Administration of Active Directory and Windows Server (2025)

Explore the core components of Active Directory Domain Services, including domains, organizational units, forests and trees, and the schema, plus deployment, administration tools, and Azure AD.

Explore the logical and physical components of AD DS, including partitions (schema, configuration, domain), domain trees and forests, sites and subnets, OUs, containers, domain controllers, and group policy objects.

Explore the logical and physical architecture of Active Directory Domain Services, including partitions of AD DS database, organizational units for delegation and GPOs, global catalog, RODC, site, and forest structure.

Explore the Active Directory schema, the rules and syntax that define all object classes and attributes, and how changes replicate from the Schema Master to every domain controller.

Explore how the active directory schema defines object classes and attributes to standardize data storage and retrieval, and how schema extensions and admins govern changes.

Define an Active Directory forest as top-level container of domain trees with a common schema and global catalog, with forest root domain hosting Schema Master and Domain Naming Master roles.

Test your understanding of AD DS forest concepts, including the forest root domain, the schema master and domain naming master roles, the global catalog, and forest security and replication boundaries.

Define a domain as a logical container for managing user accounts, computer accounts, and groups, with the Active Directory database replicated across domain controllers via multi-master replication.

Explore the knowledge check on an Active Directory domain, reinforcing its purpose as a logical container for managing users, computers, and groups, plus replication, authentication, and authorization concepts.

Explore organizational units as domain containers for users, computers, and groups, enabling GPO linking, delegated administration, and scalable OU hierarchies with a depth limit of up to 10 levels.

Explore organizational units in active directory, noting that OUs can host group policy objects and support delegation, unlike generic containers. Learn the recommended OU depth of up to 10 levels.

Azure Active Directory is a cloud identity management service for cloud apps, hosted by Microsoft, that syncs with on-premises directory to unify identities but does not replace on-premises services.

Explore the overview of active directory administration tools and use the Active Directory Administrative Center, a Windows PowerShell–based GUI, to manage users, computers, groups, and OUs across domains.

Explore the AD DS administration tools, including the Active Directory Administrative Center as the primary interface, sites and services for replication, and the schema snap-in for schema management.

Explore AD DS by locating the ntds.dit file and verifying the schema version with PowerShell and dsquery. Access schema and domain details using ldp.exe and ADSI Edit tools.

Review Active Directory components by using Get-ADForest to view forest details, functional levels, and global catalogs, then navigate AD tools to locate domains, organizational units, and the global catalog role.

Explore how to use the Active Directory Administrative Center to administer and manage ADDS, including creating objects, viewing attributes, and using the Windows PowerShell History Viewer.

Explore domain controllers in Active Directory, the global catalog, DNS and SRV records, the sign-in process, and the roles of operations masters and read-only domain controllers.

Learn how a domain controller stores the AD DS database and sysvol, uses multi-master replication, and handles Kerberos authentication. Explore ROADC options and BitLocker drive encryption.

Discover the role of domain controllers in Active Directory, including hosting the ntds.dit database, authenticating users with Kerberos, and managing GPO templates in Sysvol.

Explore domain controllers, highlighting the minimum of two for production, the NTDS.dit and sysvol locations, and how ADDS replication and service restarts affect availability and GPOs.

Explore the Active Directory global catalog, a specialized domain controller role that holds a partial replica of every object to enable fast logons and forest-wide searches.

Learn how the global catalog provides a partial read-only, cross-domain searchable copy of forest objects in Active Directory, with attributes like display name and email, to speed cross-domain searches.

Explore the Active Directory global catalog, a partial replica of every domain's objects that speeds domain logons and enables forest-wide searches with universal group memberships.

Learn how Active Directory uses DNS SRV records to locate domain controllers at sign-in, with NetLogon registering records and sites directing client requests.

Explore how SRV records in DNS enable Active Directory service discovery, locate domain controllers via site-aware DNS queries, and how NetLogon registers records while using ipconfig register-dns for host records.

Demonstrates using DNS manager to view SRV records and LDAP entries for domain controllers, including netlogon.dns, and re-registering DNS via the netlogon service or ipconfig /register-dns.

Understand the AD DS sign-in process from DNS lookup to domain controllers, LSA authentication, and the creation of an access token with SIDs, TGT, and service tickets for logon.

Explore the AD DS sign-in process, from DNS lookup to locate a domain controller, to the LSA-generated access token and Kerberos ticket granting ticket (TGT) for service tickets.

Learn to use Windows PowerShell to fetch current Active Directory user, computer, and forest domain seed information, using commands like get local user, get id computer, and get id forest.

Identify the five operations master roles and their forest and domain placement. Explain how these roles prevent replication conflicts and govern changes to schema, naming, reads, infrastructure, and PDC emulator.

Reinforce your understanding of the FISMA operations master roles in Active Directory domain services, including domain naming master, schema master, infrastructure master, read master, and the pd simulator.

Transfer FISMA roles between domain controllers with GUI ADDS snap-ins or PowerShell, and seize roles only as a last resort using ntdsutil, ensuring data replication.

Test your understanding of transferring and seizing FISMO roles in Active Directory, and distinguish planned transfers from emergency seizures using PowerShell and the Active Directory Schema Snap-in.

Learn how to deploy domain controllers in virtualization and Azure, using cloning, GUI or server core installations, and from media, while managing rollback and VMGenerationID considerations.

Launch server manager, install Active Directory Domain Services, and promote the first domain controller in a new forest, configuring forest and domain functional levels and the global catalog.

Demonstrates installing the Active Directory Domain Services (ADDS) role and promoting a domain controller using Server Manager on a Windows Server 2022 demo.

Promote a server to a domain controller in a new forest, configure forest and domain functional levels, enable DNS and global catalog, and set the directory services restore mode password.

Install the AD DS domain controller on a server core Windows Server 2016+ using remote server administration tools, Server Manager, or PowerShell. Run install-windows-feature-adds-domain-services, then install-adds-domain-controller, with automatic module loading.

This demonstration shows installing Active Directory Domain Services on Windows Server Core and promoting it to the first domain controller in a new forest, demo-learned-lessons.com.

Learn how to deploy a domain controller from media to remote sites, using ntdsutil and ifm to create a local ADDS snapshot and install via Server Manager.

Clone domain controllers to rapidly deploy identical configurations in Hyper-V environments. Use provisioning and private clouds to support disaster recovery, scaling, and branch office deployments.

Demonstrates preparing a source domain controller for cloning, exporting the virtual machine, and provisioning a cloned domain controller via Hyper-V import, with prerequisite checks and configuration steps.

Explore best practices for domain controller virtualization, including avoiding single points of failure, maintaining two domain controllers on separate hosts, time synchronization, cloning safeguards, and cross-site deployment.

Add another domain controller to the contoso domain by installing AD DS and DNS roles via server manager and promoting it from labdc1.contoso.com.

Demonstrates installing Active Directory Domain Services with Windows PowerShell, using the ADDS Deployment module to promote a server to a domain controller and configure forest and domain settings.

Explore FSMO roles in Windows, including schema master, domain naming master, RID master, PDC emulator, and infrastructure master; learn transferring or seizing roles with PowerShell.

Learn to manage user accounts in Active Directory, configure attributes and profiles, implement roaming profiles, and use templates to streamline account creation while understanding disabling and lockout differences.

Create active directory domain services user accounts with unique logon names, passwords, and group memberships. Master naming conventions, upn suffixes, and management tools like aduc, adac, powershell, and dsadd.

Active Directory Domain Services manages user accounts, enabling authentication and access control, unique naming with the user principal name, and management via ADUC, ADAC, and PowerShell.

Learn how to configure user account attributes in ADDS using ADAC, ADUC, PowerShell, or DSMOD. Review account, organization, MemberOf, password, profile, policy, silo, and extensions attributes.

Engage in knowledge checks to master configuring user account attributes in Active Directory, including logon hours, user must change password at next logon, and account expires for temporary accounts.

Learn how to manage user accounts in Active Directory using the Active Directory Administrative Center. Create, delete, move, and update users, assign departments, and adjust group memberships within OUs.

Create and manage roaming and local user profiles in active directory by configuring profile paths, logon scripts, and home folder redirection with gpos and unc paths.

Create and configure user profiles in Active Directory, including roaming profiles and profile paths. Enable or disable accounts and map home drives and logon scripts via Group Policy.

Learn how to configure roaming profiles, folder redirection, and drive mappings with Active Directory and Group Policy, including profile path, home folder, and percent username percent variable usage.

Discover how to create and use user account templates in Active Directory to speed onboarding, enforce common attributes, and copy templates to new users.

Explore how to disable and preserve user accounts, use templates to pre-configure attributes, and verify inherited group memberships and essential settings in Active Directory.

Learn to create, modify, and delete user accounts using Windows PowerShell cmdlets like NewADUser and RemoveADUser, including setting passwords as secure strings and managing expiration and properties.

Manage Active Directory user and computer accounts with Windows PowerShell, creating, modifying, enabling, disabling, moving, and deleting objects using new-aduser and get-aduser.

Explore managing Active Directory user objects with PowerShell, including creating and querying accounts, handling passwords, and using enabled and path parameters to place and activate accounts.

Use PowerShell to bulk create AD users from a CSV via import-csv, foreach, populating lab OU and attributes: display name, given name, samAccountName, user principal name, password, password never expires.

Reinforce bulk user creation in Active Directory using PowerShell and CSV files, with attribute population and for-each loops to iterate a list and create accounts dynamically.

Learn how to modify active directory user accounts with Windows PowerShell, using Get-ADUser and Set-ADUser, and perform bulk updates, attribute edits, and OU moves.

Test your understanding of updating Active Directory attributes with PowerShell, using the attribute editor and Get-ADUser with all properties to modify descriptions via Set-ADUser.

Use add-adgroupmember to grant James the administrator’s security groups by listing them from get-aduser and adding James to each: Group Policy Creator Owners, Domain Admins, Enterprise Admins, Schema Admins, Administrators.

Learn to update office, home, and mobile numbers for Active Directory users via Windows PowerShell, from single updates to bulk CSV-based changes using Get-ADUser and Set-ADUser.

Use Windows PowerShell to bulk enable or disable Active Directory users, piping get-ad user results to disable-ad account or enable-ad account, and move accounts with move-ad-object between OUs.

Test your ability to bulk manage Active Directory users with PowerShell, using Disable-ADAccount, Move-ADObject, Get-Content, and the ForEach alias to move and disable accounts.

Learn to delete user accounts in Active Directory with PowerShell using remove-ad-user or remove-ad-object, handling confirmations and bulk deletions from text files.

Explore domain controllers, the global catalog, and DNS SRV records, and learn how global catalog placement affects sign-in times and the role of operations masters in single and multi-domain environments.

Understand the Windows Server group types—security and distribution—and how their scope, permissions, and conversions affect resource access, ACLs, SIDs, and email distribution.

Explore the difference between security and distribution groups in active directory, including group type, scope, and protection from accidental deletion, with a hands-on demo and powershell examples.

Explore four group scopes: local, domain-local, global, and universal, and learn how each defines permissions, membership rules, and resource access across domains and forests in Windows Server 2016 and later.

Demonstrates group scopes in Active Directory by creating domain local, global, and universal groups, assigning members, and granting access to domain resources on a joined Windows 11 device.

Explore the differences between security and distribution groups, group scopes (local, domain local, global, universal), conversion outcomes, and why security groups can serve both resource access and email distribution.

Implement group nesting with IGDLA and IGUDLA to map identities to global and domain local groups, and assign a resource access management rule group for read access.

Demonstrates implementing group management in Active Directory using IGDLA, including creating global and domain local groups, nesting, and configuring access to the finance reports share and Windows 11 client.

Explore IGDLA and IGUDLA group nesting models, identify global, domain local, and universal groups, and apply role-based access management and resource permissions for streamlined administration.

Use the restricted groups setting in a domain-level GPO to control local and ADDS group membership across domain-joined computers, including group nesting and automatic removal of non-designated members.

Demonstrates using restricted groups in group policy to grant a domain user local administrator rights on Windows 11 computers, via a win11 power users group and a dedicated GPO.

Identify default groups and their administrative rights in Windows Server, and learn how protected groups like Administrators, Enterprise Admins, and Schema Admins are managed and safeguarded.

Demonstrates how built-in groups like account operators grant administrative rights to create, delete, and move domain objects in Active Directory, and delegates control to limit actions to specific containers.

Explore key default and protected groups in Active Directory, including domain admins, enterprise admins, and schema admins, and review best practices for managing administrative privileges.

Explore special identities in Windows Server and ADDS, including anonymous logon, authenticated users, everyone, interactive, network, and creator-owner, and learn how these groups grant rights based on authentication or connection.

Demonstrates creating an IT Managers group in Active Directory, adding members, changing group type and scope, and configuring a group manager with update permissions.

Demonstrate checking and managing user group membership in Active Directory using the Active Directory Administrative Center, server manager, and PowerShell commands, with documentation for governance and change tracking.

Discover how to manage computer objects in Active Directory, configure the computer container, control account creation, join computers to a domain, and handle secure channels and offline domain join.

Explore how to specify where computer accounts reside in Active Directory by using the default Computers container, creating custom OUs for clients and servers, and linking GPOs for delegated management.

Explore the default computer container in Active Directory, why it isn't an OU, how custom OUs and sub OUs enhance management and GPO deployment, and redircmp.

Pre-create computer objects in the correct OU to ensure policies apply when joining the AD DS domain, and delegate computer account creation using the Delegation of Control Wizard.

Join a computer to a domain via computer name tab in advanced system settings (system applet in control panel), using the domain name and credentials; a restart is required.

Explore managing computer objects in a domain with Active Directory, delegating custom tasks to join, rename, and move computers between OUs, and performing domain joins via PowerShell.

Reset the secure channel between a computer and its domain when authentication fails, by rejoining the domain, or using dsmod, netdom, nltest, or PowerShell to reset the computer account.

Demonstrates resetting the computer account secure channel in Active Directory, repairing the secure channel with credentials, and reconnecting a LitWin10 client to the domain via Hyper-V and PowerShell.

Learn how a member computer stores its computer account password as an LSA secret, maintains a secure channel, and resets trust with tools like NetDom, NLTest, dsmod, and PowerShell commands.

Learn how offline domain join lets a computer join a domain without an online domain controller using DJoin to create and import a domain join file, supporting prestaged accounts.

Create and configure groups, users, and computer objects in AD DS, manage group nesting and security groups, and repair computer trust by resetting accounts and validating sign-ins.

Demonstrates step-by-step management of AD DS objects, including creating groups and users, nesting groups, converting a distribution group to security, and repairing the secure channel on domain computers.

Analyze how to implement and manage organizational units (OUs) with the Delegation of Control Wizard, plan OU structures, and delegate ADDS permissions for administrative tasks.

Explore OU design strategies for active directory, including location-based, resource-based, organization-based, multi-tenancy, and hybrid approaches, to delegate rights and apply group policies effectively.

Explore planning OU structures in Active Directory with strategies like location-based, resource-based, organization-based, multi-tenancy, and hybrid, and test understanding of their admin delegation and use cases.

Design the OU structure to support administrative control and GPOs, not the corporate org chart, using inheritance strategically and planning for change as the organization grows.

In ADDS, create OUs beyond the domain controllers OU using GUI or PowerShell, and enable Protect OUs from Accidental Deletion to prevent deletions or moves.

Explore the design of organizational units in Active Directory, focusing on delegation and GPO administration, inheritance, change management, and how to create and move OUs.

Implement the Active Directory Administrative Delegation model by merging OU design with OU permissions to enable delegated administrators, and understand tokens, security descriptors, DACL/SACL, and inheritance across OUs.

Delegate AD DS permissions by assigning rights to groups and choosing where to delegate in the directory. Use object-type and role-based delegation, and the delegation wizard for granular control.

Explore knowledge-check concepts in Active Directory delegation, including tokens, security descriptors, and delegation methods, plus the Delegation of Control Wizard.

Automate Active Directory Domain Services (AD DS) administration with Windows PowerShell, using cmdlets to manage groups, computer accounts, and OUs, and to perform bulk operations via CSV workflows.

Use Windows PowerShell to create, modify, and delete groups with new id group and related cmdlets, and manage group membership with id group member and id principle group member.

Master active directory group management with powershell, creating domain-local global and universal security groups, and adding or removing members, searching, modifying, and managing group properties using get-adgroup, new-adgroup, and set-adgroup.

Learn to add members to Active Directory security groups with PowerShell, including single and multiple users, from files or OUs, using Get-ADGroupMember and Add-ADGroupMember.

Learn how to add computer accounts to security groups in Active Directory using PowerShell. Use the dollar suffix and Get-ADComputer to identify the SAM account name, then assign with Add-ADGroupMember.

PowerShell: manage, configure and modify group objects with Active Directory cmdlets, nesting security groups by adding one group into another, including handling universal, global, and domain-local scopes and bulk operations.

Discover how to list and manage Active Directory group members with PowerShell using get-adgroupmember and get-adgroup, including nested groups, export results with export-csv, and remove members with remove-adgroupmember.

Explore Windows PowerShell cmdlets to manage computer accounts and OUs, including new-ad-computer, set-ad-computer, get-ad-computer, remove-ad-computer, test-computer-secure-channel, and New AD Organizational Unit.

Explore PowerShell management of computer objects in Active Directory, including creating, modifying, enabling or disabling, deleting, and moving accounts, with prestaging and OU placement using New-ADComputer, Set-ADComputer, and Move-ADObject.

Harness PowerShell for managing computer objects in active directory, enabling, disabling, and deleting stale accounts with get-adcomputer, enable-adaccount, remove-adcomputer, and filter by ou or last-logon-date to manage in bulk.

Describe how Active Directory Federation Services on Windows Server 2016 enables sign-in and single sign-on to local, partner, and online apps with a single credential.

Explore the components of an active directory domain services environment and how domains and forests form security and administration boundaries, including reasons for multiple domains or forests in Azure IaaS.

Learn how Active Directory Domain Services uses domain and forest boundaries to manage authentication, resource access, and searches, including replication, group policy, auditing, and DNS zones.

Understand active directory boundaries across domains and forests. Separate forests provide complete security isolation; domain data replicates within its domain, and domain admins do not cross domains.

Understand how domain and forest boundaries govern policy, DNS, and replication in Active Directory; GPOs do not cross domains, and schema, configuration, and global catalog drive forest-wide replication.

Assess when to deploy multiple AD DS domains to meet replication bandwidth constraints, DNS namespace needs, and distributed administration, while balancing administrative autonomy and cost.

Explore why organizations adopt multiple forests for security isolation, PAM bastion forests, incompatible schemas, multinational or extranet requirements, and mergers or divestitures, guided by the simplest design.

Understand when to deploy multiple domains and forests in Active Directory. Evaluate administrative autonomy versus isolation and network, security, and regulatory considerations shaping forest design.

Explore resource domain models to grant application autonomy without affecting regular users. Deploy bastion forests for PAM to isolate privileged accounts, aligning with data sovereignty and regulatory requirements.

Deploy a domain controller on Azure IaaS to support disaster recovery, geo-distributed authentication, and isolated-app deployments, while configuring ADDS sites, site links, replication, and VM Generation ID considerations.

This knowledge check guides planning and deploying Active Directory domain services in Asia using Azure IaaS, covering site topology, replication, connectivity, DNS, and storage for reliable hybrid cloud authentication.

Deploy domain controllers in Azure IaaS using VM generation ID to prevent rollbacks, ensure shutdowns, and configure static IPs with on-prem DNS for NTDS.data and SysVol on non-cached disks.

Automate user and group management in complex AD DS deployments with workflows from HR data, enable self-service, and synchronize identities with Azure Active Directory using MIM 2016.

Explore scalability in complex AD DS deployments, implementing automated workflows for user and group management, self-service benefits, certificate management across multi-forest deployments, and identity synchronization for hybrid cloud.

Explore how multi-factor authentication-based self-service reduces help desk workload by enabling password resets and account unlocks, while multi-forest certificate authority management requires independent handling and cross-forest coordination for revocation.

Navigate identity synchronization across multiple authentication stores, including legacy applications, in hybrid environments to keep user data consistent across on-premises systems, Azure AD, and Office 365.

Deploy a distributed AD DS environment across multiple domains or forests, and learn domain and forest functional levels, upgrades to Windows Server 2016 or 2019, and migration paths.

Explore the AD DS domain functional levels from Windows 2000 native to Windows Server 2016, learn the features each level adds, and understand upgrade implications and rollback limitations.

Assess how AD DS domain functional levels unlock security features like protected users and authentication policies, guiding upgrade planning, feature availability, and Azure integration considerations.

Delve into AD DS domain functional levels with replication requirements, FRS to DFS migration, rollback limits, and the Windows Server 2025 database 32 pages feature.

Explore ad ds forest functional levels, including 2003 features such as transitive trusts, forest trusts, and linked value replication, and note levels restrict additions and enable recycle bin management.

Demonstrate the new forest and domain functional levels in Windows Server 2025, with 32k database page support and unattended promotion concepts for Active Directory Domain Services.

Explore deploying and upgrading Active Directory domain services, including forest root domain and domain controllers, DNS considerations, and strategies for child and tree domains, with upgrades to Windows Server 2016.

Explore configuring AD DS trusts and inter forest restructuring with ADMT, covering pre-migration steps, seed history attributes, and the impact of forest trusts on access across domains.

Configure advanced AD DS trust settings by applying seed filtering to prevent seed history misuse, implement selective authentication to limit access, and manage name-suffix routing across forest trusts.