LDAP vs. Active Directory: What’s the Difference?
Understand what LDAP is, what Active Directory does, how they work together, and why LDAP is an important protocol for Windows Server administrators.
Are LDAP and Active Directory the same thing?
No. This is a common point of confusion when learning Active Directory. LDAP is a protocol used to communicate with directory services. Active Directory Domain Services (AD DS) is Microsoft’s directory service, which stores and manages information about users, computers, groups and other network objects.
1. What is LDAP?
LDAP (Lightweight Directory Access Protocol) is an open protocol used to access and manage information stored in a directory service.
A directory is a structured collection of information. It can contain details about users, groups, computers, devices, organizations and other resources.
LDAP defines how a client communicates with a directory server. It allows applications to search for entries, read their attributes and, when authorized, add, modify or delete directory information.
What can LDAP be used for?
Search directory information
Find users, groups, computers and other entries based on their attributes.
Read user attributes
Retrieve information such as usernames, email addresses, department and phone numbers.
Modify directory entries
Update attributes or other directory information when the account has sufficient permissions.
Authenticate through a bind
A client can use an LDAP Bind operation to establish an authenticated LDAP session, depending on the authentication method.
2. What is Active Directory?
Active Directory Domain Services (AD DS) is a Microsoft directory service available as a Windows Server role. It provides centralized management of identities, computers, groups and other resources in a network.
Administrators can use Active Directory to manage accounts, organize computers, control access to resources and apply centralized configuration through Group Policy.
What does Active Directory provide?
User and group management
Centralized management of user accounts, security groups and memberships.
Computer management
Manage domain-joined computers and their associated directory accounts.
Authentication and authorization
Supports domain authentication and controls access to directory objects and network resources.
Group Policy
Apply centralized configuration and security settings to users and computers.
Active Directory also includes features such as replication, the Global Catalog, DNS integration and a schema that defines the types of objects and attributes stored in the directory.
3. LDAP vs. Active Directory
| Feature | LDAP | Active Directory (AD DS) |
|---|---|---|
| What is it? | A communication protocol. | A directory service. |
| Purpose | Defines how clients access directory information. | Stores and manages directory information and identities. |
| Vendor | An open standard. | Microsoft technology. |
| Stores directory data? | No, not by itself. | Yes. |
| Can search directory entries? | Yes, through LDAP operations. | Yes, it supports LDAP queries. |
| Authentication | Supports LDAP Bind methods. | Supports Kerberos and other authentication mechanisms, and LDAP Bind for LDAP connections. |
| Group Policy | Does not provide Group Policy. | Supports Group Policy. |
| Replication | Does not define AD replication. | Provides directory replication between Domain Controllers. |
4. How does Active Directory organize information?
Active Directory stores information in a hierarchical directory structure. The objects in the directory have attributes that describe them.
For example, a user object can contain attributes such as:
- Common name (CN)
- Username (sAMAccountName)
- Email address (mail)
- Department (department)
- Display name (displayName)
Example Active Directory structure
This is a simplified example of how directory objects can be organized. The actual structure depends on how an administrator designs the Active Directory environment.
What is a Distinguished Name (DN)?
In LDAP, an entry can be identified using a Distinguished Name (DN). The DN describes the entry’s location in the directory hierarchy.
CN=John Smith,OU=Users,DC=example,DC=comBreaking this down:
| Component | Meaning |
|---|---|
CN=John Smith | Common Name: the name of the directory object. |
OU=Users | Organizational Unit containing the object. |
DC=example | Domain Component: first part of the DNS domain. |
DC=com | Domain Component: second part of the DNS domain. |
The DN is useful when searching for, identifying or modifying a particular directory object.
5. How does LDAP communicate with Active Directory?
Imagine an application that needs to find a user in an Active Directory domain. Instead of accessing the directory database directly, the application can communicate with a Domain Controller using LDAP.
- The application connects to a Domain Controller. It uses the Domain Controller’s hostname or IP address and an LDAP port.
- The application establishes an LDAP session. It can use an appropriate Bind method to authenticate, or use an anonymous connection if the directory permits it.
- The application performs a search. It specifies a search base, scope and filter to find the required directory entries.
- Active Directory processes the request. The Domain Controller checks the request and the permissions of the connection.
- The application receives the result. The response contains the requested entries and attributes that the connection is allowed to read.
Example LDAP search filter
(sAMAccountName=john.smith)This filter searches for an entry whose sAMAccountName attribute matches john.smith.
Example search base
DC=example,DC=comThe search base specifies where in the directory tree the search should begin. The search scope determines whether the query checks just that entry, its immediate children or the full subtree.
6. LDAP authentication vs. Windows domain logon
LDAP supports an operation called Bind. A client uses Bind to establish an LDAP session and, depending on the method, authenticate to the directory.
However, this does not mean that every Windows domain logon uses LDAP as its authentication protocol.
LDAP Bind
Used by an LDAP client to establish an authenticated connection to a directory service. It can use different authentication mechanisms.
Kerberos
Commonly used by Windows domain-joined clients for domain authentication and obtaining tickets to access network services.
Active Directory supports several authentication mechanisms. Kerberos is the normal choice for many Windows domain authentication scenarios, while LDAP Bind is relevant when an application or client connects to the directory using LDAP.
LDAP can also be used to query group membership, but the application must still respect the security context and permissions involved.
7. Important LDAP ports
| Port | Protocol / Service | Purpose |
|---|---|---|
| 389 | LDAP | Standard LDAP connections. TCP is commonly used for LDAP sessions; UDP is also used for connectionless LDAP operations such as DC Locator discovery. |
| 636 | LDAPS | LDAP over a TLS-protected connection, commonly called LDAPS. |
| 3268 | Global Catalog | LDAP access to the Global Catalog over a standard connection. |
| 3269 | Secure Global Catalog | LDAP access to the Global Catalog over a TLS-protected connection. |
What is LDAPS?
LDAPS is LDAP over a TLS-protected connection. It protects LDAP traffic in transit between the client and the directory server.
For a typical LDAPS connection, the Domain Controller needs a suitable server certificate. The client must also trust the certificate chain and validate the server identity.
LDAP vs. LDAPS
LDAP – Port 389
Standard LDAP connection. It does not automatically mean that the entire connection is encrypted.
LDAPS – Port 636
TLS is negotiated when the connection is established, protecting the LDAP traffic in transit.
8. Useful PowerShell commands
PowerShell provides useful commands for working with Active Directory. Many of the following examples use the ActiveDirectory module, which is commonly installed through RSAT on supported Windows systems.
Import the Active Directory module
Import-Module ActiveDirectoryFind a user account
Get-ADUser -Identity jsmithRetrieves an Active Directory user account by its identity.
Retrieve selected user attributes
Get-ADUser -Identity jsmith -Properties Department,Mail,Title |
Select-Object Name,SamAccountName,Department,Mail,TitleRetrieves additional attributes and displays selected properties.
Search for users
Get-ADUser -Filter 'Department -eq "IT"' |
Select-Object Name,SamAccountName,DepartmentReturns users whose Department attribute is set to IT.
Find a user’s Distinguished Name
Get-ADUser -Identity jsmith |
Select-Object DistinguishedNameFind the current domain information
Get-ADDomainSpecify a Domain Controller
Get-ADUser -Identity jsmith -Server dc01.example.comDirects the Active Directory cmdlet to a specific Domain Controller.
Get-ADUser is not the same as demonstrating an LDAP Bind or LDAP Search.
9. Useful tools for LDAP troubleshooting
LDP.exe
A Windows graphical utility for connecting to LDAP servers, performing Bind operations, browsing directory entries and running searches.
Active Directory Users and Computers
A graphical administration tool for managing users, groups, computers and Organizational Units.
PowerShell ActiveDirectory module
Provides cmdlets such as Get-ADUser, Get-ADGroup and Get-ADComputer for directory administration.
Wireshark
Can help inspect network traffic and identify LDAP connections, connection failures and TLS negotiation issues.
Test whether an LDAP port is reachable
Test-NetConnection dc01.example.com -Port 389For an LDAPS connectivity check:
Test-NetConnection dc01.example.com -Port 636These commands test TCP connectivity to the specified ports. They do not prove that LDAP authentication, certificate validation or a directory search will succeed.
10. Quick revision: 10 key takeaways
- LDAP stands for Lightweight Directory Access Protocol.
- LDAP is a protocol, not a directory service or database.
- Active Directory Domain Services is Microsoft’s directory service.
- Active Directory supports LDAP for accessing directory information.
- LDAP can search, read and modify directory entries when authorized.
- A Distinguished Name identifies an entry in the directory hierarchy.
- LDAP Bind establishes an LDAP session and can authenticate a client.
- Windows domain authentication commonly uses Kerberos, not LDAP as the primary logon protocol.
- LDAP commonly uses port 389; LDAPS commonly uses port 636.
- PowerShell, LDP.exe and network tools can help troubleshoot directory access.
11. Official documentation and further reading
- Active Directory Domain Services overview — Microsoft’s overview of AD DS, directory objects, the schema, Global Catalog and replication.
- About Active Directory Domain Services — An introduction to AD DS features and its support for standards such as LDAP and DNS.
- Specify a server name and port number for an Active Directory PowerShell cmdlet — Microsoft documentation about AD-related connection ports.
- Active Directory Technical Specification: Ports — Official protocol documentation for LDAP and Global Catalog ports.
- Enable LDAP over SSL (LDAPS) — Certificate requirements and testing an LDAPS connection.
- Understand security identifiers (SIDs) — Additional background on Windows security identities.
About this article
This article is an independently written learning guide about LDAP and Active Directory. ChatGPT was used as an AI-assisted drafting and formatting tool. Technical explanations were checked against the Microsoft documentation linked above.
Examples use example.com as a placeholder domain. Replace it with your own Active Directory DNS domain when testing commands. Always validate changes in an appropriate test environment before applying them in production.
Geef een reactie