Page 233 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DoD and GCC High use security.microsoft.us with a workspace sensor endpoint under sensorapi.atp.azure.us, while GCC uses security.microsoft.com with a sensor endpoint under sensorapi.atp.gcc.azure.com.
Read the explainer
The forest-recovery guide calls for resetting trust passwords when recovery follows a security breach. It resets the trusting side first and then uses the same password on the trusted side during that domain’s recovery.
Read the guide
After seizure is confirmed in Ntdsutil, AD DS first attempts to transfer the role and proceeds with seizure only after that transfer fails. After seizure, Ntdsutil lists the roles and LDAP name of each current holder, and an elevated Netdom Query FSMO command provides a second holder check.
Read the playbook
Repadmin /replsum can verify AD DS and SYSVOL replication after controllers are restored or reinstalled. DFSR event 4602, or FRS event 13516 on legacy systems, indicates SYSVOL replication initialization.
Read the briefing
Metadata cleanup removes AD data that identifies a domain controller to the replication system. The cleanup applies when a controller cannot complete normal demotion because it is no longer reachable.
Read the checklist
Large LDAP result sets impose significant server work, including conversion to LDAP wire formats. Windows Server manages paged-query cookies in a server-side pool that administrators can report on and monitor.
Read the explainer
SAM client event logging records account lookups and domain enumeration that can contribute to domain-controller CPU pressure. The diagnostic events identify the processes, services, and executables generating SAM traffic.
Read the guide
ETW can trace LDAP communications between Windows clients and LDAP servers, including AD DS domain controllers. Microsoft documents how to start, stop, and scope the trace with trace flags.
Read the playbook
AD replication can fail because of DNS, networking, or security problems. The troubleshooting workflow also checks intentional disconnections, hardware failures, and firewall configuration.
Read the briefing
AD CS can issue and manage certificates using algorithms intended to resist quantum-capable attacks. The current documented AD CS post-quantum algorithm is ML-DSA, with platform and certificate-format requirements.
Read the checklist