“Knowing Active Directory” could mean resetting passwords, managing permissions, or designing a directory environment. The phrase alone doesn't establish the scope.
Use a small access scenario to show what you actually understand. Explain the account, resource, permission path, and investigation before proposing a change.
That is more useful interview preparation than memorizing obscure trivia. It lets you distinguish tasks you've performed from architecture you've only studied, while showing how you reason when a familiar Windows problem doesn't behave as expected.
Establish the account and resource before proposing a fix
Start with a fictional employee who cannot open a departmental file share. Clarify four things:
- Account: Which identity is the person using?
- Account type: Is it a domain account or a local account?
- Resource: Which system hosts the share or file?
- Requirement: What access should the person have, and why?
The answers establish the scope of the investigation. Don't assume every Windows access issue belongs in the same directory-management screen.
Microsoft's security principals reference provides background for identifying the relevant identities.
In an interview, connect that concept to the example rather than stopping at a definition. Explain what you would inspect next, which evidence would matter, and what you still don't know. A well-scoped question is more useful than a confident but unsupported password reset.
Ask how the permission reaches the user
Next, ask which group or assignment is supposed to provide access and who approved it.
The candidate should distinguish an organizational unit from a security group and explain the actual permission path rather than treating every container as an access boundary.
Then ask what else could grant access. Nested membership or another assignment may matter in a particular environment.
The goal is not an exhaustive lecture. It is a clear explanation of why the candidate believes this user should receive this permission on this resource.
Ask what they would check before changing membership
A good investigation should verify the user, resource, error, and expected behavior. It should also consider whether the problem is reaching the system, authenticating, or being authorized.
Adding broad permissions before identifying the failure can make the symptom disappear while creating a different problem.
Ask the candidate to name one piece of evidence that would support the next action. If they cannot, the proposed fix may be guesswork.
They should also explain which changes require approval and when they would escalate rather than experiment.
Ask about a directory dependency they have diagnosed
A client that cannot join a domain offers another useful discussion.
Can the candidate explain why the correct DNS path matters? Can they read the error and identify the appropriate troubleshooting reference instead of immediately rejoining, rebuilding, or disabling a firewall?
Microsoft's domain-join guidance provides a structured starting point.
For a portfolio exercise, using a small Windows lab to expose gaps in your understanding is more productive than memorizing a list of interview questions without testing the ideas.
I would also ask how they verified a change after making it. A successful administrator action is not the same as a successful user outcome. The answer should include the relevant test account, resource, and expected behavior rather than only a completed ticket.
Ask them to state what they have not done
Someone may have strong account-management experience but no responsibility for replication, architecture, or disaster recovery. That is not a reason to erase the experience they do have.
It is a reason to describe the boundary accurately.
A candidate who can distinguish their own work from the team's broader responsibilities gives the interviewer a more reliable picture of how much support they would need.
You can prepare for these conversations by building one bounded scenario and practicing the explanation. The directory project and positioning guidance in The Six-Figure IAM Career Playbook are designed to connect those two activities. The book is $9.
“Know AD” is a claim. A clear account of the identity, permission, evidence, and limitation shows what the claim actually means.