Page 4 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
Microsoft states: “The recommended way to upgrade a domain is to promote domain controllers that run newer versions of Windows Server and demote older domain controllers as needed.”
Read the checklist
Microsoft states: “Windows Server 2012 and later support virtualized domain controllers (DCs) with safeguards to prevent update sequence number (USN) rollback on virtual DCs and the ability to clone virtual DCs.”
Read the explainer
Microsoft states: “This article explains how to create a staged RODC account and then attach a server to that account during RODC installation.”
Read the guide
Microsoft states: “The Active Directory Domain Services (AD DS) Configuration Wizard is a tool in Server Manager that enables administrators to promote servers to domain controllers or demote them as needed.”
Read the playbook
Microsoft states: “This topic explains the new Windows Server 2012 Active Directory Domain Services domain controller promotion feature at an introductory level.”
Read the briefing
Microsoft states: “This article covers the updated Active Directory Administrative Center with its Active Directory Recycle Bin, fine-grained password policies, and Windows PowerShell History Viewer in detail, including architecture, examples for common tasks, and troubleshooting information.”
Read the checklist
Microsoft states: “Through Pass-the-hash (PtH) attacks, an attacker can authenticate to a remote server or service by using the underlying NTLM hash of a user’s password (or other credential derivatives).”
Read the explainer
Microsoft states: “In addition, you must identify the individuals and groups who will be responsible for owning and maintaining the directory after the deployment is completed.”
Read the guide
Microsoft states: “The Active Directory Domain Services (AD DS) tier model is a security architecture that separates administrative identities, workstations, and managed assets into trust tiers.”
Read the playbook
Microsoft states: “Recovering an entire Active Directory forest involves restoring at least one Domain Controller (DC) in every domain from an available backup.”
Read the briefing