Page 117 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
The forest owner assigns a person or group to own DNS for the AD DS forest. That owner is responsible for DNS design and coordinates delegation of the forest-root DNS name when an existing DNS service is used.
Read the checklist
Microsoft positions replication concepts as prerequisite knowledge for site-topology design. The model includes connection objects, the KCC, subnets, sites, site links, bridges, and global catalog servers.
Read the explainer
A Defender for Identity workspace is automatically created in the data center geographically closest to the Microsoft Entra ID tenant and cannot later be moved; its geolocation appears under Settings → Identity → About. Defender for Identity retains data visible across the portal for 180 days.
Read the guide
Defender for Identity alert learning periods tune detections, and testing without the needed learning period reduces detection accuracy.
Read the playbook
ATA data is not migrated to Defender for Identity, so Microsoft recommends retaining the ATA Data Center and alerts needed for ongoing investigations until those alerts are closed or remediated.
Read the briefing
The Active Directory schema level is the objectVersion value on CN=Schema,CN=Configuration in the forest, which Microsoft maps to Windows Server versions in its objectVersion table.
Read the checklist
AD DS can be installed and configured through Windows PowerShell or Server Manager. The PowerShell workflow includes test cmdlets before new-forest, child-domain, or replica-controller installation.
Read the explainer
Metadata cleanup is required after forced removal of AD DS from a domain controller. Cleanup removes replication, FRS, and DFSR references and attempts to transfer or seize held FSMO roles.
Read the guide
Microsoft maps Adprep schema changes to specific LDF files by Windows Server release. Windows Server 2025 introduces schema files Sch89.ldf through Sch91.ldf.
Read the playbook
The directory enforces UPN uniqueness during user creation and documents the resulting failure paths. Event 2974 from ActiveDirectory_DomainService is documented as evidence for uniqueness conflicts.
Read the briefing