Can AI agents automate Active Directory Domain Services?

Active Directory Domain Services is an on-premises Windows Server directory and must remain distinct from Microsoft Entra ID. Its hierarchical, replicated store exposes users, computers, groups, organizational units, policies, trusts, sites, services, and schema data through LDAP and Microsoft Active Directory Service Interfaces. Kerberos is the normal domain authentication path, with NTLM retained for compatible scenarios; Windows Server 2025 strengthens new deployments by requiring LDAP signing and preferring encrypted clients, while upgraded estates can preserve weaker legacy policy. The strongest agent path is Microsoft's Active Directory PowerShell module. It provides structured search and full create, read, update, and delete coverage for directory objects plus account, password, domain, forest, controller, and optional-feature administration. .NET's System.DirectoryServices supplies the official programmatic ADSI and LDAP object model. These paths are mature but operationally constrained to domain connectivity, Windows or RSAT tooling, functional-level differences, and high-value credentials. Changes can replicate forest-wide and privileged identities belong to the highest trust tier, so read-only discovery, delegated administration, signed or TLS-protected LDAP, staged changes, and recoverable backups are essential. An AD DS-specific first-party MCP server, webhook surface, and repeatable computer-use result were not established.

Best path today: cli · Overall automatability: 8/10