Start with Chapter 1. Read, try each activity, then select Next. Everything here is a simulation; it does not change a real computer or directory. Use the lesson here, or download a copy for offline practice. Progress and notes last only while this page stays open.
Chapter 1 of 8
Imagine a school with 500 students.
How does the school remember everybody—and decide who can enter which room?
One teacher keeping a separate notebook for every room would be confusing. The office needs a shared system that knows who each person is, which groups they belong to, and which computers are part of the school.
👤 People
A student or employee has a user account. The account represents the person in the directory.
💻 Computers
A domain-joined computer has a computer account. The directory recognizes the device too.
👥 Groups
A membership list, such as Teachers, can be given permission to a resource.
📋 Settings
Group Policy can configure settings on applicable users and computers.
Why businesses use it
IT can create an employee’s account, put it in approved groups, and manage many domain computers centrally. When the employee leaves, IT can disable the account as part of offboarding.
What is a “directory,” in normal words?
An organized collection of records. A phone directory lists people and phone numbers. AD contains objects with attributes, such as a user’s name and account status.
Four names. Four different meanings.
You will hear “server,” “AD DS,” “DC,” and “ADUC” together. Each means something different.
Windows Server
The operating system. Like Windows 11, but designed for server jobs. It can run on a physical computer or a VM.
AD DS
A server role providing directory services. Installing its software is one part of setting up a Domain Controller.
Domain Controller (DC)
The server after it has been configured to serve the AD domain. It holds directory data and handles domain authentication.
ADUC
Active Directory Users and Computers: an administration tool used to manage users, groups, OUs, and computer accounts.
What is a domain?
A named collection of directory objects, including users and computers, managed together in AD. Our fictional lab domain is lab.nexora.example. It can span buildings and networks; it is not simply one Wi-Fi network or a website.
Does ADUC have to run on the DC?
No. Authorized administrators can use ADUC from a suitable management computer with Remote Server Administration Tools (RSAT). Opening ADUC does not turn your computer into a DC.
Is a server always a huge computer in a data centre?
No. “Server” describes a job as well as a type of computer. Your Windows Server VM can be a server. Its role and configuration decide what services it provides.
Is Microsoft Entra ID the same thing?
No. Microsoft Entra ID is a separate cloud identity service, commonly used with Microsoft 365. It was formerly called Azure AD. Organizations can connect their AD DS identities to cloud identities, but the services are not interchangeable.
Give the server its new job.
“Promote to Domain Controller” means configure this server to provide AD domain services. It does not mean physically moving the computer into a domain.
NEX-SRV01
In a real setup, promotion asks you to choose:
- Create a new forest: start a new AD environment and its first domain.
- Add a DC to an existing domain: give an existing domain another server that can provide directory services.
The wizard configures directory services and related settings, then the server restarts. DNS is commonly installed on the DC as well.
A folder is not a membership list.
An object is a record in AD. An Organizational Unit (OU) is a container that helps organize objects, delegate administration, and scope Group Policy.
👤 Jordan · user object
👤 Sam · user object
Example layout only. A forest can contain one or more domains. The first domain in this example is also the forest root domain.
OU = organizing folder
“Keep student accounts here.” An OU is not a Windows file folder. Moving Alex into Students does not automatically give him access to a shared folder.
Security group = membership list
“These people may read the lab files.” Grant Read permission to Lab-Readers, then add approved users to the group.
Try an access change
Where does Group Policy fit?
A Group Policy Object (GPO) is a set of settings. For example, IT can configure a screen-lock setting and link that GPO to the Lab Computers OU. Applicable domain computers process that policy.
“Who are you?” and “Are you allowed?”
🔑 Authentication
Proving your identity. “Yes, this is Alex.” A DC commonly uses Kerberos for domain authentication.
🚪 Authorization
Checking permissions. “Alex may read this folder.” The resource server checks the relevant permissions.
Can Alex read the Teachers folder?
In this simplified example, only the Teachers group has Read access.
Assumptions: fresh sign-in, enabled account, reachable DC, no cached session, no other permission grants or denies. In real environments, group changes may require sign-out/sign-in, and share plus NTFS permissions can affect access.
How does the PC find a DC?
DNS acts like a directions service. Domain computers use DNS records to locate domain services. A PC configured with only public DNS may browse the internet but fail to locate its AD domain.
Where do Kerberos and LDAP fit?
Kerberos commonly uses tickets to authenticate users to domain services. LDAP is a protocol applications and tools use to query or update directory information. DNS helps locate services. They solve different parts of the problem.
Your first Active Directory tickets.
For these scenarios, identity has been verified and the requested change is authorized. In a real job, follow your organization’s verification and approval procedures.
Unlock, reset, and disable are different.
- Unlock: removes the current lockout; it does not change the password. Investigate repeated failures or saved old credentials.
- Reset password: sets a new password through the approved process. A password reset and an account unlock are distinct actions.
- Disable: blocks future account authentication. Existing sessions or service tickets may need separate revocation or containment.
Can you explain it without memorizing?
Choose an answer. You will get an explanation after every question. Your score counts your first answer to each question.
Question 1 of 8
Explain it. Use it. Remember it.
Close the earlier chapters and say these answers out loud in your own words.
- What problem does Active Directory solve?
- What changes when a Windows Server becomes a DC?
- How is ADUC different from AD DS?
- Why does placing a user in an OU not automatically grant folder access?
- How can a user sign in successfully but still receive “Access denied”?
Reveal the five key ideas
- It centrally organizes domain identities and related information.
- After AD DS installation and promotion, it serves the domain as a Domain Controller.
- ADUC is an administration tool; AD DS is the directory service.
- An OU organizes objects; permissions must be assigned, often using security groups.
- Authentication proves identity; authorization checks permission to the specific resource.
Your next lab
- Prepare Windows Server and a Windows 11 Pro or Enterprise VM using the class setup guide.
- Take clean-installation snapshots.
- With the instructor, configure the lab network, server IP, and DNS.
- Install AD DS and promote the server into a new lab forest.
- Create an OU, user, and security group, then join the client to the domain.
- Practise an approved password reset, account unlock, and group-based folder access.
Windows 11 Home cannot join a traditional AD domain. Perform lab work only in your practice environment.
Notes are not sent to Nexora or saved automatically. Download them before closing or refreshing.
Official references
Explore Nexora’s training programs and ask about hands-on learning, class options, and enrolment.
Explore Nexora Cyber Academy · Ask about training