Page 120 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Microsoft states that Credential Guard protected machine accounts are temporarily disabled because of a Kerberos machine-password rotation issue. FAST and managed service accounts increasingly depend on machine-account identity.
Read the checklist
Domain controllers require a KDS root key before they can generate gMSA passwords. Controllers can wait up to 10 hours after key creation so AD replication can converge before gMSA use.
Read the explainer
The ADUC Delegation tab does not appear for standalone or group managed service accounts. Microsoft documents PowerShell and direct userAccountControl approaches for configuring the required delegation state.
Read the guide
Delegation assigns selected administrative tasks without making every operator a domain-wide or forest-wide administrator. Administrative control can be delegated at specific organizational-unit levels in the domain tree.
Read the playbook
Metric progress represents exposure improvement on a scale from 0 for high exposure to 100 for no exposure. Metric weight represents relative importance and effect on the initiative score; the interface shows High, Medium, Low, or Risk accepted.
Read the briefing
The forest-recovery procedure creates domain-controller system-state backups with Windows Server Backup or wbadmin.exe. Microsoft documents separate GUI and command-line procedures for the same recovery input.
Read the checklist
Alert tuning automatically resolves alerts according to the configured rule conditions, reducing the alerts that require triage. Microsoft recommends checking whether existing tuning rules match as expected and, when a rule has no matches, considering whether it is still needed or can be removed.
Read the explainer
Microsoft recommends periodically verifying that the server setup process installs Defender for Identity sensors on new domain controllers, AD CS servers, and AD FS servers.
Read the guide
A restored domain controller that lacks the DNS Server role must have DNS installed and configured. The step is repeated for each restored controller that is not operating as a DNS server after restore.
Read the playbook
Microsoft recommends bare-metal recovery backup preparation for forest recovery. A BMR backup can be restored to different hardware or a different operating-system instance.
Read the briefing