Active Directory: Domain Controllers, Operations Masters, GC

Understand how domain controllers authenticate users and computers, the global catalog, DNS and service records, and how read-only domain controllers and operations masters shape deployment.

Domain controllers store the Active Directory Services database and NTDS.dit, plus the SYSVOL folder, using multi-master replication to synchronize changes and support Kerberos authentication, the KDC, and ROTC.

Host and manage the Active Directory database (NTDS.dit) and authentication on domain controllers, using Kerberos and KDC, while supporting multi-master replication and SYSVOL-based Group Policy.

Store a partial, read-only copy of all objects in the forest as a global catalog, containing a subset of attributes for cross-domain searches across domain controllers.

Explore how the global catalog provides a partial, read-only copy of forest objects to speed cross-domain searches, while the partial attribute set in the schema controls replication.

Clients query DNS SRV records, like _ldap._tcp.adatum.com, to locate the nearest domain controller. Netlogon registers domain controller records in DNS at startup and re-registers them on restart.

Explore how srv records guide Active Directory domain services to locate domain controllers, optimize sign-in through site-aware dns lookups, and manage dns registration with Netlogon.

Examine the ad ds sign-in process: dns lookups locate a domain controller, authentication via lsa, and access tokens with sids and group memberships, plus tgt and service tickets for logon.

Learn how Active Directory uses DNS SRV records to locate domain controllers, how site definitions prioritize nearby controllers, and how Netlogon and ipconfig register DNS to support sign-in.

Learn how operations masters manage key domain controller roles, including schema master, domain naming master, read master, infrastructure master, and PDC emulator master, and how role moves prevent replication conflicts.

Test your understanding of FSMO operation master roles in Active Directory, including RID, infrastructure, schema, domain naming, and PDC emulator, plus time, forest, and inter-domain references.

Transfer FSMO roles between domain controllers in Active Directory to balance workloads, letting the target receive current data; seize roles only during failures when the original domain controller is unavailable.

Transferring FSMO roles is planned; seizing is a last resort. Use schema master via schema snap-in and infrastructure, RID, and PDC emulator via AD snap-ins; PowerShell uses force to seize.