Active Directory Domain Services
What it is
Active Directory Domain Services (AD DS) is the Windows Server directory service. An organization runs domain controllers that store identities and other directory objects, then provide domain join, LDAP, Kerberos/NTLM, Group Policy, DNS-related integration, and directory replication.
Why it exists
Some Windows and legacy applications require domain protocols or policies that a cloud identity service does not provide. AD DS supplies that compatibility, but the organization owns the domain-controller design and its security, patching, backup, monitoring, and recovery.
Think of AD DS as an organization-operated membership office for a private network. It maintains accounts, computers, groups, and rules for that domain. If the office is unavailable or inconsistent, systems that depend on it can no longer sign in or find the information they need.
Key ideas
- A domain controller is a server running AD DS. Domain controllers replicate directory data so the domain is not dependent on a single server.
- A domain is an administrative and identity boundary. It contains users, computers, groups, and other directory objects.
- Group Policy centrally configures supported Windows settings for domain-joined computers and users.
- AD DS supports legacy protocols such as LDAP, Kerberos, and NTLM. A workload needing one of these is a reason to examine AD DS compatibility; it is not automatically a reason to create a new domain.
- DNS and replication are core dependencies. A domain controller is not an ordinary application VM that can be copied, restored, or removed without an AD DS-aware plan.
Not the same as
- Microsoft Entra ID — cloud identity service formerly called Azure AD; it is not an AD DS domain controller.
- Microsoft Entra Domain Services — a managed domain service for AD DS-compatible workloads in Azure; Microsoft manages the domain controllers.
- service-account — an identity used by a service. It can be an AD DS account, but it is not a directory service.
Operational failure mode
Treating a domain controller like an ordinary VM creates an identity outage when it is patched, deleted, or restored without an AD DS recovery plan. Keep domain-controller design, backup, DNS, replication, and privileged administration under separate change control.
Northwind example
Northwind runs a warehouse application that requires Windows-integrated authentication and LDAP lookups. The application servers join an AD DS domain. Maya deploys more than one domain controller, monitors replication and DNS, and protects privileged domain administration. When the team moves other workloads to Azure, it does not assume every application needs AD DS: the modern ordering website uses Microsoft Entra ID instead.
AD DS versus Entra Domain Services
| Need | Start by considering |
|---|---|
| Full control over domain controllers, directory design, and AD DS operations | AD DS |
| Managed Azure domain compatibility for a legacy workload | [[entra-domain-services |
| Modern cloud sign-in and application identity | [[entraid |
Common confusion
- AD DS and Entra ID can synchronize or work together, but they are different services with different protocols and operational responsibilities.
- Azure RBAC controls Azure-resource management; it does not replace an AD DS domain’s guest OS and directory permissions.
- A domain controller’s backup must be designed for AD DS recovery. Do not treat a raw VM copy as a universal safe restore method.
Related
active-directory · entraid · entra-domain-services · service-account · azure-vm · azure-backup
Sources and re-audit
- Microsoft Learn — Active Directory Domain Services overview, checked 2026-09-16.