1. Hidden Default Containers
Hidden containers in AD are concealed to prevent clutter and protect sensitive system objects. Administrators can reveal them by enabling Advanced Features in the View menu. These containers often store infrastructure data, replication information, and security principals critical to AD operations.
2. Default Container Types
- Computers: Default repository for new computer accounts.
- DCs: Houses domain controller accounts.
- ForeignSecurityPrincipals: Stores SIDs from external domains.
- Keys: Holds cryptographic key objects.
- LostAndFound: Contains orphaned objects to maintain directory integrity.
- Managed Service Accounts: Dedicated to managed service accounts for enhanced security.
- Users: Default location for new or upgraded user accounts.
3. Delegating Authority in OUs
OUs allow administrators to delegate control to specific users or groups. This enables role-based administration, where delegated administrators can manage tasks like resetting passwords or modifying group memberships within their OU, without full domain-wide rights.
4. Domain Accounts
Domain accounts are authenticated by AD, granting access to local and network resources. They are created in the Active Directory Users and Computers console and integrated into the AD structure for centralized management.
5. Local Accounts
Local accounts are managed by the SAM on individual machines. They provide access to local resources and are useful in standalone or small workgroup environments. They should not be created on servers functioning as DCs.
6. User Profiles
- Local Profiles: Stored on a single machine, tied to individual use.
- Roaming Profiles: Stored on a network share, accessible across multiple devices.
- Mandatory Profiles: Fixed templates that discard user changes at logoff.
7. Computer Accounts
Computer accounts uniquely identify machines in a domain. Managed via the AD console, they support authentication and authorization, ensuring secure integration with domain resources.
8. Group Types
- Security Groups: Manage permissions and enforce security policies.
- Distribution Groups: Simplify email distribution within organizations.
9. Default Groups
When a server is promoted to a DC, default groups such as Domain Admins, Enterprise Admins, and Schema Admins are created. These groups streamline administration by providing predefined roles and permissions.
Conclusion
Hidden containers, OUs, accounts, profiles, and groups form the foundation of secure and organized Active Directory management in Windows Server 2025. Understanding these elements ensures administrators can delegate tasks, manage resources, and maintain directory integrity effectively.