Page 118 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Setspn reads, modifies, and deletes the SPN directory property for AD service accounts. SPNs are normally created automatically but can require updates after computer renames or application-specific service changes.
Read the checklist
TPM key attestation lets a certificate requester prove cryptographically that the requested RSA key is protected by a trusted TPM. TPM-attested keys provide nonexportability, anti-hammering, and hardware isolation assurances.
Read the explainer
Event 4688 can include the command line used to create a process. Both Audit Process Creation and the policy to include command lines in process-creation events must be enabled.
Read the guide
Required domain-join permissions differ when creating a new computer account versus reusing an existing one. For a new account, the joiner needs either the workstation-join right or permission to create computer objects; Microsoft does not recommend the quota-based option.
Read the playbook
Prestaging a computer account in Active Directory is optional and is not mandatory for joining the device to a domain. Prestaging can assign the computer account to the intended organizational unit and put the required permissions in place before the device joins.
Read the briefing
Windows Server installs default accounts and organizations can create additional accounts for their requirements. The reference covers default local accounts stored on domain controllers for Active Directory use, not member-server or client local accounts.
Read the checklist
ADUC can create, delete, and manage user accounts when its AD DS or AD LDS administration components are installed. Account Operators can manage user accounts but do not receive the same group and permission authority as Domain Admins or Enterprise Admins.
Read the explainer
AD security groups are authorization principals distinct from distribution groups. Group scope controls where a group can be granted permissions and which principals it can contain.
Read the guide
Group Policy centrally manages user, client, and server operational or security settings. A GPO has a container in the AD domain partition and a template in SYSVOL on domain controllers.
Read the playbook
GPO scope begins with links to Active Directory sites, domains, or organizational units. Processing order, filtering, and link options change which policy settings apply to a user or computer.
Read the briefing