Windows Server 1.1 : termes Adds

This lesson walks through the vocabulary you must master before installing Active Directory: domain controllers, OUs, the AD database, the schema and trust relationships. Without these terms, the upcoming hands-on work is hard to follow.

Core terms

  • Domain controllers (DCs) — servers running the AD DS role. They host and replicate the Active Directory database NTDS.DIT in the SYSVOL folder. They also run the Kerberos Key Distribution Center (KDC) for authentication, plus DNS. Since authentication is critical, you should always have at least two domain controllers, so that if one is unavailable clients can reach the other.
  • Organizational Units (OUs) — containers for objects that also serve as scopes for management. OUs can be linked to Group Policy Objects (GPOs) which contain configuration settings applied to users or computers inside them. You can also delegate management of an OU's content or its subtree. No more than six OU nesting levels are recommended.
  • The AD database (NTDS.DIT) — ultimately, AD is a database of configurations and resources. Every record is an object (user, group, computer); every field is an attribute (name, password, description, SID). The file lives by default under %SystemRoot%\NTDS on each DC. It is divided into partitions: Configuration (domains, services, topology), Domain (objects in the domain — users, groups, computers), and the Partial Attribute Set used by the global catalog. If DNS is AD-integrated, zones and resource records also live in those partitions.
  • SYSVOL — a folder structure under %SystemRoot%\SYSVOL that holds logon scripts and files associated with GPOs.
  • The AD schema — the "blueprint" of Active Directory. It defines the object classes and attributes the directory can hold (for instance, that a user object class exists and is required to have a logon name). Schema changes (for example when extending the schema for Exchange) require special rights on the schema master and the registration of a DLL.
  • Trust relationships — a way for one domain to authenticate users from another domain and let them access its resources. The trusting domain extends trust to the trusted domain. Inside a single forest, every domain trusts every other domain automatically; across forests you must establish trusts manually.

Master these terms and the next lessons — installation of the first DC, creation of OUs, application of GPOs — will land on solid ground.

Summary

This lesson introduces the essential terminology and concepts of Active Directory (AD) for Windows Server administration. It covers domain controllers as the backbone of AD infrastructure, organizational units for object management and Group Policy application, the ntds.dit database structure with its multiple partitions, the schema defining object types and attributes, and trust relationships enabling cross-domain authentication and resource access.

Key points

  • Domain Controllers execute the AD role and host the ntds.dit database, providing KDC services for authentication and DNS services for name resolution
  • Organizational Units (OUs) serve as containers for AD objects (users, groups, computers) and provide scope for applying Group Policy Objects (GPOs) to automatically configure users and computers
  • The Active Directory database is structured into four main partitions: Configuration, Domain, Schema, and DomainDNS, each serving specific administrative purposes
  • The AD schema functions as a model defining which object classes and attributes can be created and stored in the directory
  • Trust relationships allow domains to authenticate users from other domains and grant them access to resources by establishing cross-domain identity verification

FAQ

What is the primary role of domain controllers in Active Directory?

Domain controllers execute the Active Directory role and host the ntds.dit database, which they replicate across multiple controllers for redundancy and failover. They also run critical services including KDC (Kerberos Key Distribution Center) for authentication and DNS services for domain name resolution.

How do Organizational Units (OUs) support Active Directory management?

OUs provide containers for organizing AD objects (users, groups, computers) and enable administrators to define management scope. They are linked to Group Policy Objects (GPOs) that automatically apply configuration settings to all users or computers within that OU.

What is the structure of the Active Directory database?

The AD database is divided into four main partitions: the Configuration partition (domain and topology information), the Domain partition (users, groups, and computers), the Schema partition (object class and attribute definitions), and the DomainDNS partition (integrated DNS zones if DNS is enabled on the domain).

What purpose does the AD schema serve?

The schema acts as a model that defines which object types (such as users, groups, and computers) can be created in Active Directory and which attributes (such as name, password, email address) each object type must or can possess.