A municipal Windows server fleet must domain-join to a managed directory so file shares and line-of-business apps can use Active Directory identities with least-privilege admin groups. Which AWS service should anchor that design?
Select an answer to reveal the explanation.
Short Explanation
Windows boxes that need a real domain are like squad cars that need the city radio network—Directory Service (Managed Microsoft AD) is that network. Macie, Kinesis, and WAF are great tools, just not your domain controller.
Full Explanation
A municipal Windows fleet that must domain-join for file shares and line-of-business apps needs a real Active Directory control plane. AWS Directory Service—commonly AWS Managed Microsoft AD—anchors that design: instances join the managed domain, Kerberos/NTLM authentication works as operators expect, and least-privilege admin groups can be modeled with AD group membership instead of local administrator sprawl. Managed Microsoft AD also integrates with AWS resources and on-premises trusts when the county hybrid pattern requires it, staying within Associate-level identity services.
Amazon Macie as a "domain controller" fails by service purpose—Macie classifies sensitive data in S3 and does not issue Kerberos tickets or manage Windows SIDs. Amazon Kinesis Data Streams replicating SAM databases in plaintext fails identity architecture and confidentiality; streams are not directory replicas. AWS WAF managed rules fail as a Kerberos substitute: WAF filters HTTP(S) at edges and cannot domain-join servers or authorize SMB/LDAP style access.
Exam caveat: Directory Service solves domain identity; you still harden join permissions, limit Domain Admins, and place directory controllers/endpoints in appropriate private subnets with SG restrictions. Operational check: domain-join a pilot Windows instance using the managed directory, authenticate a least-privilege user to a share, confirm local admin is not required for routine app access, and verify unauthorized users cannot elevate via nested group mistakes.