Identity resilience glossary
Active Directory (AD DS)
Active Directory Domain Services (AD DS) is Microsoft's directory service for managing users, computers, and other network resources in domains. It stores identity information and supports authentication and access control. Organizations use AD DS to manage access to domain resources and apply administrative policies across Windows environments, including through Group Policy.
Why Active Directory matters
Directory data connects an account to the resources that account can use. A change to a user, group, or computer object can therefore affect more than the directory itself. For an identity team, understanding an incident means checking the changed object and its access relationships, not simply confirming that the directory service is running.
Domain controllers replicate directory changes. That supports consistent operation, but an unwanted change can also reach other controllers. Replication is not a history of known-good configurations.
Active Directory and Microsoft Entra ID
AD DS and Microsoft Entra ID are distinct services. AD DS uses domains and domain controllers, while Entra ID provides cloud identity and access management. Organizations can synchronize identities between them, but synchronization does not make their settings interchangeable. Group Policy and Entra Conditional Access, for example, address different management and access decisions.
Example: a group membership changes
In a hypothetical company, a finance application grants access through an AD security group. An administrator removes several users from that group during routine cleanup. Their accounts still exist, but the application may deny access. Investigation should establish which memberships changed and whether the removals were intended before the team makes a correction.
Recovery depends on what changed
Recovering a deleted object is different from correcting a change to an object that still exists. Active Directory Recycle Bin can recover eligible deleted objects and their preserved attributes, but it must have been enabled before the deletion. It should not be treated as a general version history for every configuration change. The recovery method needs to match the actual failure.