Page 116 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
AD Recycle Bin preserves link-valued and non-link-valued attributes of deleted AD objects. A restored user can regain the group memberships and access rights held immediately before deletion.
Read the checklist
Fine-grained password policies allow multiple password and lockout policies within one domain. Different policy restrictions can be applied to different user sets, including stricter settings for privileged accounts.
Read the explainer
AD Administrative Center records the PowerShell cmdlets it runs together with arguments and values. Administrators can copy and filter the history for learning, modification, and reuse.
Read the guide
Defender for Identity forwards CEF security-alert fields including start, suser, shost, outcome, msg, cnt, app, and externalId to a SIEM. Microsoft recommends identifying alert types with externalId in automation because alert names can change while each alert type’s externalId is permanent.
Read the playbook
At boot, AD DS compares the hypervisor-provided VM-Generation ID with the value stored in NTDS.DIT; a mismatch resets the invocation ID and discards the RID pool.
Read the briefing
Virtualized DC deployment has explicit platform requirements and critical caveats. The cloning workflow includes validating the hypervisor and verifying the PDC emulator role holder.
Read the checklist
AD DS can run on Azure virtual machines in the same manner as many on-premises deployments. The documented example deploys two domain controllers in an Azure availability set using portal and CLI methods.
Read the explainer
The built-in logs are the primary cloning-troubleshooting tool and are enabled at maximum verbosity by default; cloning evidence includes the System log, Directory Service log, and dcpromo.log.
Read the guide
Regular system-state backup is required to restore a physical or virtual domain controller in disaster recovery. System state includes AD data and logs, the registry, SYSVOL, and operating-system elements.
Read the playbook
Hyper-V Replica asynchronously replicates selected VMs across LAN or WAN links. The document distinguishes supported and unsupported scenarios and requires Windows Server 2012 or newer domain controllers.
Read the briefing