Active Directory Domain Services (AD DS) forms the backbone of enterprise Windows identity management. In senior technical interviews, candidates are tested on FSMO roles, Kerberos authentication tickets (TGT vs ST), Domain Trusts, and Schema Extensions.

1. FSMO Roles Architecture

Active Directory uses a multi-master replication model, but five specific operations require single-master control to prevent conflicts. These are known as Flexible Single Master Operation (FSMO) roles.

# Query all FSMO role holders in the forest using PowerShell
Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster
Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster

2. Kerberos Ticket-Granting Process

When a user authenticates in an AD domain: 1. The client sends an AS-REQ (Authentication Service Request) to the KDC (Key Distribution Center on the DC). 2. KDC returns an AS-REP containing the Ticket Granting Ticket (TGT). 3. The client requests access to a server resource via TGS-REQ. 4. KDC verifies TGT and issues a Service Ticket (ST / TGS-REP).