Stage Determining the Number of Forests Required with AD/DNS rollback checks
Microsoft states: “When determining the number of forests to deploy for your organization, consider the following:”
Read the explainerDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 167 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
3,000 articlesGuidance and analysis from DSE
Trace Delegating Administration of Default Containers and OUs across Active Directory and Windows DNS
Microsoft states: “Every Active Directory domain contains a standard set of containers and organizational units (OUs) that are created during the installation of Active Directory Domain Services (AD DS).”
Read the guide
Review Creating an Organizational Unit Design before AD/DNS changes
Microsoft states: “Forest owners are responsible for creating organizational unit (OU) designs for their domains.”
Read the playbook
Scope Configuring a Computer for Troubleshooting in observed AD/DNS state
Microsoft states: “Before you use advanced troubleshooting techniques to identify and fix Active Directory problems, configure your computers for troubleshooting.”
Read the briefing
Validate Active Directory Forest Recovery - Recovering a single domain in a multidomain forest with AD/DNS evidence
Microsoft states: “In certain scenarios, it may be necessary to recover only a single domain within a forest that has multiple domains, rather than a full forest recovery.”
Read the checklist
Stage Database 32k pages for Active Directory on Windows Server with AD/DNS rollback checks
Microsoft states: “Active Directory Domain Services (AD DS) and Lightweight Directory Services (LDS) uses an Extensible Storage Engine (ESE) database.”
Read the explainer
Trace Using the Organizational Domain Forest Model across Active Directory and Windows DNS
Microsoft states: “In the organizational domain forest model, several autonomous groups each own a domain within a forest.”
Read the guide
Review Understanding the Active Directory Logical Model before AD/DNS changes
Microsoft states: “Designing your logical structure for Active Directory Domain Services (AD DS) involves defining the relationships between the containers in your directory.”
Read the playbook
Scope Creating a Site Link Bridge Design in observed AD/DNS state
Microsoft states: “A site link bridge connects two or more site links and enables transitivity between site links.”
Read the briefing
Validate Appendix I - Creating Management Accounts for Protected Accounts and Groups in Active Directory with AD/DNS evidence
Microsoft states: “Some privileged identity management solutions require that the software’s service accounts are granted permanent membership in groups such as DA or Administrators in each domain in the forest.”
Read the checklist