Name: The Foundation of Iron — Week 22 — Active Directory — Enterprise Directory
Author: Amine RAITI

RATIO

THE FOUNDATION OF IRON · COURSE MATERIAL · WEEK 22

◆◆◆

ACTIVE DIRECTORY
ENTERPRISE DIRECTORY
Week 22 of 26 · Block 8 — Active Directory & GPO
10h theory · 25h practice

◆

◆ WEEKLY LEARNING OBJECTIVES

1. Understand Active Directory's logical structure (forest, domain, organisational units)
2. Install and promote a domain controller on Windows Server
3. Create and organise users, groups and organisational units
4. Join a Windows client machine to the domain
5. Authenticate domain users on client machines

◆◆◆

⚠ WARNING — SHELF LIFE OF VERSIONS AND SEQUENCING REMINDER

Active Directory is taught here because DNS (Week 21) is now operational — it is its direct technical prerequisite. Windows Server versions evolve; the instructor adapts the domain controller installation procedures to the version available in the classroom.

◆

Amine RAITI · Infrastructure Architect & SRE
Public document · CC BY-NC-SA 4.0 · AI Powered by Amine
Opération Dindon

RATIO

COURSE OUTLINE · 10H

THEORY GUIDING THREAD

◆

22.1 · Active Directory logical structure3h

— Forest: set of domains sharing a common schema (top of the AD hierarchy)
— Domain: basic administrative unit, security and replication boundary
— Organisational Unit (OU): logical container for organising users, groups and computers, and applying GPOs in a targeted way (anticipated link with Week 23)
— Relationship with LDAP: AD is a Microsoft-enriched LDAP implementation

22.2 · Domain controller and DNS dependency2h

— The domain controller (DC) is the server hosting Active Directory
— FSMO roles (Flexible Single Master Operations): conceptual presentation of the 5 single-master roles
— DNS dependency: explicit recap of the link with Week 21 — without working DNS, impossible to install a domain

22.3 · AD users, groups and computers3h

— Difference between local account (Week 12) and domain account (this week) — same logic, different scope
— AD group types: security vs distribution, domain local / global / universal
— Domain join: what technically happens when a machine joins the domain

22.4 · AD replication and high availability2h

— Why multiple domain controllers are recommended (fault tolerance, link with Week 14 — HA)
— AD sites and services: concept of replication between geographical sites

RATIO

EXERCISE 1 · DOMAIN CONTROLLER INSTALLATION · 12H

Equipment: Windows Server VM (Week 11), DNS operational from Week 21, Windows client VM for domain join.

(2h) Checking prerequisites: static IP on the server, DNS pointing to itself or the Week 21 DNS server, confirmed network connectivity.

(3h) Installing the Active Directory Domain Services (AD DS) role and promoting the server to domain controller, creating the domain (e.g. foundation.lan), choosing the domain functional level.

(2h) Post-installation check: the DNS SRV records have been automatically created by the DC (confirm in the Week 21 DNS zone), AD DS service active.

(3h) Creating the organisational structure: 3 organisational units (Management, Technical, Guests), creating 5 domain users distributed according to the provided scenario, creating security groups.

(2h) Joining a Windows client VM to the domain, logging in with a domain account, verifying the account appears in the DC's event logs.

SOLUTION — EXERCISE 1

Checking SRV records: in the domain's DNS zone, verify the existence of _ldap._tcp, _kerberos._tcp and _kpasswd._tcp records in the _tcp subfolder — their presence confirms the DC registered correctly and clients will be able to locate it.

Common mistake: the Windows server's DNS points to an external server instead of itself (or the Week 21 DNS server) — the DC installation fails or the SRV records are not created in the correct zone.

RATIO

EXERCISE 2 · AD ADMINISTRATION AND ACCOUNT MANAGEMENT · 13H

Equipment: the domain controller configured in Exercise 1.

(3h) AD administration via the GUI (Active Directory Users and Computers) AND via PowerShell (Get-ADUser, New-ADUser, Add-ADGroupMember) — demonstrating both methods are equivalent.

(3h) Onboarding/offboarding scenario: create an account for a new user, assign them to the correct groups and OUs, then simulate their departure (disabling the account, removing from groups, archiving in a "former employees" OU).

(3h) Authentication testing from several client machines with different domain accounts, verifying access rights to the shared resources created in Week 12 (now via domain accounts instead of local accounts).

(2h) Control delegation: configure a non-administrator user to be able to reset passwords in a specific OU — without full administrator rights.

(2h) Writing a diagram of the deployed AD structure (forest, domain, OUs, groups, accounts).

SOLUTION — EXERCISE 2

Teaching point on delegation: control delegation in AD applies the principle of least privilege (Week 15) at directory scale — a helpdesk can reset passwords without being a domain administrator, reducing the exposure surface if the helpdesk account is compromised.

◆ SUMMARY SHEET — WEEK 22 SELF-ASSESSMENT

1. I can explain Active Directory's forest/domain/OU structure.

2. I can install and promote a domain controller.

3. I understand why DNS is a prerequisite for Active Directory.

4. I can create users, groups and OUs in AD.

5. I can join a Windows machine to a domain.

6. I can administer AD via PowerShell.

7. I can manage an account's lifecycle (creation, deactivation, archiving).

8. I can configure control delegation on an OU.