Page 232 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Alert tuning automatically resolves alerts according to the configured rule conditions, reducing the alerts that require triage. Microsoft recommends checking whether existing tuning rules match as expected and, when a rule has no matches, considering whether it is still needed or can be removed.
Read the explainer
Microsoft recommends periodically verifying that the server setup process installs Defender for Identity sensors on new domain controllers, AD CS servers, and AD FS servers.
Read the guide
A restored domain controller that lacks the DNS Server role must have DNS installed and configured. The step is repeated for each restored controller that is not operating as a DNS server after restore.
Read the playbook
Microsoft recommends bare-metal recovery backup preparation for forest recovery. A BMR backup can be restored to different hardware or a different operating-system instance.
Read the briefing
Full-server recovery is needed when restoring to different hardware or a different operating-system instance. Bare-metal recovery is a supported backup-and-restore method for that scenario.
Read the checklist
DFSR-replicated SYSVOL can be restored authoritatively with msDFSR-Options or wbadmin -authsysvol. Microsoft describes wbadmin as simpler for same-hardware system-state restore and the attribute method as necessary for bare-metal restore.
Read the explainer
The forest-recovery sequence includes adding the global catalog role to a domain controller. Microsoft documents both the standard add operation and a repadmin-based method.
Read the guide
Raising available RID pools prevents a restored domain from reallocating a RID used after the backup point. The domain-wide RID space is maintained in the RID Manager object’s rIDAvailablePool attribute.
Read the playbook
Microsoft provides a PowerShell procedure that invalidates the current RID pool on one domain controller. Directory-Services-SAM event 16654 in the System log verifies completion on Windows Server 2012; Microsoft notes that earlier Windows versions do not log this event.
Read the briefing
Microsoft documents wbadmin.exe procedures for nonauthoritative AD DS restore. The procedure distinguishes nonauthoritative AD restore from an authoritative SYSVOL restore that can be performed alongside it.
Read the checklist