1. What is Active Directory (AD)?
Active Directory is a directory service created by Microsoft that provides a centralized database for managing and organizing resources in a network, such as users, groups, computers, and other objects.

2. What are the main components of Active Directory?
The main components of Active Directory are:
– Domains: A logical grouping of objects within a network.
– Organizational Units (OUs): Containers used to organize objects within domains.
– Domain Controllers (DCs): Servers that authenticate users and manage network resources.
– Active Directory Forest: A collection of domains connected in a hierarchical structure.

3. What is the Global Catalog (GC) in Active Directory?
The Global Catalog is a distributed data repository in Active Directory that contains a partial replica of all objects from every domain in a forest. It allows for cross-domain searches and commonly accessed attributes without requiring contact with the domain’s specific server.

4. What is a Lightweight Directory Access Protocol (LDAP) in Active Directory?
LDAP is a protocol used to communicate with directory services such as Active Directory. It provides a standardized way to access and manage the directory information using TCP/IP.

5. How does Active Directory handle authentication?
Active Directory uses the Kerberos protocol for authentication. When a user logs in, their credentials are verified by the domain controller. Once authenticated, the user receives a ticket-granting ticket (TGT) that can be used to obtain service tickets for accessing network resources.

6. What is the difference between a user account and a computer account in Active Directory?
A user account represents an individual user and can be used for authentication and authorization purposes. A computer account represents a computer or device that joins the domain to access network resources.

7. What are Group Policies in Active Directory?
Group Policies allow administrators to manage users and computers by applying a set of predefined or custom configurations. Policies can control security settings, software installations, and other system configurations.

8. How do you create a new user account in Active Directory?
To create a new user account in Active Directory, you can use the Active Directory Users and Computers management console or PowerShell commands. In the console, right-click on the desired organizational unit (OU) and select “New” and then “User”. Provide the necessary details for the user account.

9. What is the purpose of an Organizational Unit (OU) in Active Directory?
Organizational Units (OUs) are containers used to organize and manage objects within a domain. OUs provide a way to delegate administrative tasks and apply Group Policies to specific groups of objects.

10. How can you delegate administrative tasks in Active Directory?
You can delegate administrative tasks in Active Directory by assigning specific permissions and roles to users or groups. This allows them to manage and control certain aspects of the directory without granting them full administrative rights.

11. What is the SYSVOL folder in Active Directory?
SYSVOL is a shared folder on domain controllers that contains important files necessary for the replication of Group Policies and logon scripts. It ensures that all domain controllers have consistent data.

12. How does replication work in Active Directory?
Replication is the process of synchronizing data between domain controllers in Active Directory. Changes made to objects on one domain controller are replicated to all other domain controllers to ensure consistency.

13. What is the difference between a domain and a workgroup?
A domain is a logical grouping of computers and resources that share a common directory database and security policies. A workgroup is a collection of computers that are connected to each other but do not have a centralized authority or directory service.

14. How can you track changes made to Active Directory objects?
Active Directory provides auditing features that allow you to track changes made to objects. By enabling auditing policies and configuring appropriate audit settings, you can monitor and log events related to Active Directory changes.

15. What is the purpose of the Active Directory Schema?
The Active Directory Schema defines the structure and attributes of all objects within the directory. It determines what types of objects can be created and the attributes associated with those objects.

16. Can you move a domain controller to a different domain?
No, a domain controller cannot be moved to a different domain. If you want to change the domain, you would need to demote the domain controller and then join it to the new domain as a new domain controller.

17. How do you perform a backup and restore of Active Directory?
To perform a backup and restore of Active Directory, you can use the Windows Server Backup tool. It allows you to create system state backups that include Active Directory data. The backups can be restored in case of data loss or system failures.

18. What is the Tombstone Lifetime in Active Directory?
The Tombstone Lifetime is the period during which deleted objects are retained in Active Directory. After this period, the deleted objects are permanently removed from the directory. The default Tombstone Lifetime is 180 days.

19. What is the difference between a domain local group and a global group?
A domain local group is used to assign permissions and access rights within a single domain. It can contain users and global groups from any domain in the forest. A global group is used to group users with similar functions across multiple domains in a forest.

20. How can you transfer or seize the Flexible Single Master Operations (FSMO) roles?
FSMO roles are responsible for specific domain controller operations in Active Directory. To transfer a role, you can use the Active Directory Users and Computers or the NTDSUTIL command-line tool. To seize a role, you can use the NTDSUTIL tool in case the current role holder is unavailable or not functioning properly.

Top 20 Advanced Active Directory Interview Questions and Answers

1. What is Active Directory?

Answer: Active Directory is a directory service provided by Microsoft that stores information about objects on a network and makes it easy to locate and access resources.

2. What is the role of Global Catalog in Active Directory?

Answer: The Global Catalog is a distributed data repository in Active Directory that contains a searchable, partial representation of every object in every domain in a multi-domain Active Directory forest.

3. What is a forest in Active Directory?

Answer: A forest is a collection of one or more domain trees that share a common schema, configuration, and global catalog. It represents the top-level structure of an Active Directory deployment.

4. What is a LDAP query?

Answer: LDAP (Lightweight Directory Access Protocol) query is a method used to search and retrieve information from an Active Directory database. It is a powerful way to filter and find specific data within the directory.

5. What is the purpose of the SYSVOL folder?

Answer: The SYSVOL folder is a shared directory that stores the server copy of the domain’s public files, such as Group Policy, user logon scripts, and system policies.

6. What is GPO (Group Policy Object) in Active Directory?

Answer: A Group Policy Object is a collection of settings that define what a system will look like and how it will behave for a defined group of users or computers. GPOs are used to enforce security settings, deploy software, and manage user configurations.

7. How do you troubleshoot Active Directory replication issues?

Answer: Some common troubleshooting steps for Active Directory replication issues include checking the event logs, verifying DNS configuration, ensuring proper connectivity between domain controllers, and using tools like Repadmin and DCDiag to diagnose and fix replication problems.

8. What is the purpose of the RID Master role?

Answer: The RID Master role is responsible for allocating a unique relative identifier (RID) pool to each domain controller in a domain. RIDs are used to create security principals like user accounts and groups.

9. How do you restore a deleted object in Active Directory?

Answer: Deleted objects in Active Directory can be restored using the tombstone reanimation process or by using a system state backup. However, it is recommended to have a proper backup strategy in place to ensure quicker and easier restoration.

10. What is a trust relationship in Active Directory?

Answer: Trust relationships are established between domains in a forest or between domains in different forests. They allow users to access resources in other domains and enable administrators to manage resources and security policies across multiple domains.

11. How do you upgrade the functional level of a domain?

Answer: The functional level of a domain can be upgraded by using the Active Directory Domain Services Installation Wizard or by using PowerShell commands. However, before upgrading, it is important to ensure compatibility with existing domain controllers and applications.

12. What is the purpose of the Infrastructure Master role?

Answer: The Infrastructure Master role is responsible for updating the group-to-user references when users move between domains within a forest. It ensures that cross-domain object references are properly maintained.

13. What is a site in Active Directory?

Answer: A site is a logical construct in Active Directory that represents a geographic location or a network link. Sites are used to control replication traffic and optimize network communication between domain controllers.

14. How do you delegate administrative control in Active Directory?

Answer: Administrative control in Active Directory can be delegated by assigning appropriate permissions to security groups or individual users. This can be done using the Active Directory Users and Computers snap-in or through PowerShell commands.

15. What is the purpose of the PDC Emulator role?

Answer: The PDC Emulator role is responsible for maintaining backward compatibility for earlier versions of Windows clients. It also serves as the primary domain controller for password changes, time synchronization, and authentication.

16. What is the difference between a domain and a workgroup?

Answer: A domain is a logical group of computers that are centrally managed and share a common security database, whereas a workgroup is a collection of computers that are individually managed and do not have a centralized authentication or security mechanism.

17. What is the purpose of the Schema Master role?

Answer: The Schema Master role is responsible for managing and updating the Active Directory schema. It controls the structure and attributes of all objects within the directory.

18. How do you enable Active Directory Recycle Bin?

Answer: Active Directory Recycle Bin can be enabled using PowerShell commands. Once enabled, it allows the recovery of deleted objects without the need for tombstone reanimation or system state backups.

19. What is the purpose of the Domain Naming Master role?

Answer: The Domain Naming Master role is responsible for maintaining the uniqueness of domain names within a forest. It ensures that no two domains have the same name.

20. What are the FSMO roles in Active Directory?

Answer: The FSMO (Flexible Single Master Operations) roles in Active Directory are: PDC Emulator, RID Master, Infrastructure Master, Schema Master, and Domain Naming Master. These roles have specific responsibilities and are assigned to a specific domain controller within a forest.