Windows Server and Active Directory
Operate domain services including authentication, group policy, DNS integration, and delegated administration.
- Certification
- CompTIA Server+
- Recommended study time
- 6h 35m
- Status
- Not started
Recommended study time
About 6h 35m in total, measured from the material on this page. At your session length of 45 minutes that is 9 sittings.
- Read the lesson22 min
About 2,853 words at a careful technical reading pace.
- Second pass with notes13 min
Re-read the harder parts and write your own notes.
- Recall from memory12 min
2 written recall questions.
- Practice decision12 min
One applied decision with feedback.
- Teach it back20 min
Write the topic in your own words.
- Real-world scenario15 min
Read the situation and justify your decision in writing.
- Hands-on practice3h 20m
Labs, commands and configuration until you can do it unaided.
- Spaced review1h 40m
4 short review sessions spread over the following weeks.
Learning objectives
- Explain domains, forests, organisational units, and replication.
- Apply group policy correctly using scope, inheritance, and filtering.
- Diagnose authentication and replication failures with built-in tooling.
Start here
About 8 minutes of reading, in 10 short parts.
Most business networks are still organised around a single directory that decides who exists, what they can log into, and what rules apply to their computer. Active Directory is that directory for the Windows world, and understanding how authentication and policy actually flow through it explains a huge share of everyday helpdesk tickets.
Where you meet it: A user in a branch office cannot log in Monday morning, and the fault could be a domain controller, DNS, replication, or their own account, all of which look identical from the login screen.
The lesson, part by part
Open one part at a time. Each part stands on its own, so you can stop and come back.
Active Directory is like a company's central staff register and rulebook combined. Instead of every computer in the building keeping its own separate list of who is allowed in and what they are allowed to do, there is one central register that every door and every office consults. When someone joins or leaves the company, or their role changes, it is updated in one place, and every door in the building automatically respects the new answer the next time it asks.
Group Policy is the rulebook part of that same system: instead of a manager individually telling every employee 'lock your screen when you leave your desk', a rule is written once, attached to the right department or floor, and applied automatically to everyone in that group. This is much more reliable than expecting a human to configure the same setting correctly on hundreds of separate machines.
Key ideas
If you remember nothing else from this topic, remember these.
- Active Directory is a hierarchical directory service that centralizes authentication and authorization for users, computers, and resources across a Windows domain.
- Group Policy applies configuration and security settings to users and computers at scale, inheriting down through the organizational unit structure unless explicitly blocked or overridden.
- Organizational units exist to structure delegation and policy application, not simply to organize objects visually like folders.
- Domain controllers replicate directory data among themselves, so a change made on one is expected to propagate, and replication failures can cause inconsistent authentication behavior across sites.
- PowerShell's Active Directory module provides scriptable, auditable administration that scales far better than clicking through the graphical console for repetitive tasks.
- Trust relationships define whether users in one domain or forest can be authenticated to access resources in another, and they can be one-way or two-way.
Onboarding forty new employees with a scripted Active Directory process
A worked example, step by step.
HR provides a spreadsheet of forty new hires and their departments, and each needs a domain account, correct OU placement, and group memberships by close of business.
- 01Prepare the inputThe HR spreadsheet is exported to CSV with columns for name, department, and title, matched to existing OU naming conventions.
- 02Review the OU structureGet-ADOrganizationalUnit -Filter * confirms the target OUs, such as OU=Sales,OU=Employees,DC=corp,DC=local, already exist for each department.
- 03Script the account creationA PowerShell script loops through the CSV and runs New-ADUser for each row, setting -Path to the correct department OU and a temporary password with -ChangePasswordAtLogon.
- 04Assign group membershipsAdd-ADGroupMember is called for each new account to place it in the correct department distribution and security groups.
- 05Verify account creationGet-ADUser -Filter {Department -eq 'Sales'} lists the new accounts to confirm all forty were created in the right location.
- 06Apply Group Policy inheritanceBecause the new accounts sit in the correct OU, existing GPOs linked to that OU, such as password policy and mapped drives, apply automatically at next logon.
- 07Check replicationrepadmin /replsummary confirms the new objects have replicated to other domain controllers before employees start logging in at different sites.
- 08OutcomeAll forty accounts are created, correctly organized, and policy-compliant well before the deadline, with an auditable script instead of forty manual clicks.
Outcome: Scripted, OU-aware account creation completed the batch onboarding accurately and left a repeatable, auditable process behind.
Windows Server and Active Directory reference
Worth keeping at hand while you work.
- Domain Controller (DC)
- A server that holds a writable copy of Active Directory and authenticates logon requests.
- Organizational Unit (OU)
- A container used to structure objects for delegation and Group Policy application.
- Group Policy Object (GPO)
- A defined set of configuration settings applied to users or computers within linked OUs.
- New-ADUser
- PowerShell cmdlet to create a new Active Directory user account.
- Get-ADUser / Get-ADGroup
- Cmdlets to query existing user or group objects and their attributes.
- Add-ADGroupMember
- Adds one or more users or computers to an existing group.
- gpupdate /force
- Forces immediate reapplication of Group Policy on a machine instead of waiting for the refresh interval.
- repadmin /replsummary
- Reports the health and status of Active Directory replication between domain controllers.
- Forest / Domain / OU
- Hierarchy from broadest security and schema boundary down to organizational structure within a domain.
- Trust relationship
- Defines whether authentication in one domain or forest is accepted by another, one-way or two-way.
- FSMO roles
- Special single-master operations, such as Schema Master and PDC Emulator, held by specific domain controllers.
- Security group vs distribution group
- Security groups can be assigned permissions; distribution groups are for email only and cannot be used for access control.
Common misunderstandings
What most beginners get wrong here.
Group Policy settings apply instantly to every affected machine.
Machines refresh policy on an interval or at logon, and gpupdate /force is needed to apply changes immediately for testing.
Moving a user object to a new OU has no effect on their access or configuration.
OU placement determines which GPOs apply through inheritance, so moving a user can change their applied policies and delegated permissions.
A distribution group can be used to grant folder or resource permissions.
Only security groups can be assigned permissions; distribution groups exist purely for email distribution.
Every domain controller operates completely independently with no need to synchronize.
Domain controllers replicate directory changes among themselves, and replication failures cause inconsistent authentication behavior across sites.
A one-way trust means users in both domains can access each other's resources.
A one-way trust only allows users in the trusted domain to access resources in the trusting domain, not the reverse.
Exam traps
How the question writers try to catch you out.
- Scenarios describing inconsistent login behavior across office locations are often testing knowledge of Active Directory replication issues, not account lockout policy.
- A question about a GPO not applying to a user often hinges on OU placement and inheritance blocking, not the GPO's own settings being wrong.
- Security group versus distribution group is a common distractor pair in access control questions.
- PowerShell cmdlet naming follows a Verb-Noun pattern, and exam questions expect recognition of the correct cmdlet for a described task.
- FSMO role questions expect you to know these are single-master operations, not something every domain controller can perform simultaneously.
Check yourself
Answer in your head first, then reveal. This is not scored.
What determines which Group Policy settings apply to a given user account?
What is the difference between a security group and a distribution group?
Which PowerShell cmdlet creates a new Active Directory user account?
What can cause inconsistent authentication behavior between two office sites in the same domain?
What does gpupdate /force do?
Quick reference
A condensed summary of the lesson above, for revision.
What It Is
Active Directory Domain Services stores identity and configuration objects in a hierarchical structure of forests, domains, and organisational units, replicated between domain controllers. Kerberos provides authentication, DNS provides service location through SRV records, and Group Policy applies configuration to users and computers based on OU scope, security filtering, and inheritance.
Why It Matters
AD failures stop everything: logons, file shares, printing, and applications. AD compromise means total environment compromise, which is why tiered administration and privileged account hygiene matter as much as availability.
How It Works
- Clients locate domain controllers through DNS SRV records and authenticate with Kerberos.
- Group Policy is processed by scope: local, site, domain, then OU, with later settings winning by default.
- Controllers replicate directory changes on a schedule and topology defined by sites and links.
Where You See It
- Corporate logons, file and print services, certificate services, application authentication, and hybrid cloud identity.
Key Terms
- Domain controller
- A server hosting the directory and authentication services.
- OU
- Organisational unit used for delegation and policy scope.
- GPO
- Group Policy Object applying configuration to scoped objects.
- Replication
- Synchronisation of directory data between controllers.
- SRV record
- DNS record clients use to locate domain services.
Examples
- gpresult or the Group Policy Results wizard shows exactly which policies applied and why.
- repadmin /replsummary quickly reveals replication failures between controllers.
Common Problems
- Time skew breaking Kerberos
- Replication failures
- Policy not applying
- DNS misconfiguration on clients
- Excessive privileged accounts
How It Fails
- Clients pointed at public DNS cannot find domain services at all.
- Unresolved replication failures cause inconsistent policy and logon behaviour across sites.
- A compromised privileged account allows domain-wide persistence that is hard to remove.
How to Troubleshoot
- Verify time synchronisation and DNS configuration before deeper analysis.
- Use policy results reporting rather than assuming which GPO applies.
- Check replication health and event logs on all controllers, not just one.
Practical Knowledge
- Keep separate tiered administrative accounts and never browse the web from a controller.
- Test policy changes against a pilot OU before broad deployment.
Exam Coverage
- Directory structure and replication
- Group Policy scope and processing
- Authentication troubleshooting
Interview Questions
- Why is DNS critical to Active Directory?
- How do you find out why a group policy setting did not apply?
Watch and read
Verified official and reputable sources for this topic. Links open in a new tab.
Video training
Professor Messer video channel — general CompTIA training (no dedicated CompTIA Server+ course)
Professor Messer
WatchVideoFree
Lesson notes and bookmark
Notes and bookmarks for this lesson, saved with everything else you have marked.
No notes on this item yet.
Learning progress
0% across six evidence areas. Reading alone does not change progress.
Prerequisites
Next steps
- 01Run a Group Policy results report for one user and interpret the winning settings.
- 02List which accounts hold Domain Admin and whether each is justified.