Deploy and manage Active Directory Domain Services in on-premises and cloud environments
Know the scope of every object
AZ-800 AD DS questions reward knowing scope. The forest is the security boundary and holds the Schema Master and Domain Naming Master. Each domain holds its own PDC Emulator, RID Master, and Infrastructure Master. The PDC Emulator is the time source for its domain (the forest root PDC Emulator syncs to an external NTP source), the final authority for password changes and account lockouts, and the default target when editing GPOs. Infrastructure Master maintains cross-domain references and matters only when not every DC is a global catalog.
Replication and sites
Intra-site replication uses change notification, so partners pull changes within seconds. Inter-site replication follows site link cost, schedule, and interval, which defaults to 180 minutes unless you enable inter-site change notification. Map every subnet to a site, or clients may pick a distant domain controller. A site without a global catalog can enable universal group membership caching.
Hybrid identity
Microsoft Entra Connect should run on a member server, not a domain controller, and offers password hash synchronization, pass-through authentication, or federation. Microsoft Entra Domain Services is a managed domain: no domain admin rights, one-way sync from Entra ID, and no schema extensions.
Traps
RODCs cannot hold FSMO roles and filter credentials through a password replication policy. The AD Recycle Bin cannot be disabled once enabled. A group Managed Service Account requires one KDS root key per forest. Universal group membership resolution needs a global catalog (port 3268).
Rule of thumb
When asked where something is configured: forest means Schema Master or Domain Naming Master; domain means PDC Emulator, RID Master, or Infrastructure Master; site means replication schedule and DC placement.
Worked example: a branch office on a slow WAN link gets its own site, its subnets mapped to it, an RODC, and a site link with higher cost and an overnight schedule. If users see stale data during the day, enable inter-site change notification rather than shortening the interval.