Page 228 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
AD DS can run on Azure virtual machines in the same manner as many on-premises deployments. The documented example deploys two domain controllers in an Azure availability set using portal and CLI methods.
Read the explainer
The built-in logs are the primary cloning-troubleshooting tool and are enabled at maximum verbosity by default; cloning evidence includes the System log, Directory Service log, and dcpromo.log.
Read the guide
Regular system-state backup is required to restore a physical or virtual domain controller in disaster recovery. System state includes AD data and logs, the registry, SYSVOL, and operating-system elements.
Read the playbook
Hyper-V Replica asynchronously replicates selected VMs across LAN or WAN links. The document distinguishes supported and unsupported scenarios and requires Windows Server 2012 or newer domain controllers.
Read the briefing
The forest owner assigns a person or group to own DNS for the AD DS forest. That owner is responsible for DNS design and coordinates delegation of the forest-root DNS name when an existing DNS service is used.
Read the checklist
Microsoft positions replication concepts as prerequisite knowledge for site-topology design. The model includes connection objects, the KCC, subnets, sites, site links, bridges, and global catalog servers.
Read the explainer
A Defender for Identity workspace is automatically created in the data center geographically closest to the Microsoft Entra ID tenant and cannot later be moved; its geolocation appears under Settings → Identity → About. Defender for Identity retains data visible across the portal for 180 days.
Read the guide
Defender for Identity alert learning periods tune detections, and testing without the needed learning period reduces detection accuracy.
Read the playbook
ATA data is not migrated to Defender for Identity, so Microsoft recommends retaining the ATA Data Center and alerts needed for ongoing investigations until those alerts are closed or remediated.
Read the briefing
The Active Directory schema level is the objectVersion value on CN=Schema,CN=Configuration in the forest, which Microsoft maps to Windows Server versions in its objectVersion table.
Read the checklist