{
 "categories": [
  "identity",
  "enterprise",
  "rpa"
 ],
 "deployment": "on-prem",
 "evidence": [
  {
   "date": "2026-08-16",
   "fact": "homepage",
   "note": "Microsoft defines AD DS as a hierarchical, replicated directory for network identities, computers, services, shared resources, authentication, access control, policy, schema, and search.",
   "source": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "platforms",
   "note": "AD DS is installed as a Windows Server role and administered locally or through Windows Remote Server Administration Tools.",
   "source": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-active-directory-domain-services--level-100-",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "license",
   "note": "AD DS ships with commercially licensed Windows Server editions under core, CAL, OEM, volume, service-provider, retail, or pay-as-you-go channels.",
   "source": "https://www.microsoft.com/licensing/guidance/Windows-Server-2025",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.api.exists",
   "note": "Microsoft documents programmatic Active Directory access through LDAP and Active Directory Service Interfaces.",
   "source": "https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.api.kinds[0]",
   "note": "AD DS domain controllers expose LDAP on port 389 and LDAP over SSL or TLS on port 636, with signing and channel-binding policy.",
   "source": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/ldap-signing",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.api.kinds[1]",
   "note": "ADSI is Microsoft's unified programmatic interface for applications that administer AD DS and other directory providers.",
   "source": "https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.api.auth[0]",
   "note": "AD DS supplies the account database and domain controller KDC for default Kerberos authentication in a domain or forest.",
   "source": "https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.api.auth[1]",
   "note": "LDAP SASL negotiation supports NTLM as a compatibility authentication protocol, with signing and channel binding required to reduce relay and interception risk.",
   "source": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/ldap-signing",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.api.coverage",
   "note": "LDAP and ADSI expose the indexed directory, schema, global catalog, identity and computer objects, shared resources, access controls, and replicated domain data.",
   "source": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.sdk",
   "note": "Microsoft's .NET System.DirectoryServices namespace supplies managed classes for ADSI, LDAP searching, directory entries, and account administration.",
   "source": "https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.sdk.languages",
   "note": "System.DirectoryServices is a current .NET API with C# reference and examples for Active Directory access.",
   "source": "https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.cli.exists",
   "note": "Microsoft's Active Directory PowerShell module is a command-line interface for AD DS and AD LDS administration.",
   "source": "https://learn.microsoft.com/en-us/powershell/module/activedirectory/about/about_activedirectory",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.extensibility.scripting",
   "note": "Administrators can automate AD DS through PowerShell cmdlets and its directory provider, or build LDAP and ADSI applications.",
   "source": "https://learn.microsoft.com/en-us/powershell/module/activedirectory/about/about_activedirectory",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.data_access.export",
   "note": "PowerShell filters, identity parameters, providers, and LDAP searches retrieve directory objects as structured entries and .NET-backed objects.",
   "source": "https://learn.microsoft.com/en-us/powershell/module/activedirectory/about/about_activedirectory",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "modalities.data_access.import",
   "note": "The module and directory interfaces create, modify, move, enable, disable, and remove authorized AD DS objects and configuration.",
   "source": "https://learn.microsoft.com/en-us/powershell/module/activedirectory/about/about_activedirectory",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "verdict.scores.api",
   "note": "LDAP and ADSI are mature, complete directory interfaces with strong query and administration coverage, but on-premises reachability, legacy compatibility, protocol hardening, and forest-wide consequences add operational load.",
   "source": "https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "verdict.scores.cli",
   "note": "The official module has structured filters and broad CRUD, account, password-policy, domain, forest, controller, and feature coverage, constrained by Windows tooling, domain access, and privileged change risk.",
   "source": "https://learn.microsoft.com/en-us/powershell/module/activedirectory/about/about_activedirectory",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current Windows Server 2025 LDAP signing, TLS, channel-binding, compatibility, and rollout guide.",
   "source": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/ldap-signing",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current Active Directory PowerShell coverage and provider overview.",
   "source": "https://learn.microsoft.com/en-us/powershell/module/activedirectory/about/about_activedirectory",
   "tier": "declared"
  },
  {
   "date": "2026-08-16",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current domain-controller and functional-level compatibility reference.",
   "source": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-08-16",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/ldap-signing"
   },
   {
    "type": "docs",
    "url": "https://learn.microsoft.com/en-us/powershell/module/activedirectory/about/about_activedirectory"
   },
   {
    "type": "docs",
    "url": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels"
   }
  ]
 },
 "homepage": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/",
 "id": "active-directory-ds",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": "unknown"
  },
  "api": {
   "auth": [
    "kerberos",
    "ntlm"
   ],
   "coverage": "full",
   "docs": "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview",
   "exists": true,
   "kinds": [
    "ldap",
    "adsi"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "ldap-entries",
    "powershell-objects"
   ],
   "import": [
    "ldap-entries",
    "powershell-objects"
   ]
  },
  "extensibility": {
   "scripting": [
    "active-directory-powershell",
    "ldap",
    "adsi"
   ],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": "unknown",
   "third_party": [],
   "verdict": "unknown"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. The Active Directory PowerShell module, LDAP, and ADSI provide supported object and forest administration without GUI control.",
   "ui_stack": [
    "windows-native"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": true,
   "languages": [
    "csharp"
   ],
   "official": true
  }
 },
 "name": "Active Directory Domain Services",
 "platforms": [
  "windows"
 ],
 "related": {
  "alternatives": [
   "microsoft-entra-id",
   "freeipa",
   "openldap"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Microsoft",
 "verdict": {
  "best_path": "cli",
  "scores": {
   "api": 8,
   "cli": 8,
   "computer_use": null,
   "integrations": null,
   "mcp": null,
   "overall": 8,
   "rpa": null
  },
  "summary": "Active Directory Domain Services is an on-premises Windows Server directory and must remain distinct from Microsoft Entra ID. Its hierarchical, replicated store exposes users, computers, groups, organizational units, policies, trusts, sites, services, and schema data through LDAP and Microsoft Active Directory Service Interfaces. Kerberos is the normal domain authentication path, with NTLM retained for compatible scenarios; Windows Server 2025 strengthens new deployments by requiring LDAP signing and preferring encrypted clients, while upgraded estates can preserve weaker legacy policy. The strongest agent path is Microsoft's Active Directory PowerShell module. It provides structured search and full create, read, update, and delete coverage for directory objects plus account, password, domain, forest, controller, and optional-feature administration. .NET's System.DirectoryServices supplies the official programmatic ADSI and LDAP object model. These paths are mature but operationally constrained to domain connectivity, Windows or RSAT tooling, functional-level differences, and high-value credentials. Changes can replicate forest-wide and privileged identities belong to the highest trust tier, so read-only discovery, delegated administration, signed or TLS-protected LDAP, staged changes, and recoverable backups are essential. An AD DS-specific first-party MCP server, webhook surface, and repeatable computer-use result were not established.\n"
 }
}