Active Directory and Windows Server 90+ Hour with Labs

Explore domain controllers and the global catalog, noting how DNS and SRV records affect sign-in, and the roles of read-only controllers and operations masters.

Define a domain controller and its ADDS directory database (ntds.dit) and the sysvol folder, explain multi-master replication, and discuss high-availability options like two domain controllers, ROADC, and BitLocker.

Assess the role of a domain controller in Active Directory, covering authentication, multi-master replication, read-only domain controllers, BitLocker protection, and Group Policy template storage in SYSVOL.

Demonstrates viewing a domain controller in LearnedLessons.com and LitDC1, explains why two domain controllers are essential for production, and shows NTDS.did, sysvol, and ADDS replication.

The global catalog is a partial, read-only, searchable copy of forest objects that uses a subset of attributes, such as given name, display name, and mail, for cross-domain searches.

Discover how the global catalog in Active Directory provides a partial read-only copy of forest objects to speed cross-domain queries and support universal group membership checks.

Discover the global catalog, a specialized domain controller with a partial replica of every object. It speeds logons and forest-wide searches, and balances deployment to manage replication traffic.

Examine how domain controllers register srv records in dns and how clients locate the nearest dc via srv lookups, including site-aware searches and netlogon re-registration.

View and interpret domain controller SRV records with DNS manager, exploring __sites, __tcp, __udp, and __msdcs, and LDAP services including port 88 and netlogon DNS re-registration.

Explore how a domain-joined computer authenticates a user through a domain controller via dns lookup, issues an access token with sids, and uses tickets for network logon and resource access.

Explore the Active Directory sign-in process, including DNS lookup to locate a domain controller and LSA-generated access tokens. Understand how Kerberos tickets, TGT, enable requesting service tickets for resource access.

Demonstrates the AD DS sign-in process by retrieving seed information for users, computers, and domains in Active Directory with Windows PowerShell commands like get id computer and get id forest.

Explore how operations masters, the five flexible single master roles, govern key ADDS tasks across forests and domains, including schema, domain naming, read, infrastructure, and PDC emulator.

Discover how Active Directory fsmo roles govern domain operations, including the RID master, infrastructure master, schema master, and the PDC emulator, with knowledge checks and role identification commands.

Learn how to transfer FISMA roles between domain controllers using gui ad ds snap-ins or powershell, and when to seize roles with ntdsutil.exe as a last resort.

Explore how to transfer and seize FSMO roles in an Active Directory environment, plan transfers, and recognize seizures as a last-resort measure, including the PowerShell force parameter.

Deploy a domain controller via cloning in virtualized environments like Hyper-V, addressing rollback and VMGenerationID, plus Azure considerations. Install and upgrade domain controllers with GUI or server core.

Install first domain controller in a new forest using server manager, add AD DS features, promote to domain controller, name adatum.com, enable the global catalog, and prepare a PowerShell script.

Demonstrates installing the Active Directory Domain Services role and promoting a domain controller in Windows Server 2022 via Server Manager, with a fast lab setup.

Install a first domain controller in a new forest with server manager, configure root domain, forest and domain functional levels, and dns with the global catalog.

Install and configure a domain controller on a server core installation using remote Server Manager or Windows PowerShell, deploying ADDS and managing modules in Windows Server 2016 and later.

Observe a hands-on demo of installing Active Directory Domain Services on Windows Server Core and promoting the core server to the first domain controller in the demo-learned-lessons.com forest.

Install a domain controller from media to reduce wide area network traffic by creating an Active Directory Domain Services snapshot with ntdsutil and promoting the server via Server Manager.

Clone domain controllers to rapidly deploy identical configurations in private clouds via computer provisioning. Run Hyper-V on Windows Server 2012 or later with a PDC emulator online during first cloning.

Prepare a source domain controller for cloning, export the source VM, and import and start the cloned domain controller, including verification of app lists and renaming to LoneDC3.

Implement domain controller virtualization with redundancy and diversification across hardware, hosts, and data centers, ensure time synchronization and virtual machine generation identifiers, and batch clone with safeguards instead of checkpoints.

Add another domain controller to the Contoso domain by installing Active Directory Domain Services and DNS via Server Manager, then promote it using labdc1.contoso.com as the replication partner.

Learn to install the Active Directory Domain Services role, use the ADDS Deployment module to promote a server to a domain controller, and verify prerequisites with test commands.

Manage the five FSMO roles—schema master, domain naming master, RID master, PDC emulator, and infrastructure master—and learn how to transfer or seize them across domain controllers.

learn how to install windows server 2022, from boot media and bios settings to selecting core versus desktop installation, partitioning, and post-install configurations like administrator password and server manager.

Upgrade Windows Server 2019 to 2022 by applying updates, then using installation media for the in-place upgrade. Keep files, select desktop experience, accept the license, and reboot to complete.

rename the server and join it to a domain using server manager or the sysadmin tool, then enable remote desktop and configure essential network and security settings.

Learn post-installation tasks for Windows Server, including renaming the computer, joining a domain, enabling remote desktop, and configuring DNS and network settings for remote access.

Set up a base image using Sysprep by capturing post-installation changes, firewall, time and language, disabled media player, updates, and git, for rapid deployment of new Windows servers.

This recap walks through a hands-on exercise with a Windows 2022 VM, using git clone to follow along, and reviews activation, management, drivers, network settings, and boot repair commands.

Deploy domain controllers in a vlab Active Directory domain using Windows Server 2022 and PowerShell, and promote a server to a domain controller with AD DS and DNS.

Join a Windows client to the domain, configure DNS to the domain controller, sign in with a domain administrator account, install RSAT and Windows Admin Center, promote Active Directory.

Add a child domain to the lab using PowerShell, install domain services on dc two, configure lab one, and manage via Windows Administration Center with PowerShell one-liners.

Recap the base lab SOP by building a Windows Server lab with PowerShell and Hyper-V, creating base images, VHDs, multiple VMs, domain controllers, and client setup, with checkpoints.

Demonstrate provisioning a core server, adding a domain controller with Windows Admin Center, and creating a new child domain via a PowerShell one-liner, including DNS configuration and automated reboot.

Master AD DS administration with the Active Directory Administrative Center and MMC snap-ins, manage domain controllers, connect to multiple domains, and perform PowerShell-based AD tasks.

Learn to manage Active Directory user accounts, including roaming profiles on a network share, and use templates, attributes, and profile management to handle active, inactive, and disabled accounts.

Create and manage unique user accounts in ADDS to authenticate to the domain, assign permissions, and access resources, using UPN suffixes, naming conventions, and tools like dsadd and PowerShell.

Explore how Active Directory Domain Services uses user accounts to authenticate users and grant access to resources. Learn about unique user principal names and naming practices across the forest.

Configure a user account in Active Directory Domain Services, including logon hours, allowed computers, expiration, password policies, and delegation. Use ADAC, ADUC, PowerShell, or DSMOD to manage these attributes.

Explore configuring and managing user account attributes in active directory, including log on hours, password settings (next logon, expiration, reversible encryption), delegation, group memberships, and account expiration for temporary users.

Configure roaming and local user profiles in Active Directory, including profile paths, home folders, and logon scripts. Manage profiles with Group Policy and folder redirection.

Demonstrates creating user profiles, configuring profile paths and roaming profiles, setting logon scripts, mapping drives, and guiding folder redirection via group policy in Active Directory.

Learn how to configure user profiles and folder redirection using Active Directory and Group Policy, covering roaming profiles, profile paths, home folders, and drive mappings.

Demonstrate managing users in Active Directory using the Active Directory Administrative Center, including create, delete, and move operations, and adjust attributes, department, and group memberships within OUs and groups.

Demonstrates enabling and disabling user accounts in Active Directory, and creating templates to rapidly provision new users with common attributes like group memberships, home directories, and logon scripts.

Explore managing user accounts in Active Directory using templates to simplify creation, learn when to disable versus delete, and verify copied attributes, naming conventions, and group memberships.

Create, modify, and delete user accounts with Windows PowerShell cmdlets such as NewADUser and RemoveADUser. Set passwords, expiration, and home directory with AccountPassword, AccountExpirationDate, and secure string prompts.

Master Active Directory user and computer management with PowerShell, creating and modifying accounts using New-ADUser, securing passwords as secure strings, and retrieving attributes with Get-ADUser for production-ready automation.

Test your understanding of managing Active Directory users with PowerShell, covering creating users, password handling, OU placement, retrieving all properties, and enabling accounts.

Use Windows PowerShell to create bulk Active Directory users from a CSV. Populate core attributes (display name, given name, surname, samAccountName, userPrincipalName, password) and add email and phone details.

Automate bulk user creation in Active Directory with PowerShell by iterating CSV data using foreach and import-csv, populating attributes like display name and email, and validating with the pass-through parameter.

Learn to modify Active Directory user properties with PowerShell, including bulk updates, by using Get-ADUser and Set-ADUser, and update attributes like description across OUs.

Learn to view and modify Active Directory user attributes with Windows PowerShell, retrieve all attributes using Get-ADUser -Properties *, and update descriptions with Set-ADUser, including determining data types with Get-Type.

Use Windows PowerShell to duplicate an administrator's security group membership by listing the admin's groups with get-aduser and adding a user with add-adgroupmember to each group.

Update office, home, and mobile phone numbers for multiple Active Directory users with Windows PowerShell. Use Get-ADUser and Set-ADUser with add or replace, and import CSV for looping updates.

Learn to enable and disable Active Directory accounts with Get-ADUser and Enable-ADAccount, and move users between OUs using Move-ADObject in PowerShell.

Master bulk enabling and disabling of Active Directory users and moving objects with PowerShell, using Get-Content and the foreach-object alias for pipelines.

Delete user accounts in Active Directory using Windows PowerShell with remove-ad-user and remove-ad-object. Pass identity by DN, GUID, SID, or SAM name, and delete accounts from text file with Get-Content.

Explore how domain controllers authenticate users and computers, plan global catalog placement to optimize sign-in times and availability, and understand the role of DNS and SRV records.

Explore two Windows server group types: security and distribution, and learn how group scope and type affect permissions, email distribution, and access tokens, with conversion rules and practical implications.

Explore how to create and manage groups in Active Directory, comparing security and distribution groups, converting between types, enabling protection from accidental deletion, and using PowerShell to view group attributes.

Explore the four group scopes local, domain-local, global, and universal, and learn how each governs permissions and membership across domain resources in Windows Server.

Explore group scopes—domain local, global, and universal—and create a domain local security group, add members, and grant access to domain resources, including joining Windows 11 client and configuring DNS.

Test your knowledge of Active Directory group types and scopes, comparing security versus distribution groups, and exploring local, global, and universal scopes and their permissions implications.

Implement group nesting with IGDLA and IGUDLA to grant read access across domains by assigning users to role groups, creating a resource access management rule group, and applying domain-local permissions.

Demonstrate Active Directory group management using IGDLA, creating user accounts and groups. Configure access to shared resources and manage AD remotely with Windows Admin Center.

Explore group nest strategies including the DLA and Igla model, and test your knowledge of group types, nest, and role-based access management.

Use restricted groups in a domain-level GPO to manage local and ADDS group memberships on domain-joined computers, enforce nesting, remove non-designated members, and preserve the Local Default Administrator account.

Use restricted groups in group policy to grant local administrators on domain-joined Windows 11 machines. Create an OU, link a GPO, add win11 power users, and run gpupdate.

Explore default local and domain groups such as Enterprise Admins, Schema Admins, Administrators, Domain Admins, Server Operators, Account Operators, Backup Operators, Print Operators, and Third Publishers, noting their protected status.

Explore how account operators and delegated controls shape who can create, move, or delete Active Directory objects, and how to limit actions to specific OUs with delegation in ADUC.

Explore default and protected groups in Active Directory and Windows Server, including Enterprise Admins, Schema Admins, and Domain Admins, and learn best practices for managing permissions, ACLs, and administrative privileges.

Explore special identities in Windows Server, including anonymous logon, authenticated users, everyone, interactive, network, and creator-owner, to grant permissions by connection type rather than accounts.

Create an IT managers group in Active Directory, add members, and modify its type and scope, then assign a group manager using the Active Directory Administrative Center.

Demonstrate checking george's group membership and adding domain admins using the active directory administrative center, member of, and powershell commands like get-ad-principal-group-membership, while documenting changes across domains.

Learn to manage computer objects in active directory, join computers to a domain, prevent trust issues from password mismatches, and configure properties, OUs, and secure channels, including offline domain join.

Explore how Active Directory stores computer objects, from the default computers container to custom OUs for servers and clients. Learn to design OU structures and apply GPOs to manage them.

This lecture reinforces that the computer's container is the default location for computer accounts, outlines its limitations, and recommends using custom OUs and views to organize servers and clients.

Learn how to create computer objects in the correct OU and meet domain join requirements. Manage machine quotas and delegate computer account permissions using the Delegation of Control Wizard.

Join or leave a domain from the client computer via the Computer Name tab in Advanced System Settings, using domain credentials with proper permissions, and restart after changes.

Learn to manage computer objects in an Active Directory domain by delegating control, creating and moving organizational units, and joining or renaming computers with PowerShell.

reset the computer account secure channel to restore domain authentication after password or trust failures. use aduc/adac, dsmod, netdom, nltest, or PowerShell to reset.

Reset the computer account's secure channel, troubleshoot a failed domain trust, and repair the channel with credentials using test-computer-secure-channel-repair to restore domain logins.

Explore how Active Directory domain members store credentials in LSA secrets, manage computer account passwords, and use netdom, dsmod, nltest, and PowerShell commands to repair or reset the secure channel.

Use offline domain join to add a computer to a domain without contacting an online domain controller. Provision and transfer the domain join file with DJoin for offline deployment.

Create and configure AD DS groups and users for a branch office, enable group nesting and convert groups to security, then repair computer trust and reset accounts for domain authentication.

Demonstrate end-to-end active directory management, including creating and nesting groups, converting distribution to security groups, configuring user templates, and resetting computer accounts to repair secure channels.

Explore implementing and managing Organizational Units (OUs) in Active Directory and Windows Server, including planning OU structures and using the delegation of control wizard to assign task-based permissions.

Design effective Active Directory organizational units to delegate rights, apply group policies, and organize domain objects through location-based, resource-based, organization-based, multi-tenancy, and hybrid strategies.

Explore planning OUs in Active Directory using location-based, resource-based, organization-based, multi-tenant, and hybrid strategies, reinforced by knowledge checks on design choices and administrative delegation.

Plan OU design for administrative purposes, aligning with the tasks delegation model and GPOs, not the organizational chart, and design for inheritance and change, reflecting department-specific GPOs at lower levels.

Always create new OUs with administrative tools, using graphical tools or PowerShell, since copying OUs isn't supported. Enable Protect OUs from Accidental Deletion to prevent unintended deletions or moves.

Explore OU design for Active Directory, covering admin delegation, GPO application, inheritance, and change management while creating, moving, and protecting OUs using ADUC, ADAC, and PowerShell.

Learn to design the Active Directory Administrative Delegation model by merging OU design with OU permissions, empowering delegated administrators and understanding security descriptors, ACLs, and inheritance.

Delegate Active Directory permissions using object-type and role-based approaches, assigning rights to groups and using the Delegation of Control Wizard to set tasks.

Explore tokens, security descriptors, and delegation methods in Active Directory, and learn how role-based delegation and the Delegation of Control Wizard simplify assigning administrative rights.

Use Windows PowerShell to automate Active Directory Domain Services administration, performing and describing bulk operations on groups, computer accounts, and OUs with cmdlets and CSV files.

Master Windows PowerShell group management with create, modify, and delete cmdlets like new id group, set id group, and remove id group, plus add or remove group members.

Learn to manage Active Directory groups and memberships with PowerShell cmdlets, creating domain-local, global, and universal security groups, searching and modifying group information, and handling group membership operations.

PowerShell teaches adding members to security groups in Active Directory with add-adgroupmember and get-adgroupmember, including single, multiple, file-based, and OU-based additions, plus copying memberships and verifying results in the GUI.

Use PowerShell to add computer accounts to security groups with Get-ADComputer and Add-ADGroupMember, noting SAM account names end with a dollar and filtering by test or prod.

Master PowerShell for managing Active Directory security groups by nesting groups, handling scope rules, and bulk creating and assigning group memberships with New-ADGroup and Add-ADGroupMember.

List and verify security group members with get-adgroupmember (including recursive checks), inspect object class, export to csv, and remove members with remove-adgroupmember for single or bulk updates in PowerShell.

Learn to manage computers and OUs in Active Directory with Windows PowerShell cmdlets, creating and updating computer accounts, verifying trust, resetting passwords, and handling OUs with New-ADOrganizationalUnit and related cmdlets.

Use PowerShell to manage Active Directory computer objects by creating, modifying, enabling or disabling, and moving accounts. Explore prestaging, OU placement, and practical examples with new-ad-computer, set-ad-computer, and move-ad-object.

Enable or disable computer accounts in active directory with get-adcomputer piped to enable-adaccount or disable-adaccount, and delete stale or offline objects with remove-adcomputer using last-logon-date filters.

Master the basics of PowerShell, including pipelines, aliases, and object-based commands, navigate directories, use get-command and get-help, and leverage variables and the integrated scripting environment for scripting.