Page 227 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
For an IPv4 reverse lookup, the DNS client reverses the address octets and appends the in-addr.arpa suffix to form the query name. The example authoritative response returns a PTR record whose data is the fully qualified domain name associated with the queried address.
Read the explainer
Windows DNS Policy can distribute application traffic according to time of day. Microsoft states that multiple DNS policies are ordered and that the first matching policy is used.
Read the guide
Anycast assigns the same IP address to multiple endpoints and uses routing to select a destination. Microsoft describes Anycast DNS as a way to scale a stateless service and add geographic routing and redundancy.
Read the playbook
AD DS stores information about network objects such as user accounts in a hierarchical directory. The directory service makes stored data available to authorized network users and administrators.
Read the briefing
AD Recycle Bin preserves link-valued and non-link-valued attributes of deleted AD objects. A restored user can regain the group memberships and access rights held immediately before deletion.
Read the checklist
Fine-grained password policies allow multiple password and lockout policies within one domain. Different policy restrictions can be applied to different user sets, including stricter settings for privileged accounts.
Read the explainer
AD Administrative Center records the PowerShell cmdlets it runs together with arguments and values. Administrators can copy and filter the history for learning, modification, and reuse.
Read the guide
Defender for Identity forwards CEF security-alert fields including start, suser, shost, outcome, msg, cnt, app, and externalId to a SIEM. Microsoft recommends identifying alert types with externalId in automation because alert names can change while each alert type’s externalId is permanent.
Read the playbook
At boot, AD DS compares the hypervisor-provided VM-Generation ID with the value stored in NTDS.DIT; a mismatch resets the invocation ID and discards the RID pool.
Read the briefing
Virtualized DC deployment has explicit platform requirements and critical caveats. The cloning workflow includes validating the hypervisor and verifying the PDC emulator role holder.
Read the checklist