Active Directory
Active Directory
Microsoft's central directory for users, computers, groups and access control in a Windows domain.
In everyday business: One staff account can be managed centrally instead of separately on every PC.
ACTIVE DIRECTORY
Active Directory Trusts Playbook
Understand why two domains can trust identities, how trust direction differs from access permission, and what to test when cross-domain access fails.
Learning objectives
- Explain the main purpose of Active Directory Trusts in plain language.
- Explain how domain controllers, DNS, users, groups, OUs and Group Policy fit together.
- Use evidence to separate a design problem from a configuration or physical fault.
- Describe the business impact of a failure and the evidence required for handover.
Why this matters in a real company
For a company, this is about controlling who can sign in, which computers are trusted and what staff are allowed to access. A clean identity design reduces password chaos, orphaned accounts and uncontrolled administrator access.
PLAIN ENGLISH
Technical terms used in this chapter
You do not need to memorise the jargon first. Understand what each term does and why somebody running a company would care about it.
Replication
Replication
The process of copying data or VM state to another system or location.
In everyday business: It can shorten recovery time after a server or site failure, but copied corruption can also replicate.
FSMO
Flexible Single Master Operations
Five special Active Directory roles for operations that should not be handled independently by every domain controller.
In everyday business: They prevent certain directory operations from conflicting with each other.
ACL
Access Control List
A list of rules that says which network traffic is allowed or blocked.
In everyday business: Like a security guard checking a list at a door.
DNS
Domain Name System
The service that translates names into IP addresses and helps Windows domain clients find services.
In everyday business: People and applications can use names instead of remembering network numbers.
BUSINESS TRANSLATION
What this means outside the server room
This topic affects the systems staff depend on for sign-in, files, applications and business continuity. The technical design determines how easy the environment is to manage and how painful a failure becomes.
Active Directory
What it means: Active Directory centrally manages users, computers, groups and access in a Windows domain.
In normal business language: Think of it as one employee identity system for the company instead of separate usernames and passwords on every computer and server.
Why the decision matters: Use it when a company needs central sign-in, consistent permissions, controlled administrator access and easier onboarding/offboarding.
DNS
What it means: DNS translates names into IP addresses and also helps many business services locate each other.
In normal business language: It is the company phonebook for systems. Staff type a name such as fileserver or portal instead of remembering a number.
Why the decision matters: Good DNS design reduces configuration mistakes and is especially important for Windows domains, cloud integrations and internal applications.
Virtual Machine
What it means: A virtual machine is a software-defined computer with its own operating system, memory, CPU allocation, disks and network interfaces.
In normal business language: It behaves like a separate server even though several VMs may share one physical machine.
Why the decision matters: VMs are useful for separating roles such as domain control, file sharing and applications while keeping management and recovery flexible.
Replication
What it means: Replication copies data or VM state to another system or location.
In normal business language: It is like keeping a second live copy of the filing room at another branch. It can reduce recovery time, but bad changes can also be copied.
Why the decision matters: Replication improves availability and recovery speed, but it does not replace retention and backup.
Firewall
What it means: A firewall controls which network connections are allowed between users, systems and external networks.
In normal business language: It is a security checkpoint between parts of the company network. It should allow legitimate work while blocking unwanted access.
Why the decision matters: Firewall rules should describe real business flows such as 'staff may reach accounting on HTTPS', not unexplained broad permits.
GPO
What it means: Group Policy centrally applies Windows settings to users and computers.
In normal business language: It is like issuing one company policy that automatically reaches every relevant workstation instead of changing each PC manually.
Why the decision matters: Use GPOs for consistent security and configuration, but document scope and ownership so one change does not surprise the whole business.
Trust does not grant file access by itself
A trust establishes an authentication relationship between security boundaries. Resource ACLs still decide whether an authenticated user can access a file, application or service.
Direction matters
When troubleshooting, draw the trust direction and the direction of resource access. The wording "Domain A trusts Domain B" is easy to misread without a diagram.
Forest and external scenarios
Active Directory supports several trust models depending on whether domains are in the same forest, different forests or older/external structures. Use current Microsoft design guidance for the exact scenario.
Cross-domain troubleshooting
- Check DNS/name resolution both ways.
- Check time/Kerberos health.
- Validate trust.
- Confirm user/group identity.
- Confirm target resource ACL.
- Check firewall ports between domain controllers where required.
Security
A trust expands the identity relationship between environments. Do not create one merely to avoid managing separate credentials without understanding the security boundary it changes.
PRACTICAL WORK
Hands-on lab
Build a small lab domain with one DC and one client. Create two OUs, two security groups and two users. Join the client, then prove which DNS server it uses and which GPOs apply.
Troubleshooting exercise
A user can sign in locally but cannot sign in with the domain account. Check DNS, network reachability, time, domain membership and DC service health in that order.
Chapter field checklist
- I can explain the subject without relying only on acronyms.
- I can draw or describe the main traffic, storage, power or service path.
- I know what normal operation should look like.
- I know which logs, counters or test results prove the result.
- I can explain the business impact if this component fails.
- I would document the final configuration and evidence at handover.
Chapter summary
Active Directory Trusts Playbook should now be understood as a business service with a technical implementation, not simply a collection of commands or product names. The important habit is to know the purpose, understand the dependencies, measure the result and document what was proven.
Technical references
Use the current product documentation and project requirements for production work.