Page 229 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
AD DS can be installed and configured through Windows PowerShell or Server Manager. The PowerShell workflow includes test cmdlets before new-forest, child-domain, or replica-controller installation.
Read the explainer
Metadata cleanup is required after forced removal of AD DS from a domain controller. Cleanup removes replication, FRS, and DFSR references and attempts to transfer or seize held FSMO roles.
Read the guide
Microsoft maps Adprep schema changes to specific LDF files by Windows Server release. Windows Server 2025 introduces schema files Sch89.ldf through Sch91.ldf.
Read the playbook
The directory enforces UPN uniqueness during user creation and documents the resulting failure paths. Event 2974 from ActiveDirectory_DomainService is documented as evidence for uniqueness conflicts.
Read the briefing
Setspn reads, modifies, and deletes the SPN directory property for AD service accounts. SPNs are normally created automatically but can require updates after computer renames or application-specific service changes.
Read the checklist
TPM key attestation lets a certificate requester prove cryptographically that the requested RSA key is protected by a trusted TPM. TPM-attested keys provide nonexportability, anti-hammering, and hardware isolation assurances.
Read the explainer
Event 4688 can include the command line used to create a process. Both Audit Process Creation and the policy to include command lines in process-creation events must be enabled.
Read the guide
Required domain-join permissions differ when creating a new computer account versus reusing an existing one. For a new account, the joiner needs either the workstation-join right or permission to create computer objects; Microsoft does not recommend the quota-based option.
Read the playbook
Prestaging a computer account in Active Directory is optional and is not mandatory for joining the device to a domain. Prestaging can assign the computer account to the intended organizational unit and put the required permissions in place before the device joins.
Read the briefing
Windows Server installs default accounts and organizations can create additional accounts for their requirements. The reference covers default local accounts stored on domain controllers for Active Directory use, not member-server or client local accounts.
Read the checklist