What is Active Directory and what is the difference between authentication and authorisation?

Active Directory Domain Services is Microsoft's directory service — a central database of users, computers, and groups providing authentication and authorisation across a Windows network. Its value is one identity instead of separate accounts on every machine.

The structure:

• Forest — the top-level security boundary containing one or more domains.
• Domain — an administrative boundary with its own policies.
• Organisational Unit (OU) — a container for organising objects, and the target for Group Policy and delegated administration.
• Domain Controller — a server hosting the directory and handling authentication using Kerberos.

Group Policy applies configuration centrally — password policy, drive mappings, software deployment, security settings — which is what makes managing thousands of machines practical. Policies apply in the order Local, Site, Domain, OU, with later overriding earlier.

Authentication versus authorisation:

• Authentication proves who you are. Something you know, something you have, or something you are. Multi-factor means two different categories.
• Authorisation determines what you may do once authenticated — group membership, file permissions, and rights.

Note: Being able to log in but not access a share is an authorisation problem, not an authentication one. Making that distinction quickly is what makes access troubleshooting efficient.