Quiz Entry - updated: 2026.10.22
How do Active Directory, LDAP and Kerberos fit together in a Windows domain?
Active Directory is the directory service (the database of users, groups and computers); LDAP is the protocol used to query and change it, and Kerberos is the protocol used to authenticate against it.
A common confusion is to treat "LDAP" and "Active Directory" as synonyms. They sit on different layers:
| Thing | What it is | Role in the domain |
|---|---|---|
| Active Directory (AD DS) | A directory service product from Microsoft | Stores accounts, groups, computers, policies; runs on the domain controllers |
| LDAP | A network protocol | Read and modify the directory: look up a user, list group members, add an account |
| Kerberos | A network authentication protocol | Log users in once and give them tickets for file servers, printers, intranet apps |
| DNS | Name resolution | Lets clients find the domain controllers |
Every domain controller is at the same time an LDAP server and a Kerberos Key Distribution Center (KDC). The KDC takes the users' long-term keys from the same directory that LDAP exposes. OpenLDAP is the open-source counterpart for the directory part; on Linux it is often combined with MIT Kerberos for the same split.
Go deeper:
Microsoft Learn: Active Directory Domain Services overview — what AD DS stores and the services it provides.- Active Directory (Wikipedia) — notes that AD uses LDAP versions 2 and 3, Microsoft's version of Kerberos, and DNS.