Validate Winlogon automatic restart sign-on (ARSO) with AD/DNS evidence
Microsoft states: “During a Windows Update, there are user specific processes that must happen for the update to be complete.”
Read the checklistDSE security knowledge hubMicrosoft 365 & Identity
Microsoft 365 & Identity
Knowledge
Page 6 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Microsoft 365 & Identity knowledge center
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
DSE post stream
760 articlesMicrosoft 365 & Identity
Stage Demote Domain Controllers and Domains with AD/DNS rollback checks
Microsoft states: “This article explains how to remove Active Directory Domain Services (AD DS) by using Server Manager or Windows PowerShell.”
Read the explainer
Trace Active Directory Forest Recovery - Perform initial recovery across Active Directory and Windows DNS
Microsoft states: “Restore the first writeable domain controller in each domain Reconnect each restored writeable domain controller to the network Add the global catalog to a domain controller in the forest root domain.”
Read the guide
Review Safely virtualizing Active Directory Domain Services (AD DS) before AD/DNS changes
Microsoft states: “Beginning with Windows Server 2012, AD DS provides greater support for virtualizing domain controllers by introducing virtualization-safe capabilities.”
Read the playbook
Scope Active Directory Domain Services Replication Priority Boost in observed AD/DNS state
Microsoft states: “Active Directory is a distributed system, which means changes you apply to one domain controller (DC) replicate to other DCs in the system automatically.”
Read the briefing
Validate Determining the Number of Domains Required with AD/DNS evidence
Microsoft states: “This information applies to forests that contain a maximum of 100,000 users and that have a connectivity of 28.8 kilobits per second (Kbps) or higher.”
Read the checklist
Stage Selecting the Forest Root Domain with AD/DNS rollback checks
Microsoft states: “The first domain that you deploy in an Active Directory forest is called the forest root domain.”
Read the explainer
Trace Upgrade domain controllers to a newer version of Windows Server across Active Directory and Windows DNS
Microsoft states: “This article provides background information about Active Directory Domain Services in Windows Server and explains the process for upgrading domain controllers (DCs) from an earlier version of Windows Server.”
Read the guide
Review Active Directory Privileged Accounts and Groups Guide before AD/DNS changes
Microsoft states: “Active Directory Domain Services contains numerous built-in accounts and groups that are granted elevated privileges to perform administrative tasks.”
Read the playbook
Scope Appendix E - Securing Enterprise Admins Groups in Active Directory in observed AD/DNS state
Microsoft states: “Enterprise Admins are, by default, members of the Administrators group in each domain in the forest.”
Read the briefing