ACTIVE DIRECTORY DEEP CORE
Active Directory DNS, Kerberos and Delegated Permissions Deep Core
Many Active Directory problems are DNS or authentication problems wearing another name.
Chapter purpose
Connect service discovery, Kerberos identity and authorization so administrators can isolate where an access failure actually occurs.
Learning objectives
- Explain SRV records and DC Locator.
- Explain Kerberos at a practical level.
- Separate authentication from authorization.
- Delegate routine administration without overusing Domain Admin.
Why this matters in a real company
Users can have perfect internet connectivity and still be unable to sign in or apply policy when AD DNS is wrong. Least-privilege delegation also limits the damage a helpdesk or admin account can cause.
5.1 AD uses DNS to locate services
Microsoft states that AD DS uses DNS so clients can locate domain controllers and domain controllers can communicate. This is why a domain client should use DNS that knows the AD namespace, not only an ISP or public resolver.
SRV records advertise services such as LDAP and Kerberos. DC Locator uses DNS and site information to find appropriate controllers.
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.corp.example.com
nltest /dsgetdc:corp.example.com
ipconfig /all5.2 Kerberos proves identity with tickets
Windows Server implements Kerberos version 5. At a high level, a client obtains domain credentials and then service tickets for target services. DNS, time and service identity are important dependencies.
Authentication answers who are you. Authorization answers what are you allowed to do.
5.3 Delegation reduces privileged-group membership
Microsoft delegation of control allows specific tasks to be granted at OU scope. A helpdesk group can reset passwords for ordinary users without becoming Domain Admins.
Highly privileged groups should stay small and should not be used for normal email or web browsing.
klist
whoami /groups
Get-ADGroupMember 'Domain Admins'5.4 Troubleshoot by separating stages
- Resolve service name and SRV records.
- Confirm time and DC discovery.
- Confirm authentication/ticket.
- Confirm group membership and token.
- Inspect target ACL or delegated permission.
Service records, SPNs and names
Active Directory service discovery relies on DNS service records, while Kerberos service authentication relies on service principal names. Both are name-driven systems. If users access a service through an alias that the service identity does not expect, Kerberos can fail or fall back in ways that confuse troubleshooting.
A useful fault-isolation habit is to write down the exact name the client used, the IP address it resolved to, the server account that owns the service and the SPN expected for that name. This turns an opaque authentication problem into a set of testable relationships.
Least privilege in practical administration
Delegation should match real helpdesk tasks. Password reset, account unlock, workstation join and group membership are separate privileges. Do not grant a domain-wide administrator role because the support team performs one of those tasks.
Use separate administrator accounts for privileged work and protect them more strongly than ordinary user identities. The goal is to reduce the number of systems on which privileged credentials are exposed.
Helpdesk needs password-reset rights only
The helpdesk must reset ordinary user passwords but must not edit server OUs or privileged accounts.
Decision: Delegate only the required rights on the user OU to a helpdesk group.
Evidence: Test an allowed reset in scope and a denied action outside scope.
Hands-on lab
In a lab, query AD SRV records, inspect Kerberos tickets and delegate one limited task to a test helpdesk group.
Troubleshooting exercise
- Service works by IP but not name: investigate DNS/SPN/Kerberos path.
- User signs in but gets access denied: investigate authorization.
- Helpdesk can modify too much: review delegated ACL scope and nesting.
Field checklist
- Domain clients use AD-aware DNS.
- SRV records resolve.
- Time hierarchy healthy.
- Privileged groups minimal.
- Delegation scoped.
- Allowed and denied access both tested.
Current technical references
The supplied PDF books are used as a historical curriculum map. Current implementation guidance is checked against current Microsoft documentation.