What is a domain controller?<\/strong><\/li>\n<\/ol>\n\n\n\nA domain controller (DC) is a server that stores a copy of the AD database. It handles logins, verifies user credentials, and applies security rules across the domain. Most networks have more than one for backup.<\/p>\n\n\n\n
Note: <\/strong>Freshers often come across basic-level Active Directory interview questions for interview like user account management, group policies, and domain concepts.<\/p>\n\n\n\n<\/span>Active Directory Interview Questions for Experienced<\/span><\/h2>\n\n\n\nLet\u2019s go through some important Active Directory interview questions and answers for experienced professionals.<\/p>\n\n\n\n
\n- How does Active Directory replication work across sites?<\/strong><\/li>\n<\/ol>\n\n\n\n
Active Directory uses multi-master replication. Changes made on one Domain Controller (DC) are copied to others. In multi-site environments, it uses site links and schedules to control when and how data replicates. Inter-site replication is less frequent to reduce bandwidth usage.<\/p>\n\n\n\n
\n- What are FSMO roles and what is the function of each?<\/strong><\/li>\n<\/ol>\n\n\n\n
There are five FSMO roles:<\/p>\n\n\n\n
\n- Schema Master:<\/strong> Handles schema changes.<\/li>\n\n\n\n
- Domain Naming Master:<\/strong> Manages domain additions\/removals.<\/li>\n\n\n\n
- RID Master:<\/strong> Allocates RID pools to DCs.<\/li>\n\n\n\n
- PDC Emulator:<\/strong> Syncs time, handles password changes, supports legacy systems.<\/li>\n\n\n\n
- Infrastructure Master:<\/strong> Updates cross-domain object references.<\/li>\n<\/ul>\n\n\n\n
\n- What is the difference between a standard DC and a Read-Only Domain Controller (RODC)?<\/strong><\/li>\n<\/ol>\n\n\n\n
A standard DC can make and accept AD changes. An RODC holds a read-only copy of the AD database. It doesn\u2019t store user passwords by default. It\u2019s ideal for branch offices where security is a concern.<\/p>\n\n\n\n
\n- How do you troubleshoot user authentication issues in AD?<\/strong><\/li>\n<\/ol>\n\n\n\n
I usually start by checking event logs on the domain controller. I verify DNS settings and see if the user account is locked, expired, or disabled. I also confirm replication is working across all DCs.<\/p>\n\n\n\n
\n- What is a Global Catalog and how does it affect user logon?<\/strong><\/li>\n<\/ol>\n\n\n\n
A Global Catalog (GC) stores a partial copy of every object in the forest. During logon, it helps find universal group memberships. Without it, users might face slow logins or access problems in multi-domain setups.<\/p>\n\n\n\n
\n- How do you manage fine-grained password policies?<\/strong><\/li>\n<\/ol>\n\n\n\n
I use Password Settings Objects (PSOs) in the Active Directory Administrative Center. These let me apply different password rules to specific users or groups. It gives more control than the domain-wide policy. You must be in Windows Server 2008 or later to use them.<\/p>\n\n\n\n
<\/span>Active Directory L2 Interview Questions<\/span><\/h2>\n\n\n\nThese Active Directory L2 interview questions and answers are designed to test your troubleshooting skills at the support engineer level.<\/p>\n\n\n\n
\n- What is the purpose of tombstone lifetime in Active Directory?<\/strong><\/li>\n<\/ol>\n\n\n\n
Tombstone lifetime defines how long a deleted object stays in the directory before it’s permanently removed. The default is 60 days. It is used during replication to inform other domain controllers that the object was deleted.<\/p>\n\n\n\n
\n- How do you recover deleted AD objects?<\/strong><\/li>\n<\/ol>\n\n\n\n
Deleted objects can be restored using the Active Directory Recycle Bin if it is enabled. I open the AD Administrative Center, go to the Deleted Objects container, and restore the object. This keeps attributes intact without needing a backup.<\/p>\n\n\n\n
\n- What is the SYSVOL folder and what does it contain?<\/strong><\/li>\n<\/ol>\n\n\n\n
The SYSVOL folder is shared on all domain controllers. It stores Group Policy templates and login scripts. These files are replicated between DCs using DFS Replication.<\/p>\n\n\n\n
\n- How do you use the \u201crepadmin\u201d tool to check AD health?<\/strong><\/li>\n<\/ol>\n\n\n\n
I run repadmin \/replsummary to get an overview of replication status. It shows failures, last success times, and errors. I also use repadmin \/showrepl to view inbound replication details per domain controller.<\/p>\n\n\n\n
\n- How do you handle replication conflicts between domain controllers?<\/strong><\/li>\n<\/ol>\n\n\n\n
First, I check for lingering objects or event log errors. Then, I use repadmin \/removelingeringobjects if needed. I make sure all DCs are reachable, replication is working, and DNS settings are correct. If necessary, I perform metadata cleanup or restore from backup.<\/p>\n\n\n\n
<\/span>Active Directory L3 Interview Questions<\/span><\/h2>\n\n\n\nThis section covers advanced Active Directory L3 interview questions and answers that are ideal for senior roles.<\/p>\n\n\n\n
\n- What is the role of the Infrastructure Master and when can it be placed on a Global Catalog?<\/strong><\/li>\n<\/ol>\n\n\n\n
The Infrastructure Master updates cross-domain object references. In multi-domain forests, it should not run on a Global Catalog. But if all DCs are Global Catalogs, it is safe to place them together.<\/p>\n\n\n\n
\n- How do you migrate Active Directory from one domain to another?<\/strong><\/li>\n<\/ol>\n\n\n\n
Migration involves planning, using tools like ADMT (Active Directory Migration Tool), and testing. I first establish trust between domains, migrate users and groups, then migrate SID history. Cleanup comes last.<\/p>\n\n\n\n
\n- How would you audit privileged user actions in AD?<\/strong><\/li>\n<\/ol>\n\n\n\n
I enable advanced auditing via Group Policy. Then I monitor logs under \u201cDirectory Service Changes.\u201d I also use tools like Microsoft Defender for Identity or third-party SIEM tools to track changes.<\/p>\n\n\n\n
\n- What is AdminSDHolder and how does it work?<\/strong><\/li>\n<\/ol>\n\n\n\n
AdminSDHolder protects high-privilege accounts like Domain Admins. Every 60 minutes, the SDProp process resets their ACLs to match AdminSDHolder. This stops accidental or malicious permission changes on critical accounts.<\/p>\n\n\n\n
\n- How would you secure Active Directory in a hybrid cloud environment?<\/strong><\/li>\n<\/ol>\n\n\n\n
I use conditional access policies, monitor sign-in logs, and restrict legacy auth. I also configure secure password policies, isolate admin accounts, and implement least privilege across both on-prem and cloud platforms like Azure AD.<\/p>\n\n\n\n
<\/span>Other Important Active Directory Interview Questions<\/span><\/h2>\n\n\n\nThis section includes additional interview questions and answers Active Directory professionals should know to strengthen their overall understanding and readiness.<\/p>\n\n\n\n
<\/span>Active Directory Admin Interview Questions<\/span><\/h3>\n\n\n\nHere are some key Windows AD interview questions that are commonly asked for Active Directory Administrator roles.<\/p>\n\n\n\n
\n- How do you create and manage user accounts in AD?<\/strong><\/li>\n<\/ol>\n\n\n\n
I use the Active Directory Users and Computers (ADUC) console. I right-click the desired OU, choose \u201cNew > User,\u201d and follow the wizard. For bulk tasks, I use PowerShell with New-ADUser and scripts to manage user properties.<\/p>\n\n\n\n
\n- How do you delegate administrative control in Active Directory?<\/strong><\/li>\n<\/ol>\n\n\n\n
I use the Delegation of Control Wizard in ADUC. It lets me assign specific permissions \u2013 like password reset or group management \u2013 to selected users or groups. This helps split responsibilities without giving full admin rights.<\/p>\n\n\n\n
\n- How do you apply and manage Group Policy Objects (GPOs)?<\/strong><\/li>\n<\/ol>\n\n\n\n
GPOs are managed through the Group Policy Management Console (GPMC). I create GPOs, link them to OUs, and use filters if needed. I run gpupdate \/force and check rsop.msc or gpresult to verify applied settings.<\/p>\n\n\n\n
\n- What\u2019s the difference between Security Groups and Distribution Groups?<\/strong><\/li>\n<\/ol>\n\n\n\n
Security Groups control access to resources and can be used in permissions and policies. Distribution Groups are for email only and cannot be used for security filtering. Security Groups have SIDs; Distribution Groups don\u2019t.<\/p>\n\n\n\n
<\/span>Active Directory Replication Interview Questions<\/span><\/h3>\n\n\n\n\n- What tools do you use to diagnose replication issues in AD?<\/strong><\/li>\n<\/ol>\n\n\n\n
I use repadmin for checking replication status and errors. I also check event viewer logs on domain controllers. Tools like dcdiag and PowerShell cmdlets help me test replication and domain health.<\/p>\n\n\n\n
\n- What is Knowledge Consistency Checker (KCC)?<\/strong><\/li>\n<\/ol>\n\n\n\n
KCC is a built-in process that creates and maintains the replication topology. It runs every 15 minutes and adjusts replication links based on network changes or failures. It reduces manual work for admins.<\/p>\n\n\n\n
\n- How do you monitor inter-site replication traffic?<\/strong><\/li>\n<\/ol>\n\n\n\n
I monitor inter-site replication using repadmin \/showrepl and replmon (on older systems). I also review replication schedules in Active Directory Sites and Services. For deeper analysis, I use Performance Monitor and third-party tools.<\/p>\n\n\n\n
\n- What are common causes of replication failure?<\/strong><\/li>\n<\/ol>\n\n\n\n
Replication can fail due to DNS misconfigurations, time sync issues, or broken site links. Network connectivity problems or outdated credentials also cause sync errors. I often find that firewall rules or lingering objects play a role too.<\/p>\n\n\n\n
<\/span>Active Directory Troubleshooting Interview Questions<\/span><\/h3>\n\n\n\nHere are practical Active Directory troubleshooting interview questions and answers to help you prepare for problem-solving scenarios.<\/p>\n\n\n\n
\n- What would you do if users are facing slow logins across the network?<\/strong><\/li>\n<\/ol>\n\n\n\n
I first check DNS settings and if clients are using the correct domain controller. Then I review Group Policy processing time using gpresult \/h and look for delays. Logon scripts and roaming profiles can also slow things down.<\/p>\n\n\n\n
\n- How do you troubleshoot account lockout issues?<\/strong><\/li>\n<\/ol>\n\n\n\n
I use the Account Lockout and Management Tools or check Event Viewer on the domain controller. I look for bad password attempts, often caused by saved credentials or scheduled tasks using old passwords.<\/p>\n\n\n\n
\n- What are typical signs of AD database corruption?<\/strong><\/li>\n<\/ol>\n\n\n\n
Frequent replication errors, unexpected reboots, or missing objects may point to corruption. The ntdsutil tool helps check and repair database integrity. I also monitor event logs for specific NTDS or Jet errors.<\/p>\n\n\n\n
\n- How do you check for and fix lingering objects?<\/strong><\/li>\n<\/ol>\n\n\n\n
Lingering objects appear when replication fails for a long time. I use repadmin \/removelingeringobjects to detect and remove them. It is important to check system time and make sure all domain controllers are syncing properly.<\/p>\n\n\n\n
<\/span>Active Directory Interview Questions Asked At Top IT Companies<\/span><\/h2>\n\n\n\nHere are commonly asked Windows Active Directory interview questions based on real interviews at leading IT companies.<\/p>\n\n\n\n
<\/span>TCS Active Directory Interview Questions<\/span><\/h3>\n\n\n\n\n- What are the prerequisites for joining a system to a domain?<\/li>\n\n\n\n
- How do you apply security settings using GPO?<\/li>\n\n\n\n
- How do you handle DNS issues in AD?<\/li>\n\n\n\n
- What is the function of the RID Master?<\/li>\n\n\n\n
- What is the impact of a broken trust relationship?<\/li>\n<\/ol>\n\n\n\n
<\/span>Capgemini Active Directory Interview Questions<\/span><\/h3>\n\n\n\n\n- What steps would you follow to demote a domain controller?<\/li>\n\n\n\n
- How do you identify replication latency?<\/li>\n\n\n\n
- What is the purpose of the Default Domain Policy?<\/li>\n\n\n\n
- How do you perform an authoritative restore?<\/li>\n\n\n\n
- How do you back up and restore Group Policy?<\/li>\n<\/ol>\n\n\n\n
<\/span>Cognizant Active Directory Interview Questions<\/span><\/h3>\n\n\n\n\n- How does AD authentication work with Kerberos?<\/li>\n\n\n\n
- What is the role of Netlogon?<\/li>\n\n\n\n
- How do you check FSMO role holders?<\/li>\n\n\n\n
- What is the difference between Domain Local, Global, and Universal Groups?<\/li>\n\n\n\n
- What\u2019s the importance of the NTDS.dit file?<\/li>\n<\/ol>\n\n\n\n