What is Active Directory? A step-by-step tutorial

In this Active Directory tutorial we’re going to look at what Active Directory is, how to use it, and Active Directory tools like ManageEngine AD360 and SolarWinds Access Rights Manager.

What is Active Directory? 

Active Directory is a directory service or container which stores data objects on your local network environment. The service records data on users, devices, applications, groups, and devices in a hierarchical structure.

The structure of the data makes it possible to find the details of resources connected to the network from one location. In essence, Active Directory acts like a phonebook for your network so you can look up and manage devices easily.

What does Active Directory do? 

Active Directory (AD) is a Microsoft directory service that organizes, manages, and secures network resources within a Windows-based environment. Used widely by businesses, AD offers a centralized way to handle permissions, security policies, and network resources like users, computers, printers, and applications. With AD, administrators can effectively control and streamline network operations, making it an essential tool for managing complex IT infrastructures.

One major reason to use Active Directory is centralized management. AD’s directory database contains detailed information about each network object, from user accounts and devices to access permissions. This centralized structure simplifies the enforcement of security policies and configurations across all devices and users in the organization, ensuring consistency and enhancing network security.

Another key advantage is Group Policy Management, which allows administrators to implement network-wide settings, such as password requirements, software updates, and security restrictions, with ease. This capability minimizes manual configuration and helps maintain standardized security measures.

Single Sign-On (SSO) is also a compelling reason to use AD. SSO allows users to access multiple applications and services with one set of credentials, reducing the need for multiple logins. This not only boosts user convenience but also enhances security by lowering the number of passwords at risk.

Active Directory is thus crucial for organizations seeking centralized control, streamlined administration, and a secure, efficient network environment.

How to set up Active Directory (with RSAT) 

To begin you will need to first make sure that you have Windows Professional or Windows Enterprise installed otherwise you won’t be able to install Remote Server Administration Tools. Then do the following:

For Windows 10 Version 1809 and Windows 11:

1. Right-click on the Start button and go to Settings > Apps > Manage optional features > Add feature.
2. Now select RSAT: Active Directory Domain Services and Lightweight Directory Tools.
3. Finally, select Install then go to Start > Windows Administrative Tools to access Active Directory once the installation is complete.

For Windows 8 (And Windows 10 Version 1803) 

1. Download and install the correct version of Server Administrator Tools for your device: Windows 8, Windows 10.
2. Next, right-click the Start button and select Control Panel > Programs > Programs and Features > Turn Windows features on or off.
3. Slide down and click on the Remote Server Administration Tools option.
4. Now click on Role Administration Tools.
5. Click on AD DS and AD LDS Tools and verify AD DS Tools has been checked.
6. Press Ok.
7. Go to Start > Administrative Tools on the Start menu to access Active Directory.

How to use Active Directory: How to set up a Domain Controller, Creating Directory Users 

How to set up A Domain Controller

One of the first things you need to do when using Active Directory is to set up a domain controller. A domain controller is a central computer that will respond to authentication requests and authenticate other computers throughout the network. The domain controller stores the login credentials of all other computers and printers.

All other computers connect to the domain controller so that the user can authenticate every device from one location. The advantage of this is that the administrator won’t have to manage dozens of login credentials.

The process of setting up a domain controller is relatively simple. Assign a static IP address to your Domain Controller and install Active Directory Domain Services or ADDS. Now follow these instructions:

1. Open Server Manager and click Roles Summary > Add roles and features.
2. Click Next.
3. Select Remote Desktop Services installation if you’re deploying a domain controller in a virtual machine or select role-based or feature-based installation.
4. Select a server from the server pool.
5. Select Active Directory Domain Services from the list and click Next.
6. Leave the Features checked by default and press Next.
7. Click Restart the destination server automatically if required and click Install. Close the window once the installation is complete.
8. Once the ADDS role has been installed a notification will display next to the Manage menu. Press Promote this server into a domain controller.
9. Now click Add a new forest and enter a Root domain name. Press Next.
10. Select the Domain functional level you desire and enter a password into the Type the Directory Services Restore Mode (DSRM password) section. Click Next.
11. When the DNS Options page displays click Next again.
12. Enter a domain in the NetBios Domain name box (preferably the same as the root domain name). Press Next.
13. Select a folder to store your database and log files. Click Next.
14. Press Install to finish. Your system will now reboot.

Add a Domain Controller to an Existing Domain in Windows Server 2016

The procedures for adding a domain controller to an existing domain in Active Directory are the same, no matter which operating system you have. However, these instructions were organized during an exercise on Windows Server 2016. It is always a good idea to have at least two domain controllers in your AD domain just in case one goes down.

The second Domain Controller is a separate computer from the one identified for your first Domain Controller. That second computer needs to be set up with Windows Server 2016. Get it fully patched and assign it an IP address before starting the AD setup on that machine. Then follow these steps:

1. Open Server Manager, click on the Manage option on the menu ribbon and select Add Roles and Features.
2. In the opening screen of the wizard, click on Next.
3. In the Installation Type screen select the Role-based or feature-based installation radio button and click on Next.
4. In Server Selection leave the only server in the list highlighted and press Next.
5. In the Server Roles screen, Check the Active Directory Domain Services box. A dialogue box appears. Click on the Add Features button.
6. Back in the main feature selection screen, click the Next button.
7. This cycles through to the Features screen. Just click on the Next button. In the AD DS screen, click on the Next button.
8. Finally, click the Install button. Once the installation process finishes, you will see a notice telling you that additional steps are required. Click on the link that says Promote this server to a domain controller. This brings up the Deployment Configuration screen.
9. Leave the Add a domain controller to an existing domain radio button active. At the bottom of the list of options, you will see <no credentials provided>. Click on the Change button next to that.
10. Enter the username and password of the Administrator account on the AD instance that you first set up. This username should be in the format <domain>\Administrator. Click OK.
11. On return from the login popup, you will see that the Domain field has been populated with the domain that you entered for the user account. Click on the Next button.
12. Decide whether to make this a read-only domain controller (RODC). If so, check that box in the Options screen, if not, check both the DNS server and Global Catalogue boxes.
13. Enter a DSRM password and confirm it. Click on the Next button. You will see a warning but just click on the Next button again.
14. In Additional Options choose your original domain controller for the Replicate from: field. Click on Next.
15. Leave all of the paths in their default settings and click on Next. In the Review Options screen, click Next.
16. The system will perform a prerequisites check. If that completes satisfactorily, the Install button will become active. Click it.
17. Wait for the installation to complete. The computer will reboot. Log in to the machine.

Go back to your original domain controller computer and open Active Directory Users and Computers and you will see that your new DC is listed there in the Domain Controllers folder.

Creating Active Directory Users

Users and computers are the two most basic objects that you will need to manage when using Active Directory. In this section, we’re going to look at how to create new user accounts. The process is relatively simple, and the easiest way to manage users is through the Active Directory Users and Computer or ADUC tool that comes with the Remote Server Administration Tools or RSAT pack. You can install ADUC by following the instructions listed below:

Install ADUC on Windows 10 Version 1809 and Higher or Windows 11:

1. Right-click on the Start button and click Settings > Apps, then click Manage optional features > Add feature.
2. Select RSAT: Active Directory Domain Services and Lightweight Directory Tools.
3. Select Install and wait for the installation to complete.
4. Go to Start > Windows Administrative Tools to access the feature.

Install ADUC on Windows 8 and Windows 10 Version 1803 or Lower: 

1. Download and install Remote Server Administrator Tools for your version of Windows. You can do so from one of these links here:
   Remote Server Administrator Tools for Windows 10, Remote Server Administrator Tools for Windows 8, or Remote Server Administrator Tools for Windows 8.1.

1. Right-click on Start > Control Panel > Programs > Programs and Features > Turn Windows features on or off.
2. Scroll down and select Remote Server Administration Tools.
3. Expand Role Administrator Tools > AD DS and AD LDS Tools.
4. Check AD DS Tools and press Ok.
5. Go to Start > Administrative Tools and select Active Directory Users and Computers.

How to Create New Users with ADUC 

1. Open the Server Manager, go to the Tools menu and select Active Directory Users and Computers.
2. Expand the domain and click Users.
3. Right-click on the right pane and press New > User.
4. When the New Object-User box displays enter a First name, Last name, User logon name, and click Next.
5. Enter a password and press Next.
6. Click Finish.
7. The new user account can be found in the Users section of ADUC.

Active Directory Events to Monitor 

Like all forms of infrastructure, Active Directory needs to be monitored to stay protected. Monitoring the directory service is essential for preventing cyber-attacks and delivering the best end-user experience to your users.

Below we’re going to list some of the most important network events that you should look out for. If you see any of these events then you should investigate further ASAP to make sure that your service hasn’t been compromised.

Understanding Active Directory: Forests and Trees

Forest and trees are two terms you will hear a lot when delving into Active Directory. These terms refer to the logical structure of Active Directory. Briefly, a tree is an entity with a single domain or group of objects that is followed by child domains. A forest is a group of domains put together. When multiple trees are grouped together they become a forest.

Trust Relationships and Domain Connectivity in Active Directory

Trees in the forest connect to each other through a trust relationship, which enables different domains to share information. All domains will trust each other automatically so you can access them with the same account info you used on the root domain.

Hierarchy and Database Management in Active Directory Forests

Each forest uses one unified database. Logically, the forest sits at the highest level of the hierarchy and the tree is located at the bottom. One of the challenges that network administrators have when working with Active Directory is managing forests and keeping the directory secure.

Choosing the Right Forest Design for Network Administration

For example, a network administrator will be tasked with choosing between a single forest design or multi-forest design. The single-forest design is simple, low-cost and easy to manage with only one forest comprising the entire network. In contrast, a multi-forest design divides the network into different forests which is good for security but makes administration more complicated.

How to Find the Source of Account Lockouts in Active Directory

The easiest way to find account lockouts in Active Directory is to use the Event Viewer, which is built into Windows. Active Directory generates Windows Events messages for each of its actions, so your first task is to track down the right event log.

1. Open a PowerShell window by pressing the Windows key and R together. In the Run popup, type powershell and hit ENTER.
2. At the command line type (get-addomain).pdcemulator
3. Note down the address of the PCD Emulator domain controller, which will be shown on the next line.
4. Type exit to close the PowerShell window.
5. The standard event log viewer that is built into the Windows operating system will help you find the account lockouts.
6. Go to the DC named as the PDC Emulator.
7. Open the Event Viewer by expanding Windows Administrative Tools in the Start menu and clicking on the Event Viewer entry in that submenu.
8. In the Event Viewer, expand the Windows Logs node in the left-hand menu tree. Click on Security. The Security events list will appear in the central panel of the Event Viewer.
9. In the right panel of the Event Viewer, click on Filter Current Log, which will open a popup window.
10. In the Event IDs field replace <All Event IDs> with 4740.
11. Select a time horizon in the Logged drop-down list at the top of the form.
12. Optionally, enter a username or a hostname if you are specifically looking for a lockout on a specific user or resource.
13. Press OK.
14. Double click on the log entry that relates to the user or resource that interests you and that has a timestamp that matches the moment you think the lockout occurred. This will open the Event Report.

The Event Report will show you the user that was locked out, the computer that the event occurred on, and the source, or reason for the lockout.

Active Directory Management with ManageEngine AD360 (FREE TRIAL)

ManageEngine AD360 is a compendium of ManageEngine Active Directory management systems plus a backup and recovery service. This package represents a good example of the tools that are available to automate the management tasks surrounding Active Directory usage. It is able to interface to AD implementations for SharePoint, Microsoft 365, Azure, and AWS, as well as the Active Directory system that you have in your Windows Server operating system.

ManageEngine AD360 is available on a 30-day free trial.

ManageEngine AD360 Start 30-day FREE Trial

Trust Relationships (and Trust Types) 

As mentioned above, trusts are used to facilitate communication between domains. Trusts enable authentication and access to resources between two entities. Trusts can be one-way or two-way in nature. Within a trust, the two domains are divided into a trusting domain and a trusted domain.

Types of Trust Relationships: One-Way and Two-Way

In a one-way trust, the trusting domain accesses the authentication details of the trusted domain so that the user can access resources from the other domain. In a two-way trust, both domains will accept the other’s authentication details. All domains within a forest trust each other automatically, but you can also set up trusts between domains in different forests to transfer information.

Setting Up Trusts: Using the New Trusts Wizard in Active Directory

You can create trusts through the New Trusts Wizard. The New Trust Wizard is a configuration wizard that allows you to create new trust relationships. Here you can view the Domain Name, Trust Type, and Transitive status of existing trusts and select the type of trust you want to create.

Trust Types 

There is a range of trust types in Active Directory. We’ve listed these in the table below:

Active Directory Reporting with SolarWinds Access Rights Manager

Generating reports on Active Directory is essential for optimizing performance and staying in accordance with regulatory compliance. One of the best Active Directory reporting tools is SolarWinds Access Rights Manager (ARM). The tool has been created to increase visibility into how directory credentials are used and managed. For example, you can view accounts with insecure configurations and credential abuse that could indicate a cyber attack.

Using a third-party tool like SolarWinds Access Rights Manager is beneficial because it provides you with information and features that would be much more difficult or impossible to access through Active Directory directly.

As well as generating reports you can automatically delete inactive or expired accounts that cybercriminals target. SolarWinds Access Rights Manager starts at $3,444 (£2,829). There is also a 30-day free trial version that you can download.

See also: Access Rights Management

Final Words

Active Directory is one of the best tools for managing resources in your network. In this article, we’ve just scratched the surface of the potential of this tool. If you’re using Active Directory remember that it is a potential entry point for cyber attackers. Making a note of key directory events and use a directory monitor will go a long way towards minimizing the risk of a malicious attack and protecting the availability of your service.

Active Directory FAQs

What should you look for in Active Directory tools?

We reviewed the market for Active Directory monitoring software and analyzed the options based on the following criteria:

• An interface that offers an easier way to organize Active Directory
• Reporting functions for auditing
• The ability to monitor many AD instances
• Tracking for replication, synchronization, backup, and migration
• Fast account status identification
• A free trial that provides a no-cost assessment period
• Value for money from a tool that pays for itself in efficiency improvements