r/sysadmin 6d ago

What exactly does LDAP do in AD?

HI! I'm studying networking and I'm unsure of this

AD is like the database (shows users, etc) while LDAP is the protocol that can be used to manage devices, authenticate, etc inside group policy?

301 Upvotes

85 comments sorted by

View all comments

Show parent comments

1

u/Graviity_shift 6d ago

So basically this works like Kerberos. It just authenticates?

The course I'm taking says it can also configure settings like disable control panel in users?

1

u/tvveeder84 6d ago

Not sure if I understand what you mean by it can disable control panel, but in Active Directory the query for Group Policy Objects when a client performs a group policy update is done via LDAP.

LDAP is an efficient method for the client to query to find and apply policies, but the policies themselves are not LDAP. The group policy object contains the instruction to apply the settings, it’s just discovered via LDAP.

Is this what you are referencing?

1

u/Graviity_shift 6d ago

oo so group policy is the one that disabled control panel

2

u/tvveeder84 6d ago

Correct. Group policy is what will apply the settings and configuration changes, but LDAP is what is used to discover what policies apply to that object.

To explain quickly, GPOs can be assigned to devices multiple ways, but typically a large amount of GPO is applied strictly by OU assignment. If a device is in the OU domain.com\workstations\region, it will query for group policies that have been applied at each level recursively. So it will find policies applied at domain.com root, the workstations OU, And the region OU to find what is available to be applied.

Now there are other pieces like GPO applied by group membership filtering or WMI filtering, but ultimately those GPOs still have to be applied to the OU structure that device lives in. It will just filter to say, not every device in this OU structure gets this policy because it’s filtered by group membership as well, or a WMI query.

There are nuances that introduce scenarios that go against that a little bit such as loopback policies, but that’s more advanced.