Microsoft Active Directory (AD DS)

Centralized directory service (LDAP-based hierarchical object store) for users, computers, groups, and resources

AD DS stores objects representing users, computers, groups, printers, and other resources in a single directory that domain members query for identity and resource information. The directory is organized as a hierarchy of containers and is accessed over LDAP, with each object holding a defined set of attributes and a unique distinguished name reflecting its position in the tree. Domain controllers host this database and answer directory queries, so applications and operating systems have one authoritative place to look up accounts, group membership, and resource records.

Kerberos v5 authentication protocol with ticket-granting infrastructure

AD DS implements Kerberos version 5 as the default authentication protocol for domain accounts. Each domain controller runs a Key Distribution Center that authenticates the user's initial logon and issues a ticket-granting ticket, which the client then presents to obtain service tickets for individual servers and services. Those service tickets prove the user's identity to the target service without the password being sent to it, and tickets carry a limited lifetime after which they must be renewed or reissued.

NTLM authentication support for legacy compatibility

AD DS continues to accept NTLM challenge-response authentication for scenarios where Kerberos cannot be used, such as connections made by IP address rather than name, workgroup clients, and older applications. The domain controller validates the client's response against the stored password hash and returns a pass or fail result to the server that requested it. Administrators can restrict or audit NTLM usage through policy where they want to move authentication onto Kerberos.

LDAP v3 directory access and secure LDAP (LDAPS) over SSL/TLS

Domain controllers expose the directory through LDAP version 3, so clients and applications can bind, search, read attributes, and modify objects using a standard protocol. The same directory is available over LDAPS, where the LDAP session is wrapped in SSL/TLS on a dedicated port so credentials and query contents are encrypted in transit. Serving LDAPS requires the domain controller to hold a suitable certificate, and connections can also be protected through signing and sealing on the standard LDAP port.

Single sign-on (SSO) to domain-joined resources

Once a user authenticates to the domain, the Kerberos tickets issued at logon are reused to access domain-joined servers, file shares, and Kerberos-aware applications without the user entering credentials again. The client requests a service ticket for each target transparently in the background, and the target service validates it locally. This gives one interactive logon that carries across the resources within the domain and across trusted domains.