Windows Server 2008 service that provides a centralized authentication service for Microsoft networks. Provides the full-fledged directory service that is called Active Directory in Windows Server 2008 and previous versions of Windows Server.

Partition that allows information to be replicated to administratively chosen domain controllers. An example of information that is commonly stored in an application partition is DNS data. Application partitions offer control over the scope and placement of information that is to be replicated.

Characteristics associated with an object class in Active Directory that make the object class unique within the database. The list of attributes is defined only once in the schema, but the same attribute can be associated with more than one object class.

Object, such as a domain or organizational unit, that is used to organize other objects. Also known as a leaf object.

Trust type that allows resources to be shared between Active Directory forests.

Administration of an organizational unit is tasked to a departmental supervisor or manager, thus allowing that person to manage day-to-day resource access as well as more mundane tasks, such as resetting passwords.

Allows businesses to define, manage, access, and secure network resources including files, printers, people, and applications.

Full name of an object that includes all hierarchical containers leading up to the root domain. The distinguished name begins with the object’s common name and appends each succeeding parent container object, reflecting the object’s location in the Active Directory structure.

Grouping of objects in Active Directory that can be managed together. A domain can function as a security boundary for access to resources such as computers, printers, servers, applications, and file systems.

Server that stores the Active Directory database and authenticates users with the network during logon.

Name resolution mechanism that computers use for all Internet communications and for private networks that use the Active Directory domain services included with Microsoft Windows Server 2008, Windows Server 2003, and Windows 2000 Server.

Active Directory domain partition that is replicated to each domain controller within a particular domain. Each domain’s Domain NC contains information about the objects that are stored within that domain: users, groups, computers, printers, organizational units, and more.

Ability to respond gracefully to a software or hardware failure. In particular, a system is considered to be fault tolerant when it has the ability to continue providing authentication services after the failure of a domain controller.

First domain created within an Active Directory forest.

Designed to offer support for Active Directory domain controllers running various supported operating systems by limiting functionality to specific software versions. As legacy domain controllers are decommissioned, administrators can modify the functional levels to expose new functionality within Active Directory. Some features in Active Directory cannot be activated, for example, until all domain controllers in a forest are upgraded to a specific level.

Occurs when a domain controller receives updates to the Active Directory database from other domain controllers on the network.

Unique number used to identify all devices on an IP network. IP addresses are four octets long and are commonly expressed in dotted-decimal notation, such as 192.168.10.1.

Internal Active Directory process that automatically creates and maintains the replication topology. The KCC operates based on information provided by an administrator in the Active Directory Sites and Services snap-in that is located in the Administrative Tools folder on a domain controller or an administrative workstation that has the Administrative Tools installed.

Protocol that has become an industry standard that enables data exchange between directory services and applications. The LDAP standard defines the naming of all objects in the Active Directory database and, therefore, provides a directory that can be integrated with other directory services, such as Novell eDirectory, and Active Directory–aware applications, such as Microsoft Exchange.

When a change is made to the member list of a group object, only the portion of the member list that has been added, modified, or deleted will be replicated.

Individual domain controllers in an Active Directory database may contain slightly different information because it can take anywhere from a few seconds to several hours for changes to replicate throughout a given environment.

Portion of Active Directory database used to divide the database into manageable pieces.

Domain controller that contains a copy of the ntds.dit file that cannot be modified and that does not replicate its changes to other domain controllers within Active Directory. This feature was introduced in Windows Server 2008.

Upgrade strategy based on functional levels that allows enterprises to migrate their Active Directory domain controllers gradually, based on the need and desire for the new functionality.

Master database that contains definitions of all objects in the Active Directory.

Partition that contains the rules and definitions used for creating and modifying object classes and attributes within Active Directory.

Manually created nontransitive trust that allows child domains in separate trees to communicate more efficiently by eliminating the tree-walking of a trust path.

Allows access between multiple domains and/or forests, either within a single forest or across multiple enterprise networks.