5.3 Directory Services: Active Directory & LDAP

Directory Services: Active Directory & LDAP

In modern enterprise environments with hundreds or thousands of employees, managing user accounts, passwords, system permissions, and endpoint configurations individually on each local machine is impossible. Directory Services provide a centralized, hierarchical, read-optimized database that stores information about enterprise network resources (users, security groups, computers, printers, and shares) and serves as the single source of truth for Authentication (verifying who you are) and Authorization (determining what you are allowed to access).

This section covers the architecture of centralized identity, the Lightweight Directory Access Protocol (LDAP), Microsoft Active Directory Domain Services (AD DS), Flexible Single Master Operation (FSMO) roles, Group Policy Objects (GPOs), domain joining workflows, and user offboarding protocols.

---

1. Centralized Identity & Directory Services Overview

To understand the necessity of directory services, consider the limitations of peer-to-peer or workgroup network models.

+-----------------------------------------------------------------------------+
|            WORKGROUP (LOCAL SAM) VS. CENTRALIZED DIRECTORY SERVICES         |
|                                                                             |
|   [WORKGROUP MODEL: ISOLATED LOCAL ACCOUNTS]                                |
|   +-------------------+  +-------------------+  +-------------------+       |
|   | WORKSTATION A     |  | WORKSTATION B     |  | FILE SERVER       |       |
|   | - Local SAM DB    |  | - Local SAM DB    |  | - Local SAM DB    |       |
|   | - User: alice_loc |  | - User: alice_loc2|  | - User: alice_fs  |       |
|   | - Pass: Secret1   |  | - Pass: Secret2   |  | - Pass: Secret3   |       |
|   +-------------------+  +-------------------+  +-------------------+       |
|   * Result: 500 machines = 500 separate password databases to maintain!    |
|                                                                             |
|   [ENTERPRISE DIRECTORY MODEL: ACTIVE DIRECTORY / LDAP]                     |
|   +---------------------------------------------------------------------+   |
|   | CENTRALIZED DIRECTORY SERVICE (Domain Controllers / LDAP Directory) |   |
|   | - Single Identity Store: "alice@corp.example.com"                   |   |
|   | - Single Password Policy, Single Sign-On (SSO), Central Audit Logs  |   |
|   +---------------------------------------------------------------------+   |
|             ^                                 ^                 ^           |
|             | Kerberos / LDAP                 | Auth            |           |
|             v                                 v                 v           |
|   [Workstation A]                      [Workstation B]   [File Server]      |
+-----------------------------------------------------------------------------+

The Limitations of Workgroups / Local SAM Accounts:

• Decentralized Administration: On standalone Windows workstations, accounts are stored in the local Security Account Manager (SAM) database file (C:\Windows\System32\config\SAM). If an organization has 200 workstations and hires a new employee, an administrator would theoretically have to create that user account on all 200 machines.
• Password Desynchronization: If a user changes their password on their desktop, it does not update on file servers or other workstations, forcing users to manage multiple distinct passwords.
• Zero Central Auditing or Instant Revocation: When an employee leaves the company, an admin must manually log into every individual endpoint to disable the account. Missing a single endpoint creates a severe security vulnerability.

Centralized Directory Services Benefits:

• Single Sign-On (SSO): A user logs in once using a single set of enterprise credentials (e.g., user@domain.com) and receives a cryptographic ticket granting seamless access to workstations, file shares, email, databases, and enterprise web applications.
• Uniform Policy Enforcement: Security baselines (password complexity, screen lockouts, firewall rules, software restrictions) are configured once in the directory and automatically applied across thousands of connected machines.
• Centralized Provisioning & Immediate Offboarding: Creating a user account in the directory instantly enables access across all authorized network resources. Disabling the account immediately revokes all authentication tokens enterprise-wide.

---

2. Lightweight Directory Access Protocol (LDAP)

LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral, industry-standard application protocol (defined in RFC 4510) used to query and modify items in directory service providers over IP networks. LDAP is a streamlined, IP-based successor to the complex OSI X.500 Directory Access Protocol.

• LDAP Standard Port: TCP / UDP port 389 (Plaintext or encrypted via StartTLS).
• LDAPS (LDAP over SSL/TLS): TCP port 636 (Encrypted tunnel established immediately upon connection using X.509 digital certificates).

+-----------------------------------------------------------------------------+
|                        LDAP DIRECTORY INFORMATION TREE (DIT)                |
|                                                                             |
|                       [dc=corp, dc=example, dc=com]   (Root Domain)         |
|                                     |                                       |
|                 +-------------------+-------------------+                   |
|                 |                                       |                   |
|       [ou=Engineering]                            [ou=Marketing]            |
|                 |                                       |                   |
|       +---------+---------+                             |                   |
|       |                   |                             |                   |
| [ou=Developers]     [ou=DevOps]                   [cn=Bob Jones]            |
|       |                                                                     |
| [cn=Alice Smith]  <--- Distinguished Name (DN):                             |
|                        "cn=Alice Smith,ou=Developers,                       |
|                         ou=Engineering,dc=corp,dc=example,dc=com"           |
+-----------------------------------------------------------------------------+

Directory Information Tree (DIT) & Distinguished Names (DN):

Information in LDAP is organized hierarchically in a tree structure called the Directory Information Tree (DIT). Every entry in the directory is uniquely addressed by its Distinguished Name (DN)—equivalent to an absolute file path in a filesystem.

An LDAP Distinguished Name is constructed from right to left (from the root of the tree down to the specific leaf object) using standardized attribute identifiers:

Full Distinguished Name Example:

cn=Alice Smith,ou=Developers,ou=Engineering,dc=corp,dc=example,dc=com

To parse this DN:

1. The object is a leaf entry with Common Name Alice Smith (cn=Alice Smith).
2. It resides inside the child Organizational Unit Developers (ou=Developers).
3. Which is nested inside the parent Organizational Unit Engineering (ou=Engineering).
4. Within the domain corp.example.com (dc=corp,dc=example,dc=com).

---

3. Active Directory Domain Services (AD DS) Architecture

Developed by Microsoft, Active Directory Domain Services (AD DS) is the dominant enterprise directory service implementation for Windows-centric and hybrid networks. AD DS integrates LDAP, Kerberos v5 authentication, and DNS into a unified management platform.

+-----------------------------------------------------------------------------+
|                   ACTIVE DIRECTORY LOGICAL VS. PHYSICAL STRUCTURE           |
|                                                                             |
|   [LOGICAL ARCHITECTURE]                                                    |
|   +---------------------------------------------------------------------+   |
|   | FOREST (Schema Master, Domain Naming Master, Global Catalog)        |   |
|   |   |                                                                 |   |
|   |   +---> TREE: corp.example.com (Root Domain)                        |   |
|   |   |       |                                                         |   |
|   |   |       +---> CHILD DOMAIN: na.corp.example.com (Two-way trust)   |   |
|   |   |               |                                                 |   |
|   |   |               +---> ORGANIZATIONAL UNITS (OUs): IT, Sales, HR   |   |
|   |   |                       |                                         |   |
|   |   |                       +---> OBJECTS: Users, Groups, Computers   |   |
|   +---------------------------------------------------------------------+   |
|                                                                             |
|   [PHYSICAL ARCHITECTURE]                                                   |
|   +---------------------------------------------------------------------+   |
|   | SITES & SUBNETS (Mapped to physical geographic branch IP ranges)    |   |
|   |   - Site HQ (Subnet 10.10.0.0/16) <== WAN Link ==> Site Branch (10.20)  |   |
|   |   - Domain Controllers (DCs) running multi-master replication       |   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

Logical Structure of Active Directory:

1. Forest: The top-level administrative and security boundary of an Active Directory instance. A forest contains one or more domain trees that share a single unified Active Directory Schema (the definition of all object classes and attributes), a single Configuration Partition, and a common Global Catalog.
2. Tree: A hierarchical grouping of one or more domains that share a contiguous DNS namespace linked together by automatic, two-way transitive Kerberos trust relationships (e.g., na.corp.example.com is a child domain of corp.example.com).
3. Domain: The core security and administrative boundary within Active Directory. A domain defines unique security policies (such as minimum password length and account lockout rules) and stores directory data for its member computers and users.
4. Organizational Units (OUs): Sub-containers within a domain used to organize users, groups, and computers into manageable administrative divisions (e.g., by department, office location, or device type). OUs are the lowest level in the Active Directory hierarchy to which Group Policy Objects (GPOs) can be linked and administrative permissions can be delegated.
5. Objects: The fundamental leaf components stored in the directory database (User accounts, Security Groups, Computer accounts, Shared Printers, and Service Accounts).

Physical Structure: Domain Controllers, Sites & Replication

• Domain Controllers (DCs): Physical or virtual Windows servers running the AD DS server role that hold a replica of the directory database file (ntds.dit) and the SYSVOL folder (which stores Group Policy templates and logon scripts). DCs authenticate users, process Kerberos tickets, and enforce security policies.
• Multi-Master Replication: Active Directory uses a multi-master replication model. Administrators can write directory changes (such as creating a user or resetting a password) to any Domain Controller in the domain. The modified DC then replicates those updates to all other DCs using Update Sequence Numbers (USNs) and timestamps to resolve conflicts.
• Sites & Subnets: Represent the physical network topology. Administrators define Active Directory Sites and associate them with specific IP subnets (e.g., Site Dallas_HQ associated with 10.10.0.0/16, and Site Austin_Branch associated with 10.20.0.0/24). Sites control inter-DC replication schedules across slow WAN links and ensure client workstations authenticate against the nearest local DC rather than routing across the WAN.
• Global Catalog (GC): A specialized Domain Controller role that holds a full replica of all objects in its own domain plus a Partial Attribute Set (PAS) of every object in all other domains across the entire forest. The Global Catalog enables rapid forest-wide search queries and resolves Universal Group memberships during user logons.

Active Directory FSMO (Flexible Single Master Operation) Roles

While most Active Directory operations use multi-master replication, five specific operations require strict single-master authority to prevent data corruption or conflicts. These are known as FSMO Roles (Operations Master Roles):

4. Group Policy Objects (GPOs) & Enterprise Management

Group Policy is a powerful centralized configuration management framework built into Active Directory. It allows system administrators to define, automate, and enforce operating system settings, security baselines, software installations, and user environment restrictions across thousands of domain-joined endpoints.

+-----------------------------------------------------------------------------+
|                     GROUP POLICY OBJECT (GPO) ARCHITECTURE                  |
|                                                                             |
|   +---------------------------------------------------------------------+   |
|   | GROUP POLICY OBJECT (GPO)                                           |   |
|   |                                                                     |   |
|   |   +-------------------------------------------------------------+   |   |
|   |   | COMPUTER CONFIGURATION (Applies at System Boot)             |   |
|   |   | - Windows Security Baselines, BitLocker, Firewall Rules     |   |
|   |   | - OS Patching Schedules, Local Administrator Group Members  |   |
|   |   +-------------------------------------------------------------+   |
|   |   | USER CONFIGURATION (Applies at User Logon)                  |   |
|   |   | - Desktop Wallpaper, Mapped Network Drives, Folder Redirect |   |
|   |   | - Browser Bookmarks, Application Preferences, Script Hooks  |   |
|   |   +-------------------------------------------------------------+   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

Computer Configuration vs. User Configuration:

• Computer Configuration: Settings apply to the computer operating system itself upon system boot, regardless of which user logs into the machine. Examples include enforcing BitLocker drive encryption, configuring Windows Defender Firewall rules, disabling USB mass storage ports, defining Windows Update installation schedules, and restricting members of the local Administrators group.
• User Configuration: Settings apply when an individual user logs into the computer, following the user regardless of which domain workstation they use. Examples include redirecting user folders (Documents, Desktop) to an enterprise file share, mapping network drives (e.g., Z: drive to \\fileserver\dept), configuring browser proxy settings, and locking desktop backgrounds.

Group Policy Processing Order: The LSDOU Rule

When a domain-joined computer boots and a user logs on, Active Directory evaluates and applies GPOs in a strict chronological sequence known by the mnemonic LSDOU:

1. L - Local Group Policy: The policy stored locally in the workstation's local registry (gpedit.msc).
2. S - Site GPOs: Policies linked to the physical Active Directory Site in which the computer's IP subnet resides.
3. D - Domain GPOs: Policies linked to the root of the Active Directory domain.
4. OU - Organizational Unit GPOs: Policies linked to Organizational Units, processed sequentially from the highest parent OU down through nested child OUs.

Precedence & Conflict Resolution Rules:

• The General Rule ("Last Applied Wins"): If two GPOs contain conflicting settings (for example, the Domain GPO sets a screen lock timeout to 15 minutes, but the Marketing OU GPO sets it to 30 minutes), the setting in the GPO applied last takes precedence. Therefore, Child OU policies override Parent OU policies, which override Domain policies, which override Local policies.
• Enforced (No Override): An administrator can set a higher-level GPO (such as a critical Domain-level security baseline) to Enforced. An Enforced GPO moves to the end of the processing order, preventing any lower-level OU from overriding its settings.
• Block Policy Inheritance: Configured on an individual OU container to block all incoming policies from parent containers. However, an Enforced policy on a parent container will pierce through and override a Block Inheritance rule.

Group Policy Management & Troubleshooting Commands:

• Background Refresh Interval: By default, Windows client workstations refresh Group Policy in the background every 90 minutes, with a random 0–30 minute offset (jitter) to prevent all workstations from querying Domain Controllers simultaneously. Domain Controllers refresh every 5 minutes.
• gpupdate /force: Forces the local Windows computer to immediately re-evaluate and apply all computer and user policies from the Domain Controller, bypassing the 90-minute background interval.
• gpresult /r: Displays a summary Resultant Set of Policy (RSoP) report in the command prompt, showing applied GPOs, denied/filtered GPOs, and security group memberships.
• gpresult /h C:\report.html: Generates a comprehensive, interactive HTML report detailing every single applied policy setting and execution timestamp for troubleshooting.

---

5. Domain Joining & Workstation Lifecycle Management

Joining a client workstation to an Active Directory domain establishes a formal cryptographic trust relationship between the local machine and the centralized directory service.

+-----------------------------------------------------------------------------+
|                        DOMAIN JOINING & TRUST WORKFLOW                      |
|                                                                             |
|   [WORKSTATION]                                               [DOMAIN CTRL] |
|         |                                                           |       |
|         | --- 1. Query DNS SRV (_ldap._tcp.dc._msdcs.corp.com) ----> |       |
|         |                                                           |       |
|         | <--- 2. Returns IP Address of Active Domain Controller --- |       |
|         |                                                           |       |
|         | --- 3. Negotiate Domain Join (Admin Credentials) --------> |       |
|         |                                                           |       |
|         | <--- 4. Creates AD Computer Object & Shared Trust Secret - |       |
|         v                                                           v       |
|   [REBOOT COMPUTER: WORKSTATION IS NOW AN AD SECURE DOMAIN MEMBER]          |
+-----------------------------------------------------------------------------+

Prerequisites & Mechanics of Joining a Domain:

1. DNS Prerequisite: The client workstation's Network Interface Card (NIC) must have its primary DNS server configured to point to an Active Directory DNS server. When a domain join is initiated, the workstation queries DNS for the specialized Service Locator record: _ldap._tcp.dc._msdcs.<DomainName>. If the workstation points to a public DNS server (like 8.8.8.8), this query will fail, and the machine cannot contact a Domain Controller.
2. Machine Trust Account & Password: Joining creates a unique Computer Object in Active Directory. A secure shared secret (the machine account password) is negotiated between the computer and the Domain Controller and automatically rotated by Windows every 30 days.

User Profile Strategies: Roaming Profiles vs. Folder Redirection:

• Roaming User Profiles: Copies the user's entire local profile directory (Desktop, Documents, AppData, Downloads) over the network to a central SMB file server during user logoff, and downloads it back to the local workstation upon logon. Disadvantages: Extremely slow logons/logoffs for large profiles and high risk of file corruption if network connections drop.
• Folder Redirection & Offline Files (Recommended Best Practice): Leaves application data (AppData) local on the endpoint while dynamically redirecting specific user folders (Documents, Desktop, Pictures) to an enterprise SMB network share. Paired with Windows Offline Files, users can continue editing files when disconnected from the corporate network, automatically synchronizing changes upon reconnection.

Secure User Offboarding & Deprovisioning Protocol:

When an employee resigns or is terminated, system administrators must execute a strict, standardized offboarding workflow to prevent data exfiltration and unauthorized access:

1. Disable the User Account Immediately: Change the account status to Disabled in Active Directory. Never delete the account immediately, as deleting permanently destroys the object's unique Security Identifier (SID), which breaks file ownership records, encryption certificates, and audit logs.
2. Reset the Password & Revoke Active Tokens: Reset the account password to a long, random string. In cloud/hybrid identity environments (Microsoft Entra ID / Google Workspace), revoke all active OAuth refresh tokens and terminate all active web/mobile sessions.
3. Revoke MFA Devices: Remove registered hardware security keys, authenticator app registrations, and phone numbers from the user profile.
4. Relocate Object: Move the disabled user object to a designated ou=Disabled_Users container that blocks all Group Policy inheritance and access permissions.
5. Data & Mailbox Archival: Convert the user's mailbox to a shared or archived mailbox, export mailbox contents and home drive data according to organizational data retention policies, and reassign ownership of critical business documents before scheduling permanent account deletion after 90–180 days.