Active Directory Identities and Policy

Every user, computer, and group in Active Directory is an object defined by a shared blueprint called the schema. This lesson explains what objects and attributes actually are, how the schema and global catalog make the directory searchable forest-wide, and how replication keeps every domain controller in sync.

Every Windows permission check ultimately compares security identifiers, not names. This lesson explains what security principals are, how SIDs uniquely and permanently identify them, and why well-known SIDs and the RID structure let you resolve a principal's real role even after it has been renamed.

Active Directory groups come in two types and three scopes, and the scope you pick determines what a group can contain, where it can be nested, and how far its permissions reach. This lesson explains why scoping is not a technicality but the mechanism that decides how access and nested membership actually propagate.

Organizational Units are the containers Active Directory uses to organize objects and delegate administration, and they are also the anchor points where Group Policy attaches. This lesson explains what an OU actually is, how it differs from a group, and how the OU/domain/site hierarchy becomes the map that Group Policy is delivered against.