Page 125 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
BitLocker recovery can be user self-service or a controlled helpdesk process. Microsoft documents recovery-information retrieval for Entra joined, hybrid joined, and AD joined devices.
Read the checklist
Network Unlock can automatically unlock BitLocker OS volumes on a wired corporate network during reboot. It requires compatible UEFI DHCP support and combines a TPM-held key with network key material handled by the unlock server.
Read the explainer
Zero Trust DNS uses a deny-by-default outbound model; traffic is allowed when its destination came from the trusted resolver or an administrator placed it on the approved list.
Read the guide
Windows Firewall rules can allow an application, port, protocol, or predefined traffic type. Inbound and outbound precedence, local policy merge, application rules, and automatic rule creation affect the result.
Read the playbook
Windows Firewall can log dropped packets and successful connections. Microsoft documents configuration through CSP or Group Policy together with parsing and missing-log troubleshooting.
Read the briefing
UAC reduces malware risk by limiting execution with administrator privileges. Applications needing an administrator token prompt for consent, while child processes inherit the parent token only at the same integrity level.
Read the checklist
Attackers can exploit vulnerabilities in legitimate signed kernel drivers to run malicious code in the kernel. Microsoft publishes a vulnerable-driver blocklist that can be applied with App Control mechanisms.
Read the explainer
Remote Credential Guard redirects Kerberos requests to the originating device instead of sending credentials to the RDP target. It protects credentials and derivatives from a compromised target while retaining Remote Desktop single sign-on.
Read the guide
Defender for Identity sensors collect signals from on-premises identity infrastructure for threat detection. The service detects activity such as privilege escalation and high-risk lateral movement and reports exploitable identity issues such as unconstrained Kerberos delegation.
Read the playbook
The sensor v3.x is deployed on supported domain controllers. Microsoft directs administrators to complete prerequisite checks before activation and configure auditing and identity settings afterward.
Read the briefing