Stage Overview of Active Directory Domain Services with AD/DNS rollback checks
Microsoft states: “A directory is a hierarchical structure that stores information about objects on the network.”
Read the explainerDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 168 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
3,000 articlesGuidance and analysis from DSE
Trace AD DS Design and Planning across Active Directory and Windows DNS
Microsoft states: “By deploying Windows Server Active Directory Domain Services (AD DS) in your environment, you can take advantage of the centralized, delegated administrative model and single sign-on (SSO) capability that AD DS provides.”
Read the guide
Review Appendix M - Document Links and Recommended Reading before AD/DNS changes
Microsoft states: “The following table contains a list of links to external documents and their URLs so that readers of hard copies of this document can access this information.”
Read the playbook
Scope Delegating Administration by Using OU Objects in observed AD/DNS state
Microsoft states: “You can use organizational units (OUs) to delegate the administration of objects, such as users or computers, within the OU to a designated individual or group.”
Read the briefing
Validate AD Forest Recovery - Reset the krbtgt password with AD/DNS evidence
Microsoft states: “Use the following procedure to reset the krbtgt password for the domain.”
Read the checklist
Stage AD Forest Recovery - Remove the global catalog with AD/DNS rollback checks
Microsoft states: “Use the following procedure to remove the global catalog from a DC.”
Read the explainer
Trace Appendix L - Events to Monitor across Active Directory and Windows DNS
Microsoft states: “The following table lists events that you should monitor in your environment, according to the recommendations provided in Monitoring Active Directory for Signs of Compromise.”
Read the guide
Review Appendix A - Reviewing Key AD DS Terms before AD/DNS changes
Microsoft states: “The following terms are relevant to the deployment process for Windows Server 2008 Active Directory Domain Services (AD DS).”
Read the playbook
Scope Configure the Certificate Enrollment Web Service role service in observed AD/DNS state
Microsoft states: “Together with the Certificate Enrollment Policy Web Service, this enables policy-based automatic certificate enrollment for users and computers.”
Read the briefing
Validate Configure Certificate Enrollment Web Service for certificate key-based renewal on a custom port with AD/DNS evidence
Microsoft states: “Authors: Jitesh Thakur, Meera Mohideen, Technical Advisors with the Windows Group.”
Read the checklist