What does Active Directory primarily control in an organization?

Active Directory (AD) serves as a centralized directory service that primarily manages and controls security policies and access rights within an organization. It allows administrators to define who has access to specific resources and data, ensuring that individuals only access what they are authorized to. This role involves the management of user accounts, groups, and computers, enabling the enforcement of security policies such as password policies, account lockout policies, and authentication mechanisms.

As a part of its functionality, Active Directory helps in creating and managing organizational units, enforcing Group Policy settings, and providing identity management. This comprehensive control facilitates a secure IT environment where sensitive information is protected by ensuring that only the right users have access to the right resources at the right time.

In contrast, the other choices involve aspects that are not the primary functions of Active Directory. Network performance is typically managed by network management tools and systems, user interface design is related to how applications and operating systems present information to users, and device management encompasses managing physical devices in an organization's infrastructure, which may involve tools outside of the scope of Active Directory.