Active Directory

LDAP-based centralized directory service: Active Directory stores and organizes information about every object in the environment (users, computers, groups, printers, shared folders, contacts) in a hierarchical database accessible over the Lightweight Directory Access Protocol (LDAP) on ports 389/636. Applications and services query the directory using LDAP search filters to locate objects and read their attributes, giving the enterprise a single authoritative source of truth for identity and resource data.

Domain Controller services: Each domain controller hosts a writable replica of the directory database (NTDS.dit) and answers authentication and lookup requests. Domain controllers handle account logon, enforce policy, replicate changes to peer controllers, and provide redundancy so that the loss of any single controller does not take down authentication for the domain.

User account management and authentication: AD creates, stores, and validates user security principals, each with a unique Security Identifier (SID), User Principal Name (UPN), and SAM account name. It authenticates credentials at logon, controls whether accounts are enabled/disabled/expired, and issues the security tokens that determine what a user can access across the domain.

Computer account management: Every domain-joined machine receives its own computer account and secure channel password, allowing the machine itself to authenticate to the domain independently of any user. This underpins Group Policy application to machines, machine certificate enrollment, and trusted machine-to-domain communication.

Group management (security and distribution groups): AD supports security groups (used to assign permissions and rights to collections of principals) and distribution groups (used for email distribution lists), each available in domain-local, global, and universal scopes. Group nesting lets administrators model complex access structures while managing membership in one place.