# Physical Active Directory

The physical Active Directory is the servers and machines on-premise, these can be anything from domain controllers and storage servers to domain user machines; everything needed for an Active Directory environment besides the software.

![](https://i.imgur.com/BCX7S4c.png)

[Image Credit](https://image.shutterstock.com/image-vector/vector-set-various-cartoon-server-600w-1047593752.jpg)

Domain Controllers -

﻿A domain controller is a Windows server that has Active Directory Domain Services (AD DS) installed and has been promoted to a domain controller in the forest. Domain controllers are the center of Active Directory -- they control the rest of the domain. I will outline the tasks of a domain controller below:&#x20;

* holds the AD DS data store&#x20;
* handles authentication and authorization services&#x20;
* replicate updates from other domain controllers in the forest
* Allows admin access to manage domain resources

![](https://i.imgur.com/SgqBTx8.png)

[Image Credit](https://image.shutterstock.com/image-vector/icon-depicting-different-networks-attached-600w-1130107907.jpg)

AD DS Data Store -&#x20;

The Active Directory Data Store holds the databases and processes needed to store and manage directory information such as users, groups, and services. Below is an outline of some of the contents and characteristics of the AD DS Data Store:

* Contains the NTDS.dit - a database that contains all of the information of an Active Directory domain controller as well as password hashes for domain users
* Stored by default in %SystemRoot%\NTDS
* accessible only by the domain controller

That is everything that you need to know in terms of physical and on-premise Active Directory. Now move on to learn about the software and infrastructure behind the network.

What database does the AD DS contain?&#x20;

Where is the NTDS.dit stored?&#x20;

What type of machine can be a domain controller? <br>
