New-ADClaimTransformPolicy: create adclaim transform policy with rollback checks
Microsoft states: “Creates a new claim transformation policy object in Active Directory.”
Read the checklistDSE security knowledge hubMicrosoft 365 & Identity
Microsoft 365 & Identity
Knowledge
Page 16 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Microsoft 365 & Identity knowledge center
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
DSE post stream
760 articlesMicrosoft 365 & Identity
Get-ADAuthenticationPolicySilo: inventory adauthentication policy silo against recorded identity and DNS state
Microsoft states: “Gets one or more Active Directory Domain Services authentication policy silos.”
Read the explainer
Get-ADDomainControllerPasswordReplicationPolicyUsage: inventory addomain controller password replication policy usage
Microsoft states: “Gets the Active Directory accounts that are authenticated by a read-only domain controller or that are in the revealed list of the domain controller.”
Read the guide
New-ADAuthenticationPolicy: create adauthentication policy with bounded evidence
Microsoft states: “The New-ADAuthenticationPolicy creates an authentication policy object in Active Directory® Domain Services.”
Read the playbook
Get-ADReplicationUpToDatenessVectorTable: inventory adreplication up to dateness vector table under AD/DNS change control
Microsoft states: “Displays the highest Update Sequence Number (USN) for the specified domain controller.”
Read the briefing
Get-ADComputer: inventory adcomputer with rollback checks
Microsoft states: “The Get-ADComputer cmdlet gets a computer or performs a search to retrieve multiple computers.”
Read the checklist
Set-ADAccountControl: change adaccount control against recorded identity and DNS state
Microsoft states: “Modifies user account control (UAC) values for an Active Directory account.”
Read the explainer
Get-ADUser: inventory aduser with before-and-after evidence
Microsoft states: “The Get-ADUser cmdlet gets a specified user object or performs a search to get multiple user objects.”
Read the guide
Get-ADReplicationQueueOperation: inventory adreplication queue operation with bounded evidence
Microsoft states: “Returns the contents of the replication queue for a specified server.”
Read the playbook
Scope ActiveDirectory in observed AD/DNS state
Microsoft states: “The Active Directory module for Windows PowerShell is a PowerShell module that consolidates a group of cmdlets.”
Read the briefing