What is Active Directory and what are Group Policy Objects used for?

Active Directory Domain Services is Microsoft's directory service — a central database of users, computers, groups, and other objects, providing authentication and authorisation across a Windows network. It means one identity instead of a separate account on every machine.

The structure:

• Forest — the top-level security boundary, containing one or more domains.
• Domain — an administrative boundary with its own policies and its own directory partition.
• Organisational Unit (OU) — a container for organising objects, and the unit that Group Policy and delegated administration are applied to.
• Domain Controller — a server hosting the directory and handling authentication, using Kerberos.

Group Policy Objects (GPOs) apply configuration centrally to users and computers: security settings such as password policy and account lockout, software deployment, mapped drives, firewall rules, and desktop restrictions. They are what makes managing thousands of machines feasible.

How GPOs apply — remembered as LSDOU: Local, then Site, then Domain, then OU, with later ones overriding earlier. gpupdate /force forces a refresh and gpresult /r shows what actually applied, which is the first troubleshooting step.

Note: Design OUs around how you administer and apply policy, not around the company org chart. Mirroring the org chart is a common mistake that makes policy application awkward as the organisation reshuffles.