Microsoft’s Active Directory Security Feature

Active Directory is Microsoft's trademarked directory service, an integral part of the Windows 2000 architecture. Active Directory is a centralized and standardized system that automates network management of user data, security, and distributed. It is responsible for authenticating and authorizing all users and computers within a network of Windows domain type, assigning and enforcing security policies for all computers in a network and installing or updating software on network computers.

Security

Domain Name System (DNS) is necessary to any Internet-connected organization. DNS provides name resolution between common names, such as mspress.microsoft.com, and the raw IP addresses that network layer components use to communicate. Active Directory makes extensive use of DNS technology and relies on DNS to locate objects within Active Directory. Windows and Internet domains are now completely compatible. A domain name will identify Active Directory domain controllers which responsible for the domain, so any client with DNS access can locate a domain controller. Active Directory clients can use DNS resolution to locate any number of services because Active Directory servers send a list of addresses to DNS using the new features of dynamic update. Active Directory servers provide the LDAP service for object location, and LDAP relies on TCP as the underlying transport-layer protocol.

 Reference

http://technet.microsoft.com/en-us/library/bb742424.aspx#XSLTsection125121120120