wide:* Schema Master (schema changes), Domain Naming Master (add/remove domains).
- *Domain-wide:* RID Master (issues RID pools), PDC Emulator (time source, password-change chaining, account lockout, GPO editing target), Infrastructure Master (phantom/cross-domain reference cleanup).
- Moved gracefully by *transfer*, forcibly by *seize* (ntdsutil or Move-ADDirectoryServerOperationMasterRole).
Functional levels: domain and forest functional levels gate features; they can be raised but (except 2008 R2→ later rollback in some versions) generally not lowered.

How logon actually works: DNS, LDAP, Kerberos

The client finds a DC by querying DNS for SRV records under _ldap._tcp.dc._msdcs.<domain> — hence the rule *AD cannot exist without correctly configured DNS*.
Kerberos AS exchange: client sends a pre-authenticator timestamp encrypted with the password-derived key; the KDC (every DC) returns a TGT encrypted with the krbtgt key.
TGS exchange: to reach a file server, the client presents the TGT and asks for a service ticket for that SPN; the ticket is encrypted with the service account's key.
AP exchange: the client presents the service ticket to the server, which decrypts and reads the PAC (group SIDs) to build an access token.
Authorisation then happens locally: the token's SIDs are compared against the DACL on the resource (NTFS/share permissions).
Key ports: LDAP 389, LDAPS 636, Global Catalog 3268/3269, Kerberos 88, kpasswd 464, DNS 53, SMB 445, RPC endpoint mapper 135 plus a dynamic high range, WinRM 5985/5986.
Time matters: Kerberos allows a default 5-minute clock skew; a DC whose clock drifts breaks logons. The PDC Emulator of the forest root is the authoritative NTP source.
NTLM remains as a fallback (used with IP addresses, local accounts, workgroup access) but is challenge–response, lacks mutual authentication and is being phased out; auditing and then disabling NTLM is standard hardening.

Users, groups, permissions and delegation

Account types: domain user, local user, computer account, managed service account (MSA) and group managed service account (gMSA) with automatic password rotation, built-in Administrator/Guest/krbtgt.
Group scopes: *Domain Local* (grant permission on resources in its domain), *Global* (collect users of one domain), *Universal* (members from any domain in the forest; stored in the GC). Group types: Security (has a SID, used in ACLs) and Distribution (mail only).
AGDLP/IGDLA rule: put Accounts into Global groups, put those into Domain Local groups, assign Permissions to the domain local group — the answer examiners want for nesting strategy.
NTFS vs share permissions: NTFS permissions (Full Control, Modify, Read & Execute, List, Read, Write + advanced) are cumulative, with Deny overriding Allow, and are inherited unless broken; the effective permission over the network is the more restrictive of the share permission and the NTFS permission.
Delegation of control: right-click an OU → Delegate Control, to give a help-desk group only password-reset and unlock rights — least privilege without making anyone a Domain Admin.
Privileged groups: Enterprise Admins, Schema Admins, Domain Admins, Account/Server/Backup Operators; protected accounts should be in Protected Users and tiered administration used.

Group Policy

A GPO has two halves: Computer Configuration (applied at boot) and User Configuration (applied at logon), each with *Policies* and *Preferences*. Stored as a GPC object in AD plus a GPT folder in SYSVOL.
Processing order — LSDOU: Local policy → Site → Domain → OU (nested OUs last); later settings win on conflict.
Modifiers: *Block Inheritance* on an OU; *Enforced (No Override)* on a link, which beats Block Inheritance; *Security Filtering* and WMI filters to target subsets; *Loopback processing* to apply user settings based on the computer (terminal servers, kiosks).
Common settings: password and lockout policy, software deployment, drive and printer mapping, firewall rules, folder redirection, BitLocker, AppLocker, USB restriction, Edge/Chrome configuration, logon scripts, Windows Update.
Fine-Grained Password Policies (PSOs) allow more than one password policy inside one domain (applied to users/global groups via msDS-PSO links) — the exception to "one password policy per domain".
Tools: gpupdate /force, gpresult /r or /h report.html, Group Policy Modelling/Results in GPMC, Central Store for ADMX files.

Trusts, migration and the cloud relationship

Trust characteristics: one-way or two-way; transitive or non-transitive; direction of trust is opposite to the direction of access.
Types: *Parent–child* and *tree-root* (automatic, two-way, transitive), *Shortcut* (speeds up intra-forest authentication), *External* (to one NT/AD domain, non-transitive), *Forest trust* (between forest roots, transitive within forests — common after a merger), *Realm trust* (to MIT Kerberos/UNIX).
Promotion/demotion: Install-WindowsFeature AD-Domain-Services then Install-ADDSForest / Install-ADDSDomainController; demote with Uninstall-ADDSDomainController. Metadata cleanup is required if a DC dies and cannot be demoted.
Backup and recovery: system state backup, authoritative vs non-authoritative restore of SYSVOL, Directory Services Repair Mode (DSRM) password, AD Recycle Bin for object recovery, ntdsutil snapshots and IFM (Install From Media) for remote DC builds.
Hybrid identity: Microsoft Entra ID (formerly Azure AD) is a *separate* cloud identity service — flat, multi-tenant, uses SAML/OAuth/OIDC and Graph, not LDAP/Kerberos/GPO. On-premises AD is synchronised to it by Entra Connect (password hash sync, pass-through authentication or federation with AD FS), giving single sign-on to Microsoft 365. Cloud-managed device policy uses Intune/MDM rather than GPO. Most Indian enterprises today run exactly this hybrid model.
Security and compliance: Kerberoasting, Pass-the-Hash, Golden/Silver Ticket and DCSync are the attacks to know; defences are tiering, LAPS, strong service-account passwords, gMSA, disabling NTLM/SMBv1, LDAP signing and channel binding, and monitoring Event IDs 4624/4625/4740/4768/4769/4776. Indian obligations that shape AD logging and retention: the Digital Personal Data Protection Act, 2023 (and rules notified thereafter) for personal-data safeguards, the Information Technology Act, 2000 with the SPDI Rules, 2011 for reasonable security practices, the CERT-In Directions of 28 April 2022 requiring synchronised NTP to NIC/NPL time servers and retention of ICT logs for 180 days, and RBI/SEBI IT-governance directions for regulated entities.

Key points

Windows Server 2025 - current GA release; licensed per core (16-core minimum) plus user or device CALs.
Server Core - GUI-less installation, smaller attack surface, managed via PowerShell/Windows Admin Center.
AD DS - replicated directory providing authentication, authorisation and central configuration.
Forest - the real security boundary; the domain is the replication and account-policy boundary.
OU - unit of delegation and GPO linking; groups cannot have GPOs linked to them.
Global Catalog - partial read-only replica of all forest objects; ports 3268/3269; needed for UPN logon and universal group membership.
FSMO - five roles: Schema, Domain Naming (forest); RID, PDC Emulator, Infrastructure (per domain).
Multi-master replication - every writable DC accepts changes; conflicts settled by version, then timestamp, then DC GUID.
SYSVOL - share holding GPOs and scripts, replicated by DFS-R.
DNS SRV records - how clients locate DCs; AD breaks without correct DNS.
Kerberos - default protocol: TGT from the KDC, then per-service tickets; 5-minute default clock-skew tolerance.
LDAP 389 / LDAPS 636 - directory query protocol and its TLS form.
AGDLP - Accounts → Global → Domain Local → Permissions, the standard nesting strategy.
Effective access - share and NTFS combine as the *most restrictive*; within NTFS, permissions accumulate and Deny wins.
LSDOU - GPO order Local, Site, Domain, OU; Enforced beats Block Inheritance.
Fine-grained password policy (PSO) - multiple password policies within a single domain.
RODC - read-only DC for insecure branch sites, with a Password Replication Policy.
Entra ID - cloud directory using SAML/OAuth, synchronised by Entra Connect; not a replacement for AD DS features like GPO.

Formulas and examples

Effective network permission = MIN(Share permission, NTFS effective permission)
NTFS effective permission = (union of all Allow permissions from user + all groups) − (any applicable Deny)
Number of automatic intra-forest trusts = (number of domains in forest) − 1
Connections in a full mesh of n DCs = n(n − 1)/2 — the reason KCC builds a ring with shortcut links instead
Maximum intra-site replication latency (3-hop ring rule) ≈ hops × notification delay, hops ≤ ⌊n/2⌋ for a ring of n DCs
RID pool: each DC gets 500 RIDs by default from the RID Master; DCs requested = ⌈accounts needed ÷ 500⌉ (approx.)
Site-link replication interval: default 180 minutes, configurable 15–10,080 minutes; cost default 100 (lower cost = preferred path)

Example 1 — Effective permissions. Ravi is in groups Finance and Interns. On share \\FS01\Accounts: share permission for Finance-Users = Change (≈ Modify). NTFS: Finance = Modify, Interns = Read, Interns = Deny Write.

NTFS cumulative Allow = Modify ∪ Read = Modify.
Apply Deny Write → effective NTFS = Read & Execute (no write/modify).
Combine with share (Change) → MIN = Read & Execute. Ravi can open files but not save changes. Remove him from Interns (or remove the Deny) to restore Modify.

Example 2 — GPO precedence. Settings for the "Screen saver timeout": Local = 30 min; Site GPO = 20 min; Domain GPO = 15 min; OU Sales GPO = 10 min; child OU Sales\Field GPO = 5 min. Block Inheritance is set on Sales, and the Domain GPO link is Enforced.

Normally LSDOU would make the last writer (Sales\Field = 5 min) win.
Block Inheritance on Sales would discard Local/Site/Domain — *but* Enforced on the Domain link overrides Block Inheritance, and Enforced links are applied last of all.
Final value = 15 minutes (the Enforced Domain GPO). Verify with gpresult /r.

Example 3 — Trusts after an acquisition. abl.local forest has domains abl.local, hr.abl.local, plant.abl.local. It acquires forest nova.in with 2 domains.

Automatic intra-forest trusts in abl.local = 3 − 1 = 2; in nova.in = 2 − 1 = 1.
One two-way forest trust between the two forest roots gives all 5 domains mutual access = 4 trusts total.
Without a forest trust you would need external, non-transitive trusts for every cross-forest pair: 3 × 2 = 6 two-way external trusts (12 one-way trust relationships) — the exam point for why forest trusts exist.

Example 4 — Replication and RID planning. A campus has 6 DCs in one site and a branch with 1 RODC; the site link is default (180 min, cost 100). HR will create 2,300 new student accounts.

Intra-site: KCC builds a ring; with 6 DCs no DC is more than ⌈6/2⌉ = 3 hops away, so a password change propagates in roughly 3 × 15 s ≈ 45 s (plus processing).
Branch RODC: inbound-only, worst case 180 min after the next scheduled cycle — so reduce the site-link interval to 15 min if branch logons depend on fresh group membership.
RID pools: 2,300 ÷ 500 = 4.6 → the creating DC must request 5 pools from the RID Master; if the RID Master is offline and the current pool runs out, account creation fails — a classic troubleshooting scenario.

Example 5 — Licensing cost (illustrative). Two physical hosts, each 2 processors × 10 cores = 20 cores, running 6 VMs each, 400 staff needing user CALs.

Core licences = 20 cores per host (above the 16-core minimum) → 40 core licences for the two hosts.
Standard allows 2 VMs per fully licensed host; 6 VMs needs the core licences stacked three times → 60 core licences per host (120 total), so Datacenter is usually cheaper at ≥ ~12 VMs per host.
Plus 400 user CALs (one CAL per user covers all servers). Actual rupee figures depend on the current Microsoft price list and your reseller/OEM/CSP agreement, so they should be quoted, not assumed.

Aspect	Workgroup	Domain (AD DS)
Account database	Local SAM on each PC	Central `ntds.dit` on DCs
Scale	~10–20 machines	Thousands
Management	Per machine	Group Policy, central
Authentication	NTLM, local	Kerberos, domain-wide SSO
Use in India	Small shop, lab bench	Bank branch, plant, campus

Feature	AD DS (on-premises)	Microsoft Entra ID (cloud)
Structure	Forest / domain / OU hierarchy	Flat tenant with groups and admin units
Protocols	LDAP, Kerberos, NTLM	SAML, OAuth 2.0, OIDC, SCIM, Graph
Device policy	Group Policy	Intune / MDM, Conditional Access
Objects	Users, computers, GPOs, printers	Users, groups, app registrations, devices
Joined devices	Domain join	Entra join / hybrid join / registered

FSMO role	Scope	What breaks if it is down
Schema Master	Forest	Schema extensions (e.g. Exchange setup)
Domain Naming Master	Forest	Adding/removing domains or app partitions
RID Master	Domain	New account creation once pools exhaust
PDC Emulator	Domain	Time sync, lockout and password-change chaining, GPO editing
Infrastructure Master	Domain	Cross-domain reference cleanup (stale SIDs shown)

# Promote the first DC of a new forest
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName "abl.local" -DomainNetbiosName "ABL" `
  -InstallDns -DomainMode WinThreshold -ForestMode WinThreshold

# Create an OU, a user and a group; apply AGDLP
New-ADOrganizationalUnit -Name "Finance" -Path "DC=abl,DC=local"
New-ADUser -Name "Ravi Kumar" -SamAccountName ravi.kumar `
  -UserPrincipalName ravi.kumar@abl.local -Path "OU=Finance,DC=abl,DC=local" `
  -AccountPassword (Read-Host -AsSecureString "Password") -Enabled $true
New-ADGroup -Name "G-Finance-Staff"  -GroupScope Global      -Path "OU=Finance,DC=abl,DC=local"
New-ADGroup -Name "DL-Accounts-Modify" -GroupScope DomainLocal -Path "OU=Finance,DC=abl,DC=local"
Add-ADGroupMember -Identity "G-Finance-Staff"   -Members ravi.kumar
Add-ADGroupMember -Identity "DL-Accounts-Modify" -Members "G-Finance-Staff"

# Diagnose
dcdiag /v                      # DC health
repadmin /replsummary          # replication status
repadmin /showrepl
netdom query fsmo              # who holds which FSMO role
nltest /dsgetdc:abl.local      # which DC am I using
w32tm /query /status           # time source and skew
gpresult /r                    # applied GPOs for this user/computer
Get-ADUser ravi.kumar -Properties MemberOf, LastLogonDate, LockedOut

Where it is used

Banking and financial services: ICICI, HDFC, SBI and NBFC branch networks run domain-joined desktops with RODCs or site-aware DCs, enforced lockout and USB-block GPOs, audited under RBI cyber-security framework expectations.
IT services and GCCs: TCS, Infosys, Wipro, HCLTech, Cognizant and captive centres staff large Windows/AD towers; "Wintel administrator", "AD/Exchange L2", "IAM engineer" and "Modern Workplace/Intune consultant" are standard job titles.
Government and PSUs: NIC-hosted departmental domains, state data centres, defence and railway offices using AD with DSC-based smart cards, CERT-In-mandated NTP sync and 180-day log retention.
Manufacturing and plants: separate OT/plant domains or forests (Tata Steel, Maruti, L&T) with forest trusts to the corporate forest, and RODCs at remote units with poor links.
Education and healthcare: university and hospital campuses using OUs per department, folder redirection, roaming/FSLogix profiles, WSUS patching and shared-lab lockdown GPOs.
Certifications and exams: Microsoft AZ-800/AZ-801 (hybrid Windows Server administration), SC-300 identity, CompTIA Server+, plus university System and Network Administration labs.

Interview questions

Q: What is the difference between a domain, a tree and a forest? A: A domain is one account and replication boundary; a tree is one or more domains in a contiguous DNS namespace joined by automatic two-way transitive trusts; a forest is one or more trees sharing a schema, configuration and global catalog, and it is the security boundary.
Q: Why can Active Directory not work without DNS? A: Clients locate domain controllers and services through DNS SRV records under _msdcs; without them logon, replication and GPO retrieval all fail.
Q: Name the five FSMO roles and say which are forest-wide. A: Schema Master and Domain Naming Master are forest-wide; RID Master, PDC Emulator and Infrastructure Master exist once per domain.
Q: When would you seize an FSMO role instead of transferring it? A: Only when the holder is permanently unavailable and cannot be brought back, because the old holder must never be reconnected to the network afterwards.
Q: What is the Global Catalog used for? A: It is a partial, searchable replica of every object in the forest, used for forest-wide searches, UPN logons and resolving universal group membership; it listens on 3268/3269.
Q: Explain the GPO processing order and what Enforced does. A: Local, then Site, then Domain, then OU (nested OUs last), with later settings overwriting earlier ones; an Enforced link cannot be overridden and defeats Block Inheritance.
Q: A user has Modify through one group and Deny Write through another. What is the result? A: The explicit Deny wins, so the user can read but not write — NTFS permissions accumulate but any applicable Deny takes precedence.
Q: How do share permissions and NTFS permissions combine? A: Over the network the effective permission is the more restrictive of the two; locally only NTFS applies.
Q: Why is a time difference a logon problem? A: Kerberos tickets carry timestamps and the default tolerance is 5 minutes; beyond that the KDC rejects the request, so the forest root PDC Emulator must be the authoritative time source.
Q: What is an RODC and where would you place one? A: A read-only domain controller that holds no writable copy and caches no passwords unless permitted; it suits branch offices or plants where physical security and the WAN link are weak.
Q: Can a single domain have two different password policies? A: Yes — through Fine-Grained Password Policies (PSOs) linked to users or global groups; otherwise the Default Domain Policy applies to all.
Q: How is Microsoft Entra ID different from AD DS? A: Entra ID is a flat, cloud, multi-tenant directory using SAML/OAuth/OIDC and Graph with Intune for device policy, whereas AD DS is hierarchical and uses LDAP, Kerberos and Group Policy; Entra Connect synchronises the two in a hybrid setup.
Q: You get "The trust relationship between this workstation and the primary domain failed." What is wrong? A: The computer account password is out of sync with AD (often after a snapshot restore or long offline period); fix it with Reset-ComputerMachinePassword or Test-ComputerSecureChannel -Repair, not by blindly rejoining.

Common mistakes

Saying the domain is the security boundary — the forest is; and treating OUs as security boundaries when they are only delegation and GPO containers.
Linking a GPO to a security group or to a container like the default Users/Computers (GPOs link only to sites, domains and OUs; use security filtering for groups).
Adding share and NTFS permissions together instead of taking the more restrictive, or forgetting that Deny beats cumulative Allow.
Confusing group scope with group type, and ignoring AGDLP by assigning permissions directly to individual users.
Pointing a domain member's DNS at a public resolver (8.8.8.8) instead of the internal DC — the commonest cause of "cannot find domain" in labs.
Assuming Entra ID gives Group Policy, or that domain-joining is the same as Entra-joining.
Forgetting metadata cleanup after a DC is lost, or ignoring clock skew, firewall ports (135/445/389/88) and functional-level prerequisites during troubleshooting.