Windows Server and Active Directory

A Windows systems administrator runs the machinery that lets a few hundred desktops behave as one estate. Active Directory holds the accounts, groups and computers, and answers authentication requests whenever someone signs in. Group policy pushes settings out to those computers, so a password rule or a mapped drive is defined once instead of being set by hand at each desk. File and print services, DNS and DHCP, update distribution and backup usually run on the same family of servers, often as virtual machines on a hypervisor the same person looks after.

Design choices that last a decade

The decisions that matter in Active Directory are made early and lived with for years. How organisational units are laid out decides how cleanly policy can be applied, and how groups are nested decides whether anyone can later say who has access to a given folder. Estates that grew without a plan end up with thousands of groups, many empty, several granting rights nobody remembers approving. Least privilege is easy to state and hard to retrofit, and whoever inherits such a directory spends months unwinding it.

Administrative rights are the other lasting choice. An account able to change the whole domain is the prize in almost every serious intrusion into a Windows network, so well-run estates keep those rights on a handful of separate accounts, used from dedicated machines, protected with multi-factor authentication and never used to read email. Defending a directory properly belongs to identity and access in the security field; keeping it tidy enough to be defended belongs here.

Where the job is heading

• Hybrid identity. Accounts created on premises are synchronised to Microsoft's cloud directory, and a fault in that link locks people out of both worlds at once. SC-300 covers the cloud side of identity in depth.
• Microsoft 365 administration. Mail, collaboration and device management have largely moved into the tenant. MS-102 certified this ground and has an announced end date, so read its page before planning around it.
• Servers in Azure. Windows Server increasingly runs as a virtual machine in Azure, managed with the same tools as local ones; AZ-104 is the associate paper for that platform and the crossing point into the cloud field.
• PowerShell everywhere. Each of the above is scripted in practice, which is why scripting and automation is a topic of its own.

Microsoft's own certification for this ground, the Windows Server Hybrid Administrator Associate, now describes the role as running Windows Server on premises and in hybrid setups, with Azure tooling throughout. That framing is the honest one. A beginner who studies Active Directory as though the cloud did not exist will meet an estate where half the accounts are synchronised and half the policy has moved to device management, and will be as lost there as someone who knows only the cloud.