Active Directory
Microsoft's directory service for Windows domains that stores user accounts, groups, computers, and security policies.
What is Active Directory?
Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It stores information about users, groups, computers, and security policies in a centralized database.
Key components:
- Domain Controllers (DCs): Servers that run AD and respond to authentication requests
- AD DS (Directory Services): The database that stores objects (users, groups, computers)
- AD CS (Certificate Services): Manages digital certificates
- AD FS (Federation Services): Provides SSO across organizational boundaries
AD uses LDAP for queries, Kerberos for authentication, and DNS for locating domain controllers.
Analogy
Think of Active Directory like a corporate employee database. It stores every employee's ID (user account), which doors they can open (groups), and which computers they can use. IT can update one record and it affects everywhere.
Types and Use Cases
Enterprise Authentication Employees log into Windows computers using AD credentials. AD validates identity via Kerberos and grants access to domain-joined resources.
Group Policy Management IT administrators push security settings, software installations, and configuration policies to all domain computers from a central console.
SSO and Federation Connect on-prem AD to cloud identity providers like Azure AD, Okta, or LoginRadius via LDAP, SCIM, or AD FS (SAML) for hybrid SSO.
Resource Access Control Control access to file shares, network printers, internal applications, and VPNs based on AD group memberships and OU structure.
How it Works
# PowerShell: Create AD User
New-ADUser -Name "John Doe" -UserPrincipalName "john@company.com" `
-SamAccountName "john" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) `
-Enabled $true -Path "OU=Employees,DC=company,DC=com"
# PowerShell: Add User to Group
Add-ADGroupMember -Identity "Sales" -Members "john"
# LDAP Query (Search Users)
ldapsearch -x -H ldap://dc.company.com -D "cn=admin,dc=company,dc=com" -w "password" `
-b "dc=company,dc=com" "(objectClass=user)"Active Directory vs LDAP (Protocol)
Active Directory
LDAP (Protocol)
Active Directory is a directory service product (Microsoft)
LDAP is a protocol for accessing directories
AD implements LDAP (among other protocols like Kerberos)
LDAP can access AD or other directories (OpenLDAP)
AD is Windows-centric
LDAP is cross-platform (Linux, macOS, Unix can use LDAP)
Best Practices for Active Directory
- Organizational Units (OUs): Structure AD with OUs for departments (Sales, Engineering)
- Group-based access: Assign permissions to groups, not individual users
- Regular cleanups: Remove disabled accounts and empty groups quarterly
How LoginRadius Powers Active Directory
LoginRadius CIAM platform integrates with Active Directory through LDAP (on-prem authentication), SCIM (user sync from AD), AD FS (SAML federation for SSO), and Azure AD (cloud sync via SCIM/OIDC). Our platform provides pre-built connectors, step-by-step integration guides, and support for both on-prem AD and cloud-based Azure AD. LoginRadius also provides user provisioning/deprovisioning sync and detailed AD integration audit logs.
FAQs
Active Directory (AD) is on-premises, Windows domain controller-based, uses LDAP/Kerberos. Azure AD is cloud-based, Microsoft's cloud identity service, uses modern protocols (SAML, OIDC). AD is for on-prem Windows networks; Azure AD is for cloud/SaaS applications. Many organizations sync them via Azure AD Connect.
Steps: (1) LDAP Integration - configure LoginRadius to authenticate against AD via LDAP, (2) SCIM Provisioning - sync AD users to LoginRadius automatically, (3) AD FS Federation - use SAML to connect AD FS to LoginRadius, (4) Azure AD Connect - if using Azure AD, sync to LoginRadius via SCIM/OIDC.
LoginRadius provides multiple AD integration options: (1) LDAP Connector - authenticate users against on-prem AD via LDAP, (2) SCIM Provisioning - automatically sync AD users to LoginRadius, (3) AD FS Federation - connect via SAML for SSO, (4) Azure AD - sync via SCIM or OIDC. Our platform provides step-by-step guides and pre-built connectors.