Stage Turn on debug logging in Windows Time Service with AD/DNS rollback checks
Microsoft states: “This article describes how to turn on debug logging for the Windows Time service (also known as W32time).”
Read the explainerDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 209 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
3,000 articlesGuidance and analysis from DSE
Trace Cannot connect to Internet or domain across Active Directory and Windows DNS
Microsoft states: “This article provides a solution to an issue where clients cannot join or log on to the domain.”
Read the guide
Review Let nonadministrators view deleted objects before AD/DNS changes
Microsoft states: “This article explains how to change permissions so that nonadministrators can view the Active Directory deleted objects container.”
Read the playbook
Scope How to complete a semantic database analysis for the Active Directory database by using Ntdsutil.exe in observed AD/DNS state
Microsoft states: “This article describes the steps to complete a semantic database analysis for the Active Directory database by using Ntdsutil.exe.”
Read the briefing
Validate Requirements for domain controller with AD/DNS evidence
Microsoft states: “This article describes the requirements that you need to fulfill to issue a domain controller certificate from a third-party certification authority (CA).”
Read the checklist
Stage Failure When You Use an Existing Computer Account to Join a Domain with AD/DNS rollback checks
Microsoft states: “This article addresses the issue of failing to join a computer to a domain when an existing computer account with the same name already exists.”
Read the explainer
Trace NET ADD doesn't support names exceeding 20 characters across Active Directory and Windows DNS
Microsoft states: “This article provides a solution to an error that occurs when you use the NET.EXE /ADD command with user or group names longer than 20 characters.”
Read the guide
Review Change Windows Active Directory and LDS user password through LDAP before AD/DNS changes
Microsoft states: “This article describes how to change a Windows Active Directory and LDS user password through LDAP.”
Read the playbook
Scope Prevent KCC from creating replication topology in observed AD/DNS state
Microsoft states: “This article describes how to disable the Knowledge Consistency Checker to prevent it from automatically creating replication topology.”
Read the briefing
Validate Change display names of AD users with AD/DNS evidence
Microsoft states: “This article describes how to change display names of Active Directory (AD) users.”
Read the checklist