Active Directory Foundations & Domain Services
Theory & Concepts

Active Directory & Domain Services

Understand identity central management, key structural elements, and how databases authenticate network actions.

🔑

Central Administration

No more local user accounts on every machine. Manage credentials, machines, and security rules from one single console.

🏛️

Forests & Domains

The organizational hierarchy. Domains partition network components, while Forests group multiple domains under a trust tree.

📂

Organizational Units

The administrative folders in AD used to structure users and computers, and link specific Group Policies (GPOs).

⚙️

Group Policy

Define exactly what users can and cannot do on Windows clients—pushing registry keys, scripts, and software silently.

Understanding Active Directory (Based on the Tutorial Video)

In the video "Understanding Active Directory and Group Policy" by Kevin Brown, we learn that Active Directory (AD) is essentially a database containing accounts, resources, and access permissions. The core service is called Active Directory Domain Services (AD DS).

Why AD is Needed

Without AD, a network is in a Workgroup model. In a Workgroup, if a user wants to log into 5 different computers, the administrator must create 5 separate local accounts. If the user changes their password, it must be updated manually on all 5 machines. With Active Directory, users are created once in a centralized database (the NTDS.dit file), stored on a Domain Controller (DC). Authentication happens centrally, enabling Single Sign-On (SSO).

Active Directory Structure
  • Forest: The security boundary. Contains all domains in your organizational network.
  • Domain: The logical partition. Your domain for this class will be john-doe.local.
  • Domain Controller (DC): A server running Windows Server 2019 that responds to security authentication requests (logging in, checking permissions) and holds the AD database.
  • Organizational Units (OUs): Sub-folders in a domain. GPOs can be linked to OUs to distribute configurations to users/computers.
❓ Conceptual Check

What is the name of the database file that stores all Active Directory objects (users, computer configurations, etc.) on a Domain Controller?

1. Deploy Server & Client VMs on Proxmox

Step 1

We are building our laboratory in Proxmox VE. Each student will configure two virtual machines: a Windows Server 2019 VM (which will become the Domain Controller) and a Windows 10 Client VM (which will join the domain).

Provision Windows Server 2019 (Domain Controller)

  1. Log into your Proxmox VE Web Console.
  2. Click Create VM in the top-right corner.
  3. General: Assign a VM ID (e.g., 201) and name it ws2019-dc-doe.
  4. OS: Select the Windows Server 2019 ISO from your local storage. Set Type to Microsoft Windows and version to 10/2016/2019.
  5. System: Keep defaults. Ensure Qemu Agent is checked.
  6. Disks: Allocate at least 50 GB storage, using standard SCSI or SATA.
  7. CPU: Assign at least 2 Cores (preferably 4).
  8. Memory: Assign at least 8192 MB (8 GB) of RAM.
  9. Network: Select your virtual bridge (use vmbr9999).
  10. Start the VM, boot into the installer, select Windows Server 2019 Standard (Desktop Experience), and complete setup by defining a secure Administrator password: Pa$$word123.

Provision Windows 10 (Client Workstation)

  1. Click Create VM in Proxmox VE.
  2. General: Assign a VM ID (e.g., 202) and name it win10-client-doe.
  3. OS: Select your Windows 10 ISO.
  4. Disks: Allocate at least 40 GB storage.
  5. CPU: Assign 2 Cores.
  6. Memory: Assign 8192 MB (8 GB) of RAM.
  7. Network: Ensure it is attached to the same network bridge (vmbr9999) as the Server. This is crucial so they can communicate!
  8. Complete the Windows 10 installation, skipping Microsoft accounts by choosing "I don't have internet" -> "Continue with limited setup", and create a local user account.

Configure Static IP on Windows Server 2019

A Domain Controller must have a static IP address because clients rely on it for authentication and DNS resolution. If its IP address shifts, the client machines won't be able to log in or query DNS.

  1. On the Server VM, click Start -> type ncpa.cpl and press Enter.
  2. Right-click your network interface and select Properties.
  3. Double-click Internet Protocol Version 4 (TCP/IPv4).
  4. Configure the settings:
    • IP Address: 192.168.1.200
    • Subnet Mask: 255.255.255.0
    • Default Gateway: 192.168.1.1
    • Preferred DNS Server: 127.0.0.1 (Loopback address, telling the server to query itself for DNS once Active Directory is installed)

⚡ Static IP Config PowerShell Generator

Copy and run this in administrative PowerShell inside your Windows Server to set up the network adapter configuration instantly:

New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.1.200 -PrefixLength 24 -DefaultGateway 192.168.1.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("127.0.0.1", "1.1.1.1")

2. Install Active Directory & Promote to DC

Step 2

Next, we install the **Active Directory Domain Services (AD DS)** role and promote the Server 2019 machine to a Domain Controller for your domain john-doe.local.

A

Install AD DS Role

Open Server Manager -> click Add roles and features -> choose Role-based or feature-based installation -> select your server -> check Active Directory Domain Services and accept dependencies.

B

Promote to Domain Controller

Once installed, click the yellow Warning Flag icon in Server Manager -> click Promote this server to a domain controller. Select Add a new forest and enter Root domain: john-doe.local.

C

DSRM Password & Reboot

Set a secure password for Directory Services Restore Mode (DSRM) (e.g. Pa$$word123). Accept all other default configurations (NetBIOS name, paths). Click Install. The server will automatically reboot.

⚡ Active Directory Forest PowerShell Script

Alternatively, execute these commands inside administrative PowerShell to deploy AD automatically:

# Install AD Domain Services features
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Install the active directory forest for the student domain
Install-ADDSForest -DomainName "john-doe.local" -InstallDns:$true -Force:$true

3. Configure OUs, Groups, and User Accounts

Step 3

With our domain controller active, we will now build the organizational structure. We'll set up a custom **Organizational Unit (OU)**, a **Security Group**, and create a domain user account.

🛠️ Configure Objects

Customize the object names to update all instructions, script blocks, and tree visualizations:

Method A: GUI (Active Directory Users & Computers)

  1. On the Server, click Tools -> Active Directory Users and Computers (ADUC).
  2. Right-click your domain john-doe.local -> select New -> Organizational Unit. Name it Sales. Click OK.
  3. Right-click the new Sales OU -> select New -> User. Set Full Name as Test User, and logon name as jdoe.
  4. Define their password (e.g. Pa$$word123). Check Password never expires.
  5. Right-click your domain (or standard Users container) -> select New -> Group. Name it Finance_Staff. Ensure Group Type is Security and Group Scope is Global.
  6. Right-click user jdoe -> click Properties -> select the Member Of tab -> click Add... -> type Finance_Staff -> click Check Names -> click OK -> click Apply.

Method B: Automated PowerShell Commands

Run this script inside administrative PowerShell on the DC to create the items instantly:

# Script to create OU, Group and User

💡 OU vs. Containers

Standard containers (like Users or Computers) cannot have Group Policies linked directly to them. An **OU** (Organizational Unit) allows Group Policy Object (GPO) linking, delegation of permissions, and structured sorting.

4. Create Shared Folders & Configure Permissions

Step 4

We will configure and share two folders on the Domain Controller to demonstrate **Role-Based Access Control (RBAC)**:

Configure Folder A Share & Security (NTFS)

  1. Open ADUC and create a new Global Security Group named Internal_Staff in your domain, and add user jdoe to it.
  2. Create folder: C:\Shares\Folder_A.
  3. Right-click Folder_A -> select Properties -> select Sharing tab -> click Advanced Sharing. Check "Share this folder". Click Permissions. Remove "Everyone" and add Internal_Staff. Grant Change and Read permissions. Click OK.
  4. Select the Security tab -> click Edit... -> click Add... -> type Internal_Staff and click OK. Check the box for **Modify**, **Read & execute**, **List folder contents**, **Read**, and **Write**. Click Apply.

Configure Folder B Share & Restrict Permissions

  1. Create folder: C:\Shares\Folder_B.
  2. Right-click Folder_B -> select Properties -> Sharing tab -> Advanced Sharing. Share it as Folder_B. Click Permissions. Ensure only Administrators have access.
  3. Select the Security tab -> click Advanced.
  4. Click Disable inheritance. Select "Convert inherited permissions into explicit permissions on this object".
  5. Remove ordinary users, users groups, or Authenticated Users. Leave only **SYSTEM** and **Administrators** with Full Control. Click OK.

Automated Share PowerShell Generator

Run this script inside administrative PowerShell on the DC to provision the folders, groups, shares, and ACLs:

# Powershell sharing script

🔍 Active Directory Permission Resolver Simulator

Test authorization logic. Select a security persona and folder to query access response:

ACCESS GRANTED

Processing security descriptors...

5. Domain Join & Deliverable Verification

Step 5

We must now connect the **Windows 10 Client VM** to the domain controller and verify the setup.

🌐 Interactive DNS Check Simulator

To join a domain, the Client VM must resolve the domain name john-doe.local to the DC's static IP (192.168.1.200). Try toggling the client DNS server setting to see if it will successfully locate your Domain Controller:

Domain Resolution Failed

Client queries 1.1.1.1. 1.1.1.1 does not know about your private local domain 'john-doe.local'. You cannot join the domain!

1
Set Client Network DNS

On your Windows 10 VM, open Network Adapter Options (ncpa.cpl) -> properties of Ethernet -> IPv4 Properties. Set Preferred DNS Server to: 192.168.1.200 (the IP address of your Server 2019 DC). Leave Alternate DNS blank.

2
Join Domain

On Windows 10, open Settings -> System -> About -> click Advanced system settings. Select the Computer Name tab -> click Change.... Toggle from Workgroup to Domain and enter: john-doe.local. Enter the Administrator credentials when prompted, click OK, and restart the VM.

3
Sign In as User

At the logon screen, click Other User. Log in with user: jdoe (UPN: jdoe@john-doe.local) and the password you defined.

4
Test Share Access

Press Win + R -> type \\192.168.1.200 -> press Enter. Double-click Folder_A (access should be granted, verify you can save a file) and then double-click Folder_B (access should be denied).

📸 Lab Deliverables (Take these screenshots for grading!)

  • Screenshot 1: ADUC Tree Show the OU structure in ADUC, including the Sales OU and your user jdoe.
  • Screenshot 2: Folder A Shared File Creation Show your Windows 10 VM client logged in as jdoe inside \\192.168.1.200\Folder_A showing a text file successfully saved by you.
  • Screenshot 3: Folder B Denied Windows Dialogue Show the security error window: "Network Error: Windows cannot access \\192.168.1.200\Folder_B. Contact network administrator to request access." when logged in as jdoe.

Active Directory Dynamic Structure Tree

Visualize the objects and containment relationships in Active Directory based on your configurations. Try adding custom objects below to see how they fit into the hierarchy.

🌐 john-doe.local Root Domain
📁 Builtin Built-in Container
📁 Computers System Container
📁 Users System Container
🛡️ Finance_Staff Security Group
🛡️ Internal_Staff Security Group
📂 Sales Organizational Unit
👤 jdoe User Principal
Tree Note: Watch how custom Organizational Units (📂) and default containers (📁) differ. You can target group policy application specifically to the custom OU folders, whereas built-in system folders are restricted.