One employee.
Two identity planes.

Follow the trust boundary.

Every modern Windows support ticket becomes easier once you know which system owns the identity, the policy and the resource.

AD DS and Entra ID work together—but they aren't the same directory.

Traditional Active Directory Domain Services (AD DS) manages Windows domain identities, machine accounts, GPO and Kerberos services. Microsoft Entra ID is a cloud directory and identity platform for modern apps. Hybrid identity connects selected objects across them; it doesn't merge their protocols into one authentication service.

Connect Sync, Cloud Sync and the limits of a sync cycle.

Northstar's fictional environment uses Microsoft Entra Connect Sync to synchronize selected AD identities. Microsoft Entra Cloud Sync offers a separate, cloud-managed architecture with on-premises provisioning agents. Both can provision objects and synchronize passwords in supported scenarios, but their feature coverage, topologies and migration requirements differ. Compare the current Microsoft decision guide before choosing or migrating.

For Jordan Reyes, an existing on-premises user in OU=Operations-Archive, the approved synchronization selection excludes that OU. The AD account can be healthy and still never appear in Entra. The right action is to understand source, scope and logs first—not assign licenses or reset a password in an unrelated cloud identity.

What actually validates a cloud password?

The synchronized object is an identity representation. The organization's configured authentication method determines how a password-based Entra sign-in is validated. It is independent from how a normal Windows Kerberos service ticket is issued for an on-premises file server.

Same employee. Different request paths.

Choose a workflow below to trace directory synchronization, cloud sign-in, domain file access, or a Windows Hello for Business hybrid trust scenario. Notice where the path depends on a synchronized object, an authentication service or direct domain-controller connectivity.

DNS, time and Kerberos turn a UNC path into a working file share.

Northstar's older workstation OPS-LT022 is joined to AD DS and hybrid joined with Entra. When the user connects to a protected SMB share on FS01, Windows may need to discover a domain controller, acquire an appropriate Kerberos ticket-granting ticket and service ticket, and present that ticket to the file server. Share and NTFS permissions still decide authorization.

AD-aware DNS is essential. A public DNS resolver generally won't have Northstar's private AD domain SRV records. And Kerberos tickets rely on time: the default Windows Kerberos clock-skew tolerance is commonly five minutes. We deliberately model both an incorrect resolver and nine-minute skew in Practice 011. Fixing one without checking the other won't restore the workflow.

Service principal names (SPNs), DNS resolution, network reachability and account rights also matter. A valid ticket doesn't make someone a file-share owner. Avoid deleting ticket caches, changing SPNs, or modifying domain time settings without evidence and authorization.

Cloud Kerberos trust is a bridge—not a replacement for Active Directory.

Windows Hello for Business (WHfB) can use device-bound credentials for sign-in. For hybrid organizations, Microsoft's current deployment guidance describes cloud Kerberos trust, key trust and certificate trust. Which model fits depends on prerequisites and the need for certificates.

Cloud Kerberos trust requires a supported Windows/domain environment, the Microsoft Entra Kerberos setup, configured WHfB policy, and domain controller line of sight for on-premises protected resources. A client may sign into Windows but still be unable to reach an internal file server when off the corporate network. Cloud Kerberos trust is not an unconditional offline replacement for an on-premises KDC.

Intune manages one plane; Group Policy can still control another.

Group Policy uses AD DS structure, linked/scoped GPOs, SYSVOL contents and client processing. Intune deploys cloud-managed policies to enrolled devices. On a hybrid-managed device, both can exist; their targeting and policy conflicts must be evaluated rather than assuming one silently replaces the other.

Northstar has an authorized GPO that maps an OPS file share. The setting won't apply if the client can't locate a domain controller, read SYSVOL, authenticate correctly, or match the GPO's link/security filtering. Start with gpresult and the Group Policy operational log. A blind gpupdate /force doesn't repair DNS or time.

Ask the right question before you change a setting.

These commands help observe what Windows, AD DS and synchronization tools report. Most are read-only; availability, permissions and output context depend on the endpoint and installed modules.

Verify the design before implementing it.

Northstar Services and all hostnames are fictional. The simulator models dependencies—not real directory, password, ticket or policy processing. Consult current Microsoft documentation and your organization's approved change controls.