All jobs / IT support / sysadmin

Active Directory interview questions

Active Directory questions a IT support / sysadmin can be asked, from first job to senior. Open one to see the strongest answer and why it works.

  1. What is an Organisational Unit in Active Directory for, and does putting a user in one give them access to anything?

    The strongest answer: An OU is a container you organise objects into so you can link Group Policy to them and delegate who may administer them; access to files and applications comes from group membership, not from which OU the account sits in

    Why it works: Exactly. OUs are for policy and delegation; groups are for access. Mixing them up is the most common AD misconception.

    • OUs are for policy and delegation.
    • Groups are what grant access.
    • Link Group Policy to an OU.
    • Never permission individual users.

  2. A share deny looks like a permissions issue. You are not sure. What do you not do?

    The strongest answer: I do not grant Full Control “to test” — I read the ACL, the group, and the ticket’s owner, then change the smallest thing

    Why it works: Exactly. Smallest change after a read. Test-grants are how shares melt.

    • Read ACL and owner first.
    • Smallest change.
    • No Everyone/Full Control tests.
    • Do not use Domain Admins as a probe.

  3. What is the difference between a locked account and a forgotten password?

    The strongest answer: Locked is usually too many tries or an admin hold; forgotten is a secret they do not have — I check which, I do not reset by reflex

    Why it works: Exactly. Two causes, two moves. Reflex reset can hide an attack or a policy hold.

    • Diagnose lock vs forgotten.
    • Do not reflex-reset.
    • Lock is not a firing.
    • Do not always do both “to be safe.”

  4. How do you grant a folder to a project of twelve?

    The strongest answer: A project group, members in and out with a ticket, folder ACLs on the group — not twelve direct names I will never remove

    Why it works: Exactly. Groups age better than names. Shared passwords and whole departments are how data walks.

    • Group, then ACL.
    • Join/leave via ticket.
    • No shared folder passwords.
    • No whole-department “safety.”

  5. A laptop’s clock is three hours off and SSO fails. What do you suspect?

    The strongest answer: Time — tickets and certificates are picky — I fix source and zone, I do not reset the user first

    Why it works: Exactly. Skewed clocks look like identity. Fix time, then retry.

    • Check time before identity theatre.
    • Fix source and time zone.
    • Do not disable SSO.
    • Do not ritual-set the clock.

  6. A firewall change pointed the office DHCP scope at the provider’s DNS servers. Domain-joined laptops now take minutes to sign in and mapped drives fail.

    What broke, and what is the rule you want written down afterwards?

    The strongest answer: Domain members have to resolve against DNS servers that hold the directory’s zones — that is how they find a domain controller to authenticate against. Point the clients back at internal DNS and let that forward everything else outward

    Why it works: Exactly. Members locate domain controllers through service records in the directory’s own zones, which a public resolver has never heard of.

    • Domain members resolve internally.
    • Controllers are found through DNS records.
    • Let internal DNS forward outward.
    • Never mix a public resolver in.

  7. How often should managers review who is in finance shares?

    The strongest answer: On a cadence you can actually run, plus joiners/movers/leavers — I do not pick a heroic weekly if they will rubber-stamp

    Why it works: Exactly. A cadence people will do, plus events. Theatre reviews are worse than a honest slower one.

    • Runnable cadence + JML events.
    • Do not design rubber stamps.
    • Trust ≠ access.
    • Do not review once in history.

  8. Three directories, three “sources of truth.” What do you standardise?

    The strongest answer: One joiners/movers/leavers throat and which system is authoritative for which fact — I do not standardise every GUI skin

    Why it works: Exactly. Authority and JML. Pretty GUIs and fourth syncs are how you get a fifth.

    • One JML throat; name authoritative facts.
    • Do not buy a GUI.
    • Do not add a fourth sync.
    • Spreadsheets are not a directory.

  9. What must joiners/movers/leavers actually do, not say?

    The strongest answer: Create, change, and cut access from one event, including SaaS and badges — a leaver who still has mail is the story you will tell badly

    Why it works: Exactly. One event, all the doors. OOO as HR is how you fail the easy case.

    • One JML event across IdP, SaaS, badges.
    • Do not learn leavers from OOO.
    • Movers lose what they left.
    • Hope is not a joiner path.