Administration of Active Directory and Windows Server (2025)

Explore the core components of ADDS, including OUs, forests and trees, and the domain controller role, plus tools, Azure AD, schema rules, and Windows Server 2016 updates.

Explore the logical and physical components of AD DS, including partitions (schema, configuration, domain), domain trees and forests, sites and subnets, OUs, containers, domain controllers, and group policy objects.

Explore Active Directory domain services, including partitions (schema, configuration, domain), organizational units for delegation and GPO linking, the global catalog, forest structure, and read-only domain controllers for branch offices.

Explore the Active Directory schema, the rules and syntax that define all object classes and attributes, and how changes replicate from the Schema Master to every domain controller.

Explore how the active directory schema defines object classes and attributes to standardize data storage and retrieval, and how schema extensions and admins govern changes.

Define an Active Directory forest as top-level container of domain trees with a common schema and global catalog, with forest root domain hosting Schema Master and Domain Naming Master roles.

Test your understanding of AD DS forest concepts, including the forest root domain, the schema master and domain naming master roles, the global catalog, and forest security and replication boundaries.

Active Directory domains act as logical containers for users, computers, and groups, with domain controllers replicating the database to enable authentication, authorization, and central access rules via dynamic access control.

Examine the purpose and replication of an AD DS domain as a logical container for users, computers, and groups. Learn about authentication, domain admins, and dynamic access control.

Explore organizational units as domain containers for users, computers, and groups, enabling GPO linking, delegated administration, and scalable OU hierarchies with a depth limit of up to 10 levels.

Test your understanding of organizational units and containers in Active Directory, including GPO linking, management capabilities, and common administrative questions.

Azure Active Directory is a cloud identity management service for cloud apps, hosted by Microsoft, that syncs with on-premises directory to unify identities but does not replace on-premises services.

Explore the overview of active directory administration tools and use the Active Directory Administrative Center, a Windows PowerShell–based GUI, to manage users, computers, groups, and OUs across domains.

Identify the Active Directory Administrative Center as the primary AD management tool. Use Active Directory Sites and Services for replication topology and register the schema snap-in with regsvr32 schema-management.dll.

Explore AD DS by locating the ntds.dit file and verifying the schema version with PowerShell and dsquery. Access schema and domain details using ldp.exe and ADSI Edit tools.

Review Active Directory components by using Get-ADForest to view forest details, functional levels, and global catalogs, then navigate AD tools to locate domains, organizational units, and the global catalog role.

Learn to administer AD DS with the Active Directory Administrative Center: create objects, view attributes, use global search and PowerShell history, and perform tasks like password resets and computer creation.

Explore domain controllers in Active Directory, the global catalog, DNS and SRV records, the sign-in process, and the roles of operations masters and read-only domain controllers.

Learn how a domain controller stores the AD DS database and sysvol, uses multi-master replication, and handles Kerberos authentication. Explore ROADC options and BitLocker drive encryption.

Explain the role of domain controllers in active directory, hosting the database and authenticating users. Cover multi-master replication, read-only domain controllers, BitLocker, and SYSVOL with GPOs for secure AD.

Watch a live demo of a domain controller in LearnItLessons.com, inspect ntds.dit and sysvol, and see active directory domain services replication via distributed file system replication and service management.

Explore the Active Directory global catalog, a specialized domain controller role that holds a partial replica of every object to enable fast logons and forest-wide searches.

Discover how the global catalog provides a partial read-only index for cross-domain searches, supports universal group checks during authentication, and how schema-driven attributes determine replication.

Explore the global catalog, a specialized domain controller role that holds a partial replica of every object in the forest, enabling fast logons, forest-wide searches, and balanced replication considerations.

Learn how Active Directory uses DNS SRV records to locate domain controllers at sign-in, with NetLogon registering records and sites directing client requests.

Explore how SRV records in DNS locate domain controllers in Active Directory Domain Services. Learn NetLogon SRV registration, ipconfig register DNS, and how Try Next Closest Site guides controller selection.

Demonstrates using DNS manager to view SRV records and LDAP entries for domain controllers, including netlogon.dns, and re-registering DNS via the netlogon service or ipconfig /register-dns.

Explore how the AD DS sign-in process authenticates users through DNS domain controller lookup, credential verification, and the creation of an access token with the user's and groups' security IDs.

Explore the AD DS sign-in process, from DNS lookup to locate a domain controller, to the LSA-generated access token and Kerberos ticket granting ticket (TGT) for service tickets.

Learn to use Windows PowerShell to fetch current Active Directory user, computer, and forest domain seed information, using commands like get local user, get id computer, and get id forest.

Explore how operations masters, the flexible single master roles, govern five roles: schema master, domain naming master, readmaster, infrastructure master, and PDC emulator, preventing replication conflicts in forests and domains.

Reinforce your understanding of the FISMA operations master roles in Active Directory domain services, including domain naming master, schema master, infrastructure master, read master, and the pd simulator.

Transfer FISMA roles between domain controllers with GUI ADDS snap-ins or PowerShell, and seize roles only as a last resort using ntdsutil, ensuring data replication.

Test your understanding of transferring and seizing FISMO roles in Active Directory, covering planned vs unplanned moves, Active Directory Schema Snap-in, and the PowerShell force parameter.

Learn how to deploy domain controllers in virtualization and Azure, using cloning, GUI or server core installations, and from media, while managing rollback and VMGenerationID considerations.

Launch server manager, install Active Directory Domain Services, and promote the first domain controller in a new forest, configuring forest and domain functional levels and the global catalog.

Demonstrates installing the Active Directory Domain Services role and promoting a domain controller using Windows Server Manager, with hands-on Hyper-V lab setup and PowerShell one-liners.

Promote a server to a domain controller in a new forest, configure forest and domain functional levels, enable DNS and global catalog, and set the directory services restore mode password.

Install the AD DS domain controller on a server core Windows Server 2016+ using remote server administration tools, Server Manager, or PowerShell. Run install-windows-feature-adds-domain-services, then install-adds-domain-controller, with automatic module loading.

This demonstration shows installing Active Directory Domain Services on Windows Server Core and promoting it to the first domain controller in a new forest, demo-learned-lessons.com.

Learn how to deploy a domain controller from media to remote sites, using ntdsutil and ifm to create a local ADDS snapshot and install via Server Manager.

Clone domain controllers to rapidly deploy identical configurations in Hyper-V environments. Use provisioning and private clouds to support disaster recovery, scaling, and branch office deployments.

Demonstrates preparing a source domain controller for cloning, exporting the virtual machine, and provisioning a cloned domain controller via Hyper-V import, with prerequisite checks and configuration steps.

Add another domain controller to the contoso domain by installing AD DS and DNS roles via server manager and promoting it from labdc1.contoso.com.

Install Active Directory Domain Services and promote a server to a domain controller with PowerShell, using the AD DS deployment module and test commands for forest creation.

Explore FSMO roles in Windows, including schema master, domain naming master, RID master, PDC emulator, and infrastructure master; learn transferring or seizing roles with PowerShell.

Explore how roaming profiles store and synchronize user data across computers, and distinguish disabling accounts from lockouts while learning to manage user accounts, attributes, profiles, and templates in active directory.

Create active directory domain services user accounts with unique logon names, passwords, and group memberships. Master naming conventions, upn suffixes, and management tools like aduc, adac, powershell, and dsadd.

Learn how Active Directory domain services manage user accounts, authenticate users, and grant access to resources, using unique UPNs and naming conventions with ADUC, ADAC, and PowerShell.

Learn how to configure user account attributes in ADDS using ADAC, ADUC, PowerShell, or DSMOD. Review account, organization, MemberOf, password, profile, policy, silo, and extensions attributes.

Learn to configure active directory user attributes, including logon hours, password at next logon, password never expires for service accounts, delegation, reversible encryption, group memberships, and expiration for temporary accounts.

Learn how to manage user accounts in Active Directory using the Active Directory Administrative Center. Create, delete, move, and update users, assign departments, and adjust group memberships within OUs.

Configure user profiles in Active Directory, including roaming profiles with UNC paths and redirected home folders, and manage settings with GPOs, logon scripts, and folder redirection.

Demonstrates creating user profiles, configuring profile paths and roaming settings, and enabling or disabling accounts in Active Directory. Explains logon scripts, home folder mapping, and folder redirection via group policy.

Learn to configure roaming profiles, folder redirection, and home folders with Active Directory and Group Policy, including profile path and percent username usage for centralized, roaming access and drive mappings.

Discover how to create and use user account templates in Active Directory to speed onboarding, enforce common attributes, and copy templates to new users.

Learn practical Active Directory domain services skills by testing account disablement vs deletion, using user account templates to streamline creation, and verifying inherited group memberships and copied attributes.

Learn to manage Active Directory user accounts with Windows PowerShell cmdlets. Create, modify, and delete accounts using NewADUser, RemoveAdUser, SetAdAccountPassword, plus SetAdAccountExpiration and UnlockAdAccount, with secure strings.

Manage Active Directory user and computer accounts with Windows PowerShell, creating, modifying, enabling, disabling, moving, and deleting objects using new-aduser and get-aduser.

Explore how to manage Active Directory user objects with Windows PowerShell, including creating users with the new AD user cmdlet, handling passwords, setting the organizational unit, and retrieving user properties.

Use PowerShell to bulk create AD users from a CSV via import-csv, foreach, populating lab OU and attributes: display name, given name, samAccountName, user principal name, password, password never expires.

Reinforces bulk user creation in Active Directory using PowerShell, covering looping through CSV data, importing CSV, and populating attributes, with checks on pass-through output and common attributes.

Learn how to modify active directory user accounts with Windows PowerShell, using Get-ADUser and Set-ADUser, and perform bulk updates, attribute edits, and OU moves.

Learn to modify Active Directory user properties with PowerShell, using the Attribute Editor and Get-ADUser to retrieve all attributes, and Set-ADUser to update descriptions.

Use add-adgroupmember to grant James the administrator’s security groups by listing them from get-aduser and adding James to each: Group Policy Creator Owners, Domain Admins, Enterprise Admins, Schema Admins, Administrators.

Learn to update office, home, and mobile numbers for Active Directory users via Windows PowerShell, from single updates to bulk CSV-based changes using Get-ADUser and Set-ADUser.

Use Windows PowerShell to bulk enable or disable Active Directory users, piping get-ad user results to disable-ad account or enable-ad account, and move accounts with move-ad-object between OUs.

Learn to manage Active Directory with Windows PowerShell by enabling and disabling user accounts, moving objects between OUs, and performing bulk operations using Get-Content and pipelines.

Learn to delete user accounts in Active Directory with PowerShell using remove-ad-user or remove-ad-object, handling confirmations and bulk deletions from text files.

Discover how to use groups to grant permissions efficiently in large networks and simplify permission management by adding or removing users from groups rather than editing file permissions directly. Understand group types and group scopes, implement group management with Group Policy, and describe default groups and special identities while focusing on managing groups in Active Directory and AD DS on Windows Server.

Understand security and distribution group types in Windows Server 2016, default group type is security, how to assign permissions, manage email distribution, and convert group types for scalable Exchange deployments.

Explore the difference between security and distribution groups in active directory, including group type, scope, and protection from accidental deletion, with a hands-on demo and powershell examples.

Explore local, domain-local, global, and universal group scopes and how they shape membership, permissions, and cross-domain availability in Active Directory.

Demonstrates group scopes in Active Directory by creating domain local, global, and universal groups, assigning members, and granting access to domain resources on a joined Windows 11 device.

Explore the differences between security and distribution groups, group scopes (local, domain local, global, universal), conversion outcomes, and why security groups can serve both resource access and email distribution.

Apply IGDLA and IGUDLA group nesting to assign identities to global, domain local, and universal groups, and grant read access to the sales folder via a resource access rule group.

Demonstrates implementing group management in Active Directory using IGDLA, including creating global and domain local groups, nesting, and configuring access to the finance reports share and Windows 11 client.

Explore IGDLA and IGUDLA group nesting models, identify global, domain local, and universal groups, and apply role-based access management and resource permissions for streamlined administration.

Configure restricted groups in a domain-level GPO to manage local and ADDS group membership on OU-held computers, with nesting, automatic removal of non-listed members, and the local administrator exception.

Demonstrates using restricted groups in group policy to grant a domain user local administrator rights on Windows 11 computers, via a win11 power users group and a dedicated GPO.

Explore default administrative groups in Active Directory, including backup operators, print operators, and third publishers, and learn why custom groups improve security and delegated permissions on domain controllers.

This demonstration shows how the account operators group can create, delete, and move Active Directory objects. It covers delegating control to restrict actions to containers and using a sandbox OU.

Explore default and protected groups in Active Directory on Windows Server, including domain admins, enterprise admins, and schema admins, and learn best-practice delegation of administrative privileges.

Manage access using special identities to assign rights based on authentication or connection. Learn about anonymous logon, authenticated users, everyone, interactive, network, and creator-owner groups and their permissions.

Demonstrates creating a new group, adding members, changing the group's type and scope to distribution and universal, and configuring a manager to update membership in Windows Server Active Directory.

Check a user’s group membership in Active Directory using the Administrative Center and tools, then verify nested groups and permissions with gpresult /r and get ad principal group membership.

Manage computer objects in Active Directory, troubleshoot trust relationships from password mismatches, and oversee lifecycle tasks such as joining domains, configuring properties, and offline domain join.

Configure and organize computer objects in Active Directory by using custom OUs to host client and server accounts, delegate administration, and apply GPOs, instead of using the default computers container.

Discover the default computers.container for computer accounts, why the computer's container is not an OU, and how custom OUs and RedirCMP improve organization and configuration.

Learn to control permissions to create computer accounts in Active Directory, pre-create computer objects in the OU, manage machine account quotas, and delegate control with the Delegation of Control wizard.

Join a computer to a domain via computer name tab in advanced system settings (system applet in control panel), using the domain name and credentials; a restart is required.

Explore managing computer objects in a domain with Active Directory, delegating custom tasks to join, rename, and move computers between OUs, and performing domain joins via PowerShell.

Learn how to reset the computer account secure channel in Active Directory, using netdom, nltest, dsmod, or the AD module for Windows PowerShell to restore trust with the domain controller.

Demonstrates resetting the computer account secure channel, troubleshooting domain trust failures in a Windows environment using Active Directory Users and Computers, Hyper-V, and test computer secure channel with credentials.

Learn how a member computer stores its computer account password as an LSA secret, maintains a secure channel, and resets trust with tools like NetDom, NLTest, dsmod, and PowerShell commands.

Learn how offline domain join lets a computer join a domain without an online domain controller using DJoin to create and import a domain join file, supporting prestaged accounts.

Create and configure groups, users, and computer objects in AD DS, manage group nesting and security groups, and repair computer trust by resetting accounts and validating sign-ins.

Demonstrates step-by-step management of AD DS objects, including creating groups and users, nesting groups, converting a distribution group to security, and repairing the secure channel on domain computers.

Analyze how to implement and manage organizational units (OUs) with the Delegation of Control Wizard, plan OU structures, and delegate ADDS permissions for administrative tasks.

Explore OU design strategies for active directory, including location-based, resource-based, organization-based, multi-tenancy, and hybrid approaches, to delegate rights and apply group policies effectively.

Explore planning OU structures in Active Directory with strategies like location-based, resource-based, organization-based, multi-tenancy, and hybrid, and test understanding of their admin delegation and use cases.

Design organizational unit structures to support administrative purposes, align delegation models and GPOs, consider inheritance, use lower-level organizational units for department GPOs, and enable manager attributes for Outlook navigation.

Learn how to create and manage organizational units (OUs) in active directory domain services, protect them from accidental deletion, and move objects between OUs while understanding the required permissions.

Explore the design of organizational units in Active Directory, focusing on delegation and GPO administration, inheritance, change management, and how to create and move OUs.

Implement the Active Directory Administrative Delegation model by merging OU design with OU permissions to enable delegated administrators, and understand tokens, security descriptors, DACL/SACL, and inheritance across OUs.

Delegate AD DS permissions by assigning rights to groups and choosing where to delegate in the directory. Use object-type and role-based delegation, and the delegation wizard for granular control.

Discover how tokens and security descriptors govern access in Active Directory, compare delegation methods, apply role-based delegation, and use the delegation of control wizard to manage group permissions.

Automate Active Directory Domain Services (AD DS) administration with Windows PowerShell, using cmdlets to manage groups, computer accounts, and OUs, and to perform bulk operations via CSV workflows.

Use Windows PowerShell to create, modify, and delete groups with new id group and related cmdlets, and manage group membership with id group member and id principle group member.

Master active directory group management with powershell, creating domain-local global and universal security groups, and adding or removing members, searching, modifying, and managing group properties using get-adgroup, new-adgroup, and set-adgroup.

Add and manage members in Active Directory groups with PowerShell, using Add-ADGroupMember and Get-ADGroupMember, including single, multiple, and file-based or OU-based additions, and verify results.

Learn how to add computer accounts to security groups in Active Directory using PowerShell. Use the dollar suffix and Get-ADComputer to identify the SAM account name, then assign with Add-ADGroupMember.

PowerShell manages Active Directory security groups by nesting groups and applying scope rules, including universal, global, and domain-local types, with bulk creation and assignment via get-adgroup and add-adgroupmember.

Discover how to list and manage Active Directory group members with PowerShell using get-adgroupmember and get-adgroup, including nested groups, export results with export-csv, and remove members with remove-adgroupmember.

Learn to manage computer accounts and OUs with Windows PowerShell, creating, modifying, displaying, and repairing trust relationships using NewADComputer, GetADComputer, SetADComputer, RemoveADComputer, and NewADOrganizationalUnit.

Explore PowerShell management of computer objects in Active Directory, including creating, modifying, enabling or disabling, deleting, and moving accounts, with prestaging and OU placement using New-ADComputer, Set-ADComputer, and Move-ADObject.

Enable or disable computer accounts in Active Directory, reconcile computer accounts data monthly, quarterly, and annually, and remove stale objects using Get-ADComputer, Enable-ADAccount, Disable-ADAccount, and Remove-ADComputer in specified OUs.

Explore advanced Active Directory Domain Services deployments, including distributed ADDS environments and ADDS trusts, and learn to install, configure, and manage centralized authentication with SSO.

Explore the components of an active directory domain services environment and how domains and forests form security and administration boundaries, including reasons for multiple domains or forests in Azure IaaS.

Learn how Active Directory Domain Services uses domain and forest boundaries to manage authentication, resource access, and searches, including replication, group policy, auditing, and DNS zones.

Explore how domain and forest boundaries shape security, replication, and administration in Active Directory, highlighting forest as the true security boundary and the limits of organizational units and site boundaries.

Understand how domain and forest boundaries govern policy, DNS, and replication in Active Directory; GPOs do not cross domains, and schema, configuration, and global catalog drive forest-wide replication.

Assess when to deploy multiple AD DS domains to meet replication bandwidth constraints, DNS namespace needs, and distributed administration, while balancing administrative autonomy and cost.

Explore why organizations adopt multiple forests for security isolation, PAM bastion forests, incompatible schemas, multinational or extranet requirements, and mergers or divestitures, guided by the simplest design.

Understand when to deploy multiple domains and forests in Active Directory. Evaluate administrative autonomy versus isolation and network, security, and regulatory considerations shaping forest design.

Explore resource domain models to grant application autonomy without affecting regular users. Deploy bastion forests for PAM to isolate privileged accounts, aligning with data sovereignty and regulatory requirements.

Deploy a domain controller on Azure IaaS to support disaster recovery, geo-distributed authentication, and isolated-app deployments, while configuring ADDS sites, site links, replication, and VM Generation ID considerations.

Explore how Azure service healing affects domain controllers, VM generation ID rollback protection, and the use of static IPs, DNS integration, and data disks with none caching for ADS integrity.

Deploy domain controllers in Azure IaaS using VM generation ID to prevent rollbacks, ensure shutdowns, and configure static IPs with on-prem DNS for NTDS.data and SysVol on non-cached disks.

Automate user and group management in complex AD DS deployments with workflows from HR data, enable self-service, and synchronize identities with Azure Active Directory using MIM 2016.

Explore scalability challenges in complex AD DS deployments and learn how automated workflows, HR-driven user provisioning, and automatic group membership updates enable secure, scalable management of objects across multi-forest environments.

Explore how multi-factor authentication-based self-service reduces help desk workload by enabling password resets and account unlocks, while multi-forest certificate authority management requires independent handling and cross-forest coordination for revocation.

Navigate identity synchronization across multiple authentication stores, including legacy applications, in hybrid environments to keep user data consistent across on-premises systems, Azure AD, and Office 365.

Deploy a distributed AD DS environment across multiple domains or forests, and learn domain and forest functional levels, upgrades to Windows Server 2016 or 2019, and migration paths.

Explore the AD DS domain functional levels from Windows 2000 native to Windows Server 2016, learn the features each level adds, and understand upgrade implications and rollback limitations.

Assess how AD DS domain functional levels unlock security features like protected users and authentication policies, guiding upgrade planning, feature availability, and Azure integration considerations.

Delve into AD DS domain functional levels with replication requirements, FRS to DFS migration, rollback limits, and the Windows Server 2025 database 32 pages feature.

Explore ad ds forest functional levels, including 2003 features such as transitive trusts, forest trusts, and linked value replication, and note levels restrict additions and enable recycle bin management.

Demonstrate the new forest and domain functional levels in Windows Server 2025, with 32k database page support and unattended promotion concepts for Active Directory Domain Services.

Configure new forest and domain functional levels in Windows Server, including vNext level 10, 32k page support, and unattended promotion options for AD DS upgrades.

Explore how Active Directory domain services trusts enable cross-forest access by configuring forest and domain trusts. Discover selective authentication and seed filtering to control authentication scope across forests.

Explore seed filtering, selective authentication, and name suffix routing to secure AD DS trusts and prevent unauthorized access across domains and forests.