Active Directory Interview Questions and Answers (L1, L2, L3)

Preparing for a Windows system administrator, service desk or IAM interview? Active Directory questions come up in almost every one. This list covers the questions interviewers actually ask at L1, L2 and L3 level, with short, clear answers you can explain in your own words.

Tip: don't memorize answers. For each topic, be ready with one real example of when you used it or fixed something with it.

L1 / service desk questions

1. What is Active Directory?

Active Directory Domain Services (AD DS) is Microsoft's directory service for Windows networks. It stores objects such as users, computers and groups, and provides authentication (Kerberos/NTLM), authorization and central management through Group Policy.

2. What is a domain controller?

A server running AD DS that holds a copy of the directory database, authenticates users and computers, and replicates changes with other domain controllers (DCs).

3. What is the difference between a domain, a tree and a forest?

• Domain: a security and administrative boundary with its own database partition, for example corp.example.com.
• Tree: domains sharing a contiguous namespace (corp.example.com and sales.corp.example.com).
• Forest: one or more trees sharing a schema, configuration and global catalog. The forest is the real security boundary.

4. What is an Organizational Unit (OU)?

A container used to organize objects, delegate administration and link Group Policy. Unlike groups, OUs are not used to grant permissions to resources.

5. How do you unlock an account or reset a password?

In Active Directory Users and Computers (ADUC), find the user, right-click and choose Reset Password, ticking Unlock the user's account. In PowerShell: Unlock-ADAccount -Identity jdoe and Set-ADAccountPassword. Always verify the caller's identity first.

6. What are the group scopes and types?

Types: Security (used for permissions) and Distribution (email only). Scopes: Domain Local (assign permissions to resources), Global (group users from the same domain) and Universal (forest-wide, stored in the global catalog). The classic best practice is AGDLP: Accounts go into Global groups, Global groups into Domain Local groups, and Permissions are assigned to Domain Local groups.

7. What is a Group Policy Object (GPO)?

A collection of settings applied to users or computers, such as password rules, mapped drives, software deployment or security settings. GPOs are linked to sites, domains or OUs.

8. A user's account keeps getting locked out. What do you check?

Saved old passwords in Credential Manager, mapped drives or scheduled tasks with old credentials, a phone or mail app using the old password, and disconnected RDP sessions. Event ID 4740 on the PDC emulator shows the source computer of the lockout.

L2 / system administrator questions

9. What are the FSMO roles?

Five operations master roles:

• Forest-wide: Schema Master and Domain Naming Master.
• Domain-wide: PDC Emulator (time source, password changes, lockouts, GPO editing), RID Master (allocates RID pools for new SIDs) and Infrastructure Master (updates cross-domain references).

Check them with netdom query fsmo. Move them with Move-ADDirectoryServerOperationMasterRole; "seize" only when the original holder is permanently gone.

10. What is the Global Catalog?

A DC that holds a full copy of its own domain and a partial, read-only copy of every object in the forest. It's used for forest-wide searches, universal group membership during logon and UPN logons.

11. In what order are GPOs applied?

LSDOU: Local, Site, Domain, OU (parent to child). The last applied wins in a conflict. Enforced links override this, Block Inheritance stops inherited GPOs (except enforced ones), and security filtering or WMI filters limit who gets a GPO.

12. How do you troubleshoot a GPO that isn't applying?

Run gpresult /r or gpresult /h report.html on the client, check the link, security filtering (the target needs Read and Apply), WMI filters, loopback processing and replication. Use gpupdate /force after changes, and check the GroupPolicy event log.

13. How does AD replication work?

AD uses multi-master replication. Within a site, changes replicate quickly through change notification; between sites, replication follows site links and schedules, using bridgehead servers. The KCC builds the replication topology automatically. Each change is tracked with USNs and version numbers.

14. Which tools do you use to check AD health?

dcdiag /v for DC health, repadmin /replsummary and repadmin /showrepl for replication, and the Directory Service, DNS Server and DFS Replication event logs.

15. Why is DNS so important for AD?

Clients find domain controllers through DNS SRV records (for example _ldap._tcp.dc._msdcs.domain). Wrong DNS settings on clients or DCs cause slow logons, failed domain joins and replication errors. Clients should point only to internal AD DNS servers.

16. Which ports does AD use?

DNS 53, Kerberos 88, RPC endpoint mapper 135 plus dynamic RPC ports, LDAP 389, SMB 445, Kerberos password change 464, LDAPS 636, Global Catalog 3268 and 3269, and NTP 123.

17. What is SYSVOL?

A shared folder on every DC containing logon scripts and Group Policy templates. It's replicated with DFS Replication (DFSR); older domains that still use FRS must migrate before adding newer DCs.

18. What is the AD Recycle Bin?

A feature that lets you restore deleted objects with all their attributes and group memberships, using Restore-ADObject or the AD Administrative Center. It must be enabled beforehand, and it can't be turned off once enabled.

L3 / senior and security questions

19. Authoritative vs non-authoritative restore?

A non-authoritative restore brings a DC back from backup and lets replication update it with newer changes. An authoritative restore (using ntdsutil) marks restored objects with higher version numbers so they replicate out and overwrite other DCs, for example to recover deleted objects when the Recycle Bin isn't enabled.

20. What is a USN rollback?

It happens when a DC is restored from an unsupported snapshot or image, so its update sequence numbers go backward and other DCs ignore its changes. Prevent it with supported, application-aware backups and VM-GenerationID-aware virtualization.

21. What is tombstone lifetime?

How long deleted objects are kept before garbage collection, 180 days by default in modern forests. A DC that hasn't replicated for longer than this can reintroduce deleted objects ("lingering objects") and must not simply be reconnected.

22. How does Kerberos authentication work?

The client gets a Ticket Granting Ticket (TGT) from the KDC on a DC after proving its identity. It then requests service tickets for specific services (identified by SPNs) and presents them to the server. Kerberos needs time sync within 5 minutes by default and working DNS.

23. Name common attacks on Active Directory and how to defend against them.

• Kerberoasting: cracking service tickets for accounts with SPNs. Defend with long random passwords or group Managed Service Accounts (gMSA) and AES encryption.
• Pass-the-hash / pass-the-ticket: reuse of stolen credentials. Defend with admin tiering, Protected Users group, Credential Guard and not logging on to workstations with domain admin accounts.
• DCSync and Golden Ticket: abuse of replication rights or the KRBTGT key. Monitor replication permissions and reset the KRBTGT password twice after a compromise.
• Password spraying: defend with strong password policies, MFA on external access and monitoring of failed logons.

24. What is Windows LAPS?

Windows Local Administrator Password Solution, built into current Windows versions. It sets a unique, regularly rotated local administrator password on each computer and stores it in AD or Microsoft Entra ID, stopping attackers from moving laterally with one shared local admin password.

25. How does on-premises AD connect to Microsoft Entra ID?

With Microsoft Entra Connect (Sync) or the lighter Entra Cloud Sync. Common sign-in options are password hash sync (recommended for resilience), pass-through authentication or federation. Hybrid joined devices can then use cloud features such as Conditional Access.

Scenario questions to practice

• A DC failed permanently. How do you clean it up and take over its FSMO roles? (Metadata cleanup, seize roles, DNS cleanup.)
• Users in one branch log on slowly. What do you check? (Site and subnet mapping, DNS, DC availability, GPO size.)
• Someone deleted an OU with 200 users. How do you recover? (Recycle Bin, or authoritative restore.)
• How would you secure domain admin accounts? (Tiering, PAWs, Protected Users, just-in-time access, MFA, monitoring.)

Handy PowerShell commands

Get-ADUser jdoe -Properties LockedOut,LastLogonDate,PasswordLastSet
Search-ADAccount -LockedOut
Get-ADGroupMember "Finance-RW" -Recursive
Get-ADComputer -Filter * -Properties LastLogonDate | Sort LastLogonDate
Get-ADDomainController -Filter * | Select Name,Site,IsGlobalCatalog

If PowerShell blocks your scripts, see how to fix "running scripts is disabled on this system" safely. For cloud identity security, read our real case of device code phishing on Microsoft 365, a favorite discussion topic in IAM interviews.

FAQ

How do I prepare for an Active Directory interview?

Build a small lab with two domain controllers on a free hypervisor, practice the tasks above, break things on purpose (stop replication, misconfigure DNS) and fix them. Practical stories impress interviewers far more than definitions.

Is Active Directory still relevant with Microsoft Entra ID?

Yes. Most companies run hybrid identity, with on-premises AD synced to Entra ID. Knowing both is one of the most in-demand skills for Windows and IAM roles.