Stage Group policy application rules for domain controllers with AD/DNS rollback checks
Microsoft states: “This article describes group policy application rules for domain controllers.”
Read the explainerDSE security knowledge hubMicrosoft 365 & Identity
Microsoft 365 & Identity
Knowledge
Page 42 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Microsoft 365 & Identity knowledge center
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
DSE post stream
764 articlesMicrosoft 365 & Identity
Trace KFSO doesn't work in external trust across Active Directory and Windows DNS
Microsoft states: “This article discusses a situation where Kerberos Forest Search Order (KFSO) doesn’t work in an external trust.”
Read the guide
Review LDAPS connection fails with event ID 36884 before AD/DNS changes
Microsoft states: “This article introduces how to troubleshoot the event ID 36884 issue that occurs when you try to build a Lightweight Directory Access Protocol (LDAP) connection.”
Read the playbook
Scope AuditPol and Local Security Policy results may differ in observed AD/DNS state
Microsoft states: “This article helps fix an issue where audit policy settings with AuditPol and the Local Security Policy (SECPOL.msc) show different results.”
Read the briefing
Validate Configure an authoritative time with AD/DNS evidence
Microsoft states: “This article describes how to configure the Windows Time service and troubleshoot when the Windows Time service doesn’t work correctly.”
Read the checklist
Stage A newly promoted domain controller may fail to advertise after completion of DCpromo with AD/DNS rollback checks
Microsoft states: “This article describes an issue where a newly promoted domain controller fails to advertise after completion of DCpromo.”
Read the explainer
Trace This page can't be displayed across Active Directory and Windows DNS
Microsoft states: “This article provides a solution to an error when you try to access an application on a website that uses AD FS 2.0.”
Read the guide
Review Find servers that hold FSMO roles before AD/DNS changes
Microsoft states: “This article describes how to find the servers that hold the Flexible Single Master Operation (FSMO) roles in a forest.”
Read the playbook
Scope w32tm /resync command fails with "The computer didn't resync because no time data was available." in observed AD/DNS state
Microsoft states: “This article provides several possible solutions to an error that you may get when you run the w32tm /resync command to synchronize time with a time source.”
Read the briefing
Validate LDAP to Active Directory is disabled with AD/DNS evidence
Microsoft states: “This article provides some information about the issue that anonymous LDAP operations to Active Directory are disabled on domain controllers.”
Read the checklist