Stage Demote Domain Controllers and Domains with AD/DNS rollback checks
Microsoft states: “This article explains how to remove Active Directory Domain Services (AD DS) by using Server Manager or Windows PowerShell.”
Read the explainerDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 164 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
3,000 articlesGuidance and analysis from DSE
Trace Active Directory Forest Recovery - Perform initial recovery across Active Directory and Windows DNS
Microsoft states: “Restore the first writeable domain controller in each domain Reconnect each restored writeable domain controller to the network Add the global catalog to a domain controller in the forest root domain.”
Read the guide
Review Safely virtualizing Active Directory Domain Services (AD DS) before AD/DNS changes
Microsoft states: “Beginning with Windows Server 2012, AD DS provides greater support for virtualizing domain controllers by introducing virtualization-safe capabilities.”
Read the playbook
Scope Active Directory Domain Services Replication Priority Boost in observed AD/DNS state
Microsoft states: “Active Directory is a distributed system, which means changes you apply to one domain controller (DC) replicate to other DCs in the system automatically.”
Read the briefing
Validate Determining the Number of Domains Required with AD/DNS evidence
Microsoft states: “This information applies to forests that contain a maximum of 100,000 users and that have a connectivity of 28.8 kilobits per second (Kbps) or higher.”
Read the checklist
Stage Selecting the Forest Root Domain with AD/DNS rollback checks
Microsoft states: “The first domain that you deploy in an Active Directory forest is called the forest root domain.”
Read the explainer
Trace Upgrade domain controllers to a newer version of Windows Server across Active Directory and Windows DNS
Microsoft states: “This article provides background information about Active Directory Domain Services in Windows Server and explains the process for upgrading domain controllers (DCs) from an earlier version of Windows Server.”
Read the guide
Review Active Directory Privileged Accounts and Groups Guide before AD/DNS changes
Microsoft states: “Active Directory Domain Services contains numerous built-in accounts and groups that are granted elevated privileges to perform administrative tasks.”
Read the playbook
Scope Appendix E - Securing Enterprise Admins Groups in Active Directory in observed AD/DNS state
Microsoft states: “Enterprise Admins are, by default, members of the Administrators group in each domain in the forest.”
Read the briefing
Validate Planning Regional Domain Controller Placement with AD/DNS evidence
Microsoft states: “To ensure cost efficiency, plan to place as few regional domain controllers as possible.”
Read the checklist