Active Directory Essentials: Managing Windows Infrastructure

Why Active Directory Still Matters

Despite the rise of cloud identity services, Active Directory remains the backbone of most enterprise Windows environments. Understanding AD is essential whether you're managing traditional on-premises networks or hybrid cloud deployments with Azure AD.

This guide covers essential AD concepts and practical administration tasks.

Active Directory Components

Domain Controller (DC)

The heart of AD—stores the directory database and handles authentication:

• Authenticates users and computers
• Replicates data to other DCs
• Best practice: Minimum 2 DCs for redundancy

Organizational Units (OUs)

Containers for organizing objects:

• Users, computers, groups
• Delegate administration
• Apply Group Policies

Groups

• Security Groups: Assign permissions
• Distribution Groups: Email lists only
• Scope: Domain Local, Global, Universal

User Management with PowerShell

Creating Users

# Single user
New-ADUser -Name "John Smith" `
    -GivenName "John" `
    -Surname "Smith" `
    -SamAccountName "jsmith" `
    -UserPrincipalName "jsmith@domain.com" `
    -Path "OU=Users,OU=IT,DC=domain,DC=com" `
    -AccountPassword (ConvertTo-SecureString "TempP@ss123" -AsPlainText -Force) `
    -Enabled $true `
    -ChangePasswordAtLogon $true

Bulk User Creation from CSV

# users.csv: FirstName,LastName,Username,Department
Import-Csv users.csv | ForEach-Object {
    New-ADUser -Name "$($_.FirstName) $($_.LastName)" `
        -GivenName $_.FirstName `
        -Surname $_.LastName `
        -SamAccountName $_.Username `
        -UserPrincipalName "$($_.Username)@domain.com" `
        -Department $_.Department `
        -Path "OU=Users,DC=domain,DC=com" `
        -AccountPassword (ConvertTo-SecureString "Welcome123!" -AsPlainText -Force) `
        -Enabled $true
}

Common User Queries

# Find disabled users
Get-ADUser -Filter {Enabled -eq $false}

# Find users not logged in for 90 days
$90Days = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -lt $90Days} -Properties LastLogonDate

# Find users with password never expires
Get-ADUser -Filter {PasswordNeverExpires -eq $true}

Group Policy Management

Common GPO Settings

• Password Policy: Minimum length, complexity, age
• Account Lockout: Threshold, duration, reset counter
• Software Installation: Deploy applications
• Drive Mappings: Network drive connections
• Security Settings: Firewall, audit policies

GPO PowerShell Commands

# List all GPOs
Get-GPO -All

# Get GPO report
Get-GPOReport -Name "Security Policy" -ReportType HTML -Path "C:\Reports\security.html"

# Backup all GPOs
Backup-GPO -All -Path "C:\GPO-Backups"

# Force Group Policy update on remote computer
Invoke-GPUpdate -Computer "WORKSTATION01" -Force

DNS Integration

AD relies heavily on DNS for service location:

Essential DNS Records

# View AD-related DNS records
Get-DnsServerResourceRecord -ZoneName "domain.com" -RRType SRV

# Key records:
_ldap._tcp.dc._msdcs.domain.com  # Domain Controllers
_kerberos._tcp.dc._msdcs.domain.com  # Kerberos authentication
_gc._tcp.domain.com  # Global Catalog servers

DNS Best Practices

• DNS servers should be domain controllers
• Configure DNS forwarders for external resolution
• Enable scavenging for stale records
• Monitor DNS replication

Hybrid Identity with Azure AD

Azure AD Connect

Synchronizes on-premises AD to Azure AD:

• Password Hash Sync: Simplest, most reliable
• Pass-through Authentication: On-prem validation
• Federation (ADFS): Complex, full control

Hybrid Scenarios

• Single Sign-On to cloud applications
• Office 365 integration
• Azure resource access
• Conditional Access policies

AD Health Monitoring

Replication Health

# Check replication status
repadmin /replsummary

# Detailed replication info
repadmin /showrepl

# Force replication
repadmin /syncall /AdeP

DCDiag for Domain Controller Health

# Comprehensive DC test
dcdiag /v /c /e

# Specific tests
dcdiag /test:dns
dcdiag /test:fsmocheck

Security Best Practices

• Implement tiered administration model
• Use Privileged Access Workstations (PAWs)
• Enable audit logging for AD changes
• Protect Domain Admins group (minimal members)
• Regular password audits
• Implement LAPS for local admin passwords

Conclusion

Active Directory remains central to Windows infrastructure management. Whether you're managing a traditional domain or building hybrid cloud solutions, strong AD skills are essential.

Our Windows administration eBooks provide comprehensive coverage of AD, Group Policy, and modern Windows Server management.