Active Directory and Windows Server 118+ Hours with Labs

Explore active directory domain services components, including the ntds.dit database and schema partition, and learn to check the schema version using PowerShell, dsquery, ldp, and ADSI Edit.

Explore Active Directory forest, domains, sites, and organizational units using Get-ADForest and Get-AD OrganizationalUnit, and learn about functional levels, the global catalog role, and advanced features.

Explore the Active Directory Administrative Center to administer AD DS, reset passwords, create computer objects, view attributes with the attribute editor, and review PowerShell history.

Test your understanding of an AD DS forest, including forest root domain, the schema master, domain naming master, and the global catalog's role in fast searches.

Explore organizational units in Active Directory, learn how OUs support GPOs linking and delegation, differentiate them from generic containers, and review practical questions on hierarchy depth and tools.

Explore domain controllers and the global catalog, noting how DNS and SRV records affect sign-in, and the roles of read-only controllers and operations masters.

Demonstrates viewing a domain controller in LearnedLessons.com and LitDC1, explains why two domain controllers are essential for production, and shows NTDS.did, sysvol, and ADDS replication.

Discover the global catalog, a specialized domain controller with a partial replica of every object. It speeds logons and forest-wide searches, and balances deployment to manage replication traffic.

Examine how domain controllers register srv records in dns and how clients locate the nearest dc via srv lookups, including site-aware searches and netlogon re-registration.

View and interpret domain controller SRV records with DNS manager, exploring __sites, __tcp, __udp, and __msdcs, and LDAP services including port 88 and netlogon DNS re-registration.

Demonstrates the AD DS sign-in process by retrieving seed information for users, computers, and domains in Active Directory with Windows PowerShell commands like get id computer and get id forest.

Learn how to transfer FISMA roles between domain controllers using gui ad ds snap-ins or powershell, and when to seize roles with ntdsutil.exe as a last resort.

Discover the role of domain controllers in active directory, hosting ntds.dit and authenticating users with Kerberos. Understand multi-master replication, road ac deployments, and the sysvol folder for GPO templates.

Master how srv records in dns locate domain controllers and how active directory sites optimize sign-in by prioritizing nearby controllers, with netlogon dns registration and ipconfig register dns.

Explore how authentication works in Active Directory Domain Services (ADDS) through a knowledge check on DNS lookup to locate a domain controller, LSA access tokens, Kerberos TGTs, and service tickets.

Deploy a domain controller via cloning in virtualized environments like Hyper-V, addressing rollback and VMGenerationID, plus Azure considerations. Install and upgrade domain controllers with GUI or server core.

Demonstrates installing the Active Directory Domain Services role and promoting a domain controller in Windows Server 2022 via Server Manager, with a fast lab setup.

Observe a hands-on demo of installing Active Directory Domain Services on Windows Server Core and promoting the core server to the first domain controller in the demo-learned-lessons.com forest.

Clone domain controllers to rapidly deploy identical configurations in private clouds via computer provisioning. Run Hyper-V on Windows Server 2012 or later with a PDC emulator online during first cloning.

Prepare a source domain controller for cloning, export the source VM, and import and start the cloned domain controller, including verification of app lists and renaming to LoneDC3.

Add another domain controller to the Contoso domain by installing Active Directory Domain Services and DNS via Server Manager, then promote it using labdc1.contoso.com as the replication partner.

Manage the five FSMO roles—schema master, domain naming master, RID master, PDC emulator, and infrastructure master—and learn how to transfer or seize them across domain controllers.

learn how to install windows server 2022, from boot media and bios settings to selecting core versus desktop installation, partitioning, and post-install configurations like administrator password and server manager.

Upgrade Windows Server 2019 to 2022 by applying updates, then using installation media for the in-place upgrade. Keep files, select desktop experience, accept the license, and reboot to complete.

rename the server and join it to a domain using server manager or the sysadmin tool, then enable remote desktop and configure essential network and security settings.

Learn post-installation tasks for Windows Server, including renaming the computer, joining a domain, enabling remote desktop, and configuring DNS and network settings for remote access.

Set up a base image using Sysprep by capturing post-installation changes, firewall, time and language, disabled media player, updates, and git, for rapid deployment of new Windows servers.

This recap walks through a hands-on exercise with a Windows 2022 VM, using git clone to follow along, and reviews activation, management, drivers, network settings, and boot repair commands.

Deploy domain controllers in a vlab Active Directory domain using Windows Server 2022 and PowerShell, and promote a server to a domain controller with AD DS and DNS.

Add a child domain to the lab using PowerShell, install domain services on dc two, configure lab one, and manage via Windows Administration Center with PowerShell one-liners.

Recap the base lab SOP by building a Windows Server lab with PowerShell and Hyper-V, creating base images, VHDs, multiple VMs, domain controllers, and client setup, with checkpoints.

Demonstrate provisioning a core server, adding a domain controller with Windows Admin Center, and creating a new child domain via a PowerShell one-liner, including DNS configuration and automated reboot.

Learn how to manage user accounts in Active Directory, including roaming profiles, disabled and locked out accounts, attributes, profiles, and templates to create, configure, and secure identities.

Create and manage Active Directory Domain Services user accounts to authenticate to the domain, access resources, and enforce unique logon names and UPN suffixes.

Demonstrates creating user profiles, configuring profile paths and roaming profiles, setting logon scripts, mapping drives, and guiding folder redirection via group policy in Active Directory.

Demonstrate managing users in Active Directory using the Active Directory Administrative Center, including create, delete, and move operations, and adjust attributes, department, and group memberships within OUs and groups.

Demonstrates enabling and disabling user accounts in Active Directory, and creating templates to rapidly provision new users with common attributes like group memberships, home directories, and logon scripts.

Explore how Active Directory Domain Services user accounts authenticate users and grant access to resources, implement unique identifiers with upns, and apply naming conventions using aduc, adac, and powershell.

Explore Active Directory Domain Services and master configuring user account attributes, including logon hours, password settings, service account settings, delegation, and group memberships through practical knowledge-check questions.

Explore configuring roaming profiles, folder redirection, and drive mappings with Active Directory and Group Policy, using profile path, home folder, and percent username to personalize user environments.

Disable user accounts to prevent unauthorized access while retaining data, use templates to pre-configure attributes, note office numbers aren't copied, and ensure password never expires in the Member Of tab.

Use Windows PowerShell cmdlets to manage user accounts with NewADUser and RemoveAdUser, including password handling, expiration, unlock, enable, disable, and properties like department, home directory, and given name.

Master Active Directory user and computer management with PowerShell, creating and modifying accounts using New-ADUser, securing passwords as secure strings, and retrieving attributes with Get-ADUser for production-ready automation.

Use Windows PowerShell to create bulk Active Directory users from a CSV. Populate core attributes (display name, given name, surname, samAccountName, userPrincipalName, password) and add email and phone details.

Learn to modify Active Directory user properties with PowerShell, including bulk updates, by using Get-ADUser and Set-ADUser, and update attributes like description across OUs.

Use Windows PowerShell to duplicate an administrator's security group membership by listing the admin's groups with get-aduser and adding a user with add-adgroupmember to each group.

Update office, home, and mobile phone numbers for multiple Active Directory users with Windows PowerShell. Use Get-ADUser and Set-ADUser with add or replace, and import CSV for looping updates.

Learn to enable and disable Active Directory accounts with Get-ADUser and Enable-ADAccount, and move users between OUs using Move-ADObject in PowerShell.

Delete user accounts in Active Directory using Windows PowerShell with remove-ad-user and remove-ad-object. Pass identity by DN, GUID, SID, or SAM name, and delete accounts from text file with Get-Content.

Explore PowerShell for Active Directory user management, including creating, moving, disabling, enabling, and deleting accounts, with name and path parameters, and retrieving all properties via Get-ADUser.

Practice user creation in Active Directory using PowerShell with CSV data, loops, and attribute population. Verify your understanding with knowledge check questions on for-each loops, Import-Csv, and the ADUser pass-through.

Execute knowledge checks to reinforce updating Active Directory user attributes with PowerShell, using the attribute editor in ADSI, and retrieving and modifying properties with Get-ADUser and Set-ADUser.

Explore PowerShell techniques for bulk enabling and disabling AD user accounts and moving objects between OUs using DisableADAccount, MoveADObject, and Get-Content pipelines, with key concepts like -PassThru, targetPath, and ForEach-Object.

Explore how domain controllers authenticate users and computers, plan global catalog placement to optimize sign-in times and availability, and understand the role of DNS and SRV records.

Identify the two Windows Server group types: security and distribution, and their roles in permissions and email distribution. Demonstrate converting between types and updating access tokens in large exchange deployments.

Explore how to create and manage groups in Active Directory, comparing security and distribution groups, converting between types, enabling protection from accidental deletion, and using PowerShell to view group attributes.

Explore group scopes—domain local, global, and universal—and create a domain local security group, add members, and grant access to domain resources, including joining Windows 11 client and configuring DNS.

Demonstrate Active Directory group management using IGDLA, creating user accounts and groups. Configure access to shared resources and manage AD remotely with Windows Admin Center.

Use restricted groups in group policy to grant local administrators on domain-joined Windows 11 machines. Create an OU, link a GPO, add win11 power users, and run gpupdate.

Explore how account operators and delegated controls shape who can create, move, or delete Active Directory objects, and how to limit actions to specific OUs with delegation in ADUC.

Create an IT managers group in Active Directory, add members, and modify its type and scope, then assign a group manager using the Active Directory Administrative Center.

Demonstrate checking george's group membership and adding domain admins using the active directory administrative center, member of, and powershell commands like get-ad-principal-group-membership, while documenting changes across domains.

Test your knowledge of Active Directory group types and scopes, comparing security versus distribution groups, and exploring local, global, and universal scopes and their permissions implications.

Explore group nest strategies including the DLA and Igla model, and test your knowledge of group types, nest, and role-based access management.

Explore default and protected groups in Active Directory and Windows Server, including Enterprise Admins, Schema Admins, and Domain Admins, and learn best practices for managing permissions, ACLs, and administrative privileges.

Explore managing computer objects in Active Directory, including computer accounts, secure channels, and domain joins. Learn to configure computer containers and perform routine management tasks.

Recognize that the computer's container is a container, not an OU, and cannot be subdivided; create OUs for clients and servers to delegate management, link GPOs, reconfigure via Redeer CMP.

Learn to control permissions for creating computer accounts in Active Directory, manage machine account quota, pre-create objects in the correct OU, and delegate rights with the Delegation of Control wizard.

Join or leave a domain from the client computer via the Computer Name tab in Advanced System Settings, using domain credentials with proper permissions, and restart after changes.

Learn to manage computer objects in an Active Directory domain by delegating control, creating and moving organizational units, and joining or renaming computers with PowerShell.

Learn how computer accounts establish a secure channel with the domain and reset it when authentication fails, using dsmod, netdom, nltest, or PowerShell.

Reset the computer account's secure channel, troubleshoot a failed domain trust, and repair the channel with credentials using test-computer-secure-channel-repair to restore domain logins.

Learn to join a computer to a domain without an online domain controller using offline domain join with DJoin, provisioning and transferring a save file, then restarting.

Create and configure AD DS groups and users for a branch office, enable group nesting and convert groups to security, then repair computer trust and reset accounts for domain authentication.

Demonstrate end-to-end active directory management, including creating and nesting groups, converting distribution to security groups, configuring user templates, and resetting computer accounts to repair secure channels.

This lecture reinforces that the computer's container is the default location for computer accounts, outlines its limitations, and recommends using custom OUs and views to organize servers and clients.

Explore how Active Directory domain members store credentials in LSA secrets, manage computer account passwords, and use netdom, dsmod, nltest, and PowerShell commands to repair or reset the secure channel.

Explore implementing and managing Organizational Units (OUs) in Active Directory and Windows Server, including planning OU structures and using the delegation of control wizard to assign task-based permissions.

Design effective Active Directory organizational units to delegate rights, apply group policies, and organize domain objects through location-based, resource-based, organization-based, multi-tenancy, and hybrid strategies.

Plan OU design for administrative purposes, aligning with the tasks delegation model and GPOs, not the organizational chart, and design for inheritance and change, reflecting department-specific GPOs at lower levels.

Always create new OUs with administrative tools, using graphical tools or PowerShell, since copying OUs isn't supported. Enable Protect OUs from Accidental Deletion to prevent unintended deletions or moves.

Learn to design the Active Directory Administrative Delegation model by merging OU design with OU permissions, empowering delegated administrators and understanding security descriptors, ACLs, and inheritance.

Delegate Active Directory permissions using object-type and role-based approaches, assigning rights to groups and using the Delegation of Control Wizard to set tasks.

Explore planning OUs in Active Directory using location-based, resource-based, organization-based, multi-tenant, and hybrid strategies, reinforced by knowledge checks on design choices and administrative delegation.

Explore OU design for Active Directory, covering admin delegation, GPO application, inheritance, and change management while creating, moving, and protecting OUs using ADUC, ADAC, and PowerShell.

Explore tokens, security descriptors, and delegation methods in Active Directory, and learn how role-based delegation and the Delegation of Control Wizard simplify assigning administrative rights.