Active Directory

Active Directory: 25 years of central identity in Windows networks

Active Directory is a directory service from Microsoft that centrally manages users, computers, groups, and security policies in Windows domain networks. This article covers the development of the system, from its early code at 3Com to the cloud variant Microsoft Entra ID, and is intended for administrators who want to understand the background of their daily tools.

REQUIREMENTS

• Basic knowledge of Windows Server and domain architecture
• No active Active Directory environment needed; this article is historical and conceptual
• Knowledge of LDAP and DNS is useful but not required

The earliest traceable code that led to Active Directory emerged around 1988 or 1989 at 3Com. The company worked on network software, including a directory service intended to manage network resources and users in an integrated environment. In 1990, 3Com stopped its network software initiatives and the directory code moved to Microsoft as part of an acquisition or collaboration.

Microsoft continued development internally under the name NT Directory Services, abbreviated as NTDS. This name still lives on in the current system: the Active Directory database is called NTDS.DIT and the maintenance utility is called NTDSUTIL.EXE. The "NT" refers to Windows NT, the operating system architecture that Microsoft developed in the 1990s for business environments.

FIRST RELEASE: WINDOWS 2000 SERVER

In 1999, Microsoft announced Active Directory as part of the upcoming Windows 2000 Server. That year, a preview version appeared that allowed organizations to test the system. The official release followed on February 17, 2000, when Windows 2000 Server with Active Directory became available for production environments. In 2025, Microsoft confirmed that the system is 25 years old, which matches the launch in the spring of 2000.

Windows 2000 Server was the first version of Windows Server with Active Directory. Before that, networks had to use Windows NT 4.0 and the NT Domain model, which was more limited in scalability and management. Active Directory introduced a hierarchical structure based on LDAP (Lightweight Directory Access Protocol). Organizations could set up domains in a forest model with trusts between domains. The system supported Group Policy, allowing administrators to centrally enforce settings on thousands of computers and users.

EXPANSIONS: 2003 TO 2008 R2

Windows Server 2003 brought forest trusts. This feature made trust relationships between different Active Directory forests possible, which simplified the integration of networks from merged companies or partners. Additionally, improved management functions for groups and users were introduced.

Windows Server 2008 introduced the Read-Only Domain Controller (RODC). An RODC contains only a read-only copy of the Active Directory database. This makes it safer to place domain controllers in environments with lower physical security, such as branch offices or remote offices. Administrators can determine which password hashes are replicated to the RODC, keeping sensitive accounts better protected.

Windows Server 2008 R2 added the Active Directory Recycle Bin. Before that, recovering deleted objects such as users or groups was a complex process that often required a backup restore. With the Recycle Bin, administrators can easily restore deleted objects, including all attributes and group memberships.

THE CLOUD: AZURE ACTIVE DIRECTORY

In October 2013, Microsoft launched Azure Active Directory, now known as Microsoft Entra ID. This cloud variant manages users and access to cloud applications such as Microsoft 365, Azure, and SaaS applications. Azure AD is technically a different product from the traditional Active Directory, but serves as a logical continuation in Microsoft's identity platform. Many organizations use a hybrid approach: on-premises Active Directory synchronizes with Azure AD via Azure AD Connect.

ARCHITECTURE AND PROTOCOL

Active Directory is built on LDAP as its core protocol. The directory follows an X.500-like hierarchy with domains, trees, and forests. A forest is the top-level container; within it are domains connected via trusts. Each domain controller runs the full directory service and replicates changes to other domain controllers via a multi-master replication model. DNS is essential: domain controllers register SRV records that clients use to find the correct domain controller.

Group Policy works through GPOs (Group Policy Objects) linked to sites, domains, or organizational units. Administrators can use them to centrally enforce password policies, software installation, script execution, and hundreds of other settings. This makes Active Directory one of the most widely used systems for large-scale Windows configuration management.

SECURITY AND IDENTITY

Kerberos is the standard authentication protocol in Active Directory. The system also uses NTLM for backward compatibility, but Microsoft advises against it due to its weaknesses. Since Windows Server 2012, Active Directory offers privileged access management via an administrative forest architecture. This isolates accounts with high privileges from the rest of the network.

In 2025, Active Directory remains a critical component in most Windows-based networks. The system has adapted from physical servers to virtual environments and now to the cloud. The integration with Intune and Conditional Access ensures that Active Directory or Microsoft Entra ID remains central to modern identity and access management.

VERIFICATION

Check whether a domain controller functions correctly:

Get-ADDomainController -Filter * | Select-Object Name, Domain, OperationMasterRole

This command requires the Active Directory module for Windows PowerShell, available on systems with RSAT (Remote Server Administration Tools) installed.

COMMON PROBLEMS

1. NTDS.DIT grows without limit: The database contains deleted objects until the tombstones expire (180 days by default). Run offline defragmentation with `ntdsutil` to shrink the database. This requires an offline domain controller.

2. Replication problems: Check with `repadmin /replsummary` whether all domain controllers replicate correctly. DNS errors are the most common cause; check whether all domain controllers register the correct SRV records.

3. RODC password caching: A RODC does not store password hashes by default. If users at a branch office cannot sign in, add them to the `Allowed RODC Password Replication Group` to enable caching for those accounts.

The original NTDS architecture from the 1990s still forms the basis of the system, and the question is how long Microsoft will continue to support the on-premises variant alongside the growing focus on Entra ID.