Active Directory & Group Policy Administration

Q: How do I check Active Directory replication?

Run repadmin /replsummary and repadmin /showrepl for replication status, dcdiag for broader domain controller health, and PowerShell's Get-ADReplicationFailure for failures.

Active Directory and Group Policy

Active Directory Domain Services (AD DS) remains the identity backbone of most organizations running Windows. It stores users, groups, computers, and service accounts; authenticates them with Kerberos; and, through Group Policy, configures thousands of machines consistently — password rules, security baselines, software settings, drive mappings, firewall rules. Even organizations moving to cloud identity typically run AD for years alongside Microsoft Entra ID, synchronizing identities between them.

Because so much depends on it, AD problems surface as everything-is-broken incidents: logons fail, policies stop applying, file shares deny access. Most of those trace back to a handful of causes — DNS, time, replication, and misunderstood policy precedence — which this page covers along with recovery and hardening.

TL;DR

Forests contain domains, which contain organizational units (OUs); sites map AD to network topology.
Domain controllers replicate the directory multi-master; five FSMO roles handle operations that must be single-master.
AD depends on DNS (SRV records locate domain controllers) and time (Kerberos fails beyond about 5 minutes of skew).
Group Policy applies in LSDOU order — Local, Site, Domain, OU — with later policies winning unless enforced or blocked.
Troubleshoot with repadmin, dcdiag, and gpresult; enable the AD Recycle Bin and keep system state backups.
Harden with tiered administration, Windows LAPS, protected groups, and monitoring of privileged changes.

Quick Example

Checking replication and domain controller health:

Seeing which Group Policy objects applied to a machine and user, and why:

Creating a policy, linking it to an OU, configuring a setting, and backing up all GPOs:

Core Concepts

Logical and Physical Structure

Design OUs around administration and policy (who manages these objects, which policies apply), not the org chart.

Domain Controllers and FSMO Roles

All writable domain controllers accept changes and replicate them (multi-master). Five Flexible Single Master Operation roles handle tasks that cannot be multi-master:

The global catalog holds a partial replica of every object in the forest for searches and logons.

DNS, Time, and Kerberos

Clients find domain controllers through DNS SRV records; broken DNS is the most common cause of AD failures. Kerberos tickets depend on synchronized clocks — the default tolerance is five minutes — so time must flow correctly from the forest root PDC emulator. See Time Synchronization and Certificate Dependencies and DNS.

Replication and SYSVOL

Directory changes replicate between domain controllers using update sequence numbers, within sites quickly and between sites on schedules over site links. SYSVOL, which holds Group Policy templates and logon scripts, replicates with DFSR. Replication failures lead to inconsistent passwords, missing objects, and policies that apply on some machines but not others.

Group Policy

Processing Order and Precedence

Policies apply in LSDOU order: Local policy, then Site, Domain, and OU policies from parent to child. Later policies override earlier ones for the same setting. Modifiers:

Computer settings apply at startup and background refresh; user settings at logon and refresh. Background refresh happens about every 90 minutes with a random offset; gpupdate /force triggers it manually.

Managing GPOs

Use the central store for ADMX templates, name GPOs descriptively, keep each GPO focused on one purpose, document changes, and back up GPOs regularly. Group Policy Preferences configure items (drive maps, registry values, scheduled tasks) that users can later change, unlike enforced policy settings.

Troubleshooting

Backup and Recovery

AD Recycle Bin: restore deleted objects with attributes and group memberships intact — enable it.
System state backups of at least two domain controllers per domain, kept offline or immutable.
Authoritative restore to recover deleted or corrupted objects and force them to replicate.
Forest recovery plan: documented, rehearsed procedures for recovering from widespread compromise, including resetting the krbtgt account twice.
Metadata cleanup when retiring a failed domain controller, and rebuilding rather than restoring compromised DCs.

Backups older than the tombstone lifetime (typically 180 days) cannot be safely restored.

Security Hardening

Tiered administration: separate admin accounts and workstations for domain controllers, servers, and user devices.
Windows LAPS: unique, rotated local administrator passwords on every machine.
Protected Users group and restricted delegation for privileged accounts.
Limit privileged groups (Domain Admins, Enterprise Admins) to the minimum, with just-in-time access where possible. See Just-in-Time Access and Break-Glass Accounts.
Monitor changes to privileged groups, GPOs, and domain controllers, and audit service accounts.
Disable legacy protocols such as NTLMv1 and SMBv1 where possible.

Hybrid Identity

Most organizations connect AD to Microsoft Entra ID with Entra Connect or Cloud Sync, synchronizing users and groups and using password hash synchronization, pass-through authentication, or federation. Cloud-managed devices can receive policy from Intune instead of Group Policy. Plan which system is authoritative for each attribute and which workloads still need on-premises AD. See Microsoft Entra ID.

Best Practices

Fix DNS and Time First

Most AD outages trace to DNS or time. Monitor both and include them in every troubleshooting runbook.

Keep GPOs Small and Documented

One purpose per GPO, clear names, documented owners, and change history make policy behavior predictable.

Test Policies Before Broad Rollout

Link new GPOs to a pilot OU or use security filtering, verify with gpresult, then expand.

Practice Recovery

Test object restores from the Recycle Bin and system state restores in an isolated lab, and keep forest recovery documentation current.

Common Mistakes

Pointing Domain Controllers at Public DNS

Editing the Default Domain Policy for Everything

Daily Use of Domain Admin Accounts

FAQ

What is Active Directory?

Microsoft's directory service for Windows networks. It stores identities and resources, authenticates users and computers with Kerberos, and lets administrators manage configuration and access centrally.

What is Group Policy?

A feature of Active Directory that applies configuration and security settings to users and computers through Group Policy Objects linked to sites, domains, and organizational units.

In what order is Group Policy applied?

Local, Site, Domain, then OU — from parent OUs to child OUs. Later policies override earlier ones for the same setting unless a GPO is enforced or inheritance is blocked.

How do I check Active Directory replication?

Run repadmin /replsummary and repadmin /showrepl for replication status, dcdiag for broader domain controller health, and PowerShell's Get-ADReplicationFailure for failures.

How does Active Directory relate to Microsoft Entra ID?

Entra ID is Microsoft's cloud identity service. Many organizations synchronize on-premises AD identities to Entra ID for cloud applications while still using AD for Windows logons, file servers, and Group Policy.