Page 230 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
ADUC can create, delete, and manage user accounts when its AD DS or AD LDS administration components are installed. Account Operators can manage user accounts but do not receive the same group and permission authority as Domain Admins or Enterprise Admins.
Read the explainer
AD security groups are authorization principals distinct from distribution groups. Group scope controls where a group can be granted permissions and which principals it can contain.
Read the guide
Group Policy centrally manages user, client, and server operational or security settings. A GPO has a container in the AD domain partition and a template in SYSVOL on domain controllers.
Read the playbook
GPO scope begins with links to Active Directory sites, domains, or organizational units. Processing order, filtering, and link options change which policy settings apply to a user or computer.
Read the briefing
Group Policy preferences configure settings beyond standard policy options but can be overridden by policy settings. Preferences are generally changeable by users, while policy settings are administrator-enforced.
Read the checklist
Group Policy is inherited and cumulative by default across an AD container and its children. Enforcement, blocked inheritance, filtering, loopback mode, and refresh behavior can alter the effective result.
Read the explainer
Group Policy Modeling simulates GPO deployment to a destination computer. Group Policy Results is the primary GPMC view for the policies actually applied.
Read the guide
GPMC provides unified Group Policy management across multiple forests. It manages GPOs, WMI filters, and Group Policy permissions and exposes scriptable interfaces.
Read the playbook
GPO backup and restore protects deployments from errors and disasters and avoids manual reconstruction. GPMC can copy GPOs across domains or import backed-up settings even where no trust relationship exists.
Read the briefing
A security principal is an entity the operating system can authenticate, including users, computers, and groups. Each security principal is represented by a unique SID used within Windows access control.
Read the checklist