Active Directory on Windows Server

Introduce core Active Directory terms—domain, domain controller, tree, forest, global catalog, and DNS—and explain their roles as a prerequisite understanding before installing Active Directory.

Explore methods to install Active Directory domain services, including PowerShell, Server Manager, and the installation wizard, and automate with an unattended dc promo script from an answer file.

Install active directory on Windows Server 2016, configure a static IP (172.16.0.10, 255.255.0.0, no gateway), and install the Active Directory Domain Services role with DNS configured.

Promote this server to a domain controller by creating a forest with 2012 R2 forest and domain functional levels, enabling DNS and a global catalog, and using the post-deployment wizard.

Verify a successful Active Directory installation on the domain controller by checking DNS, Kerberos and LDAP SRV records, and confirming the Netlogon share and the policies folder are present.

Install Active Directory using PowerShell by adding domain services, promote the server to a domain controller in the local domain with DNS installed, then reboot to complete replication.

Use PowerShell to install Active Directory administrative tools (ARSAT tools) on Windows Server by listing features with Get-WindowsFeature, then Install-WindowsFeature ARSAT-roll-tools to enable the AD module.

Discover Active Directory tools such as Active Directory Users and Computers and the Active Directory Administrative Center, powered by PowerShell, to manage replication, domains and trusts, and the schema.

Register the schema management DLL, add the Active Directory schema snap-in, and inspect the user object attributes. Use netdom query fsmo to locate the schema master.

Create and map custom attributes in the Active Directory schema, such as scanner and automobile, to the user class, then restart the domain controller to apply changes.

The global catalog stores a partial attribute list for all domains in the forest and forwards queries for resources in other domains; domain controllers know only objects in their domain.

Configure the global catalog by toggling the ntds settings on a domain controller; Microsoft advises GC in every site, noting replication of changes across the forest.

A domain is a dns namespace with user, computer, and group objects; domain controllers replicate across replication boundary. Joined clients display the domain in computer names, for example sales pc01.local.

Explore how an Active Directory forest comprises multiple domains with two-way trusts and a shared schema. See how parent and child domains form trees and enable cross-domain access.

Explore active directory basics as you view the domain controller, manage user and computer accounts in Active Directory Users and Computers, and join a client computer to the domain.

Join a Windows client from a workgroup to the test local domain by configuring system properties, authenticating with a domain administrator, and rebooting to log in as Marty Jones.

Verify domain join by locating the computer account for Tsql2 in Active Directory users and computers and confirm authentication with Marty Jones's password.

Create and manage Active Directory user accounts, enforce next-logon password changes, manage group memberships, and leverage Active Directory Administrative Center with PowerShell history for efficient administration.

Learn to manage Active Directory computer accounts, join devices to the domain, maintain the trust relationship with domain controllers, and organize machines using organizational units and computer redirection.

Compare Active Directory group types and scopes, showing how distribution and security groups differ, how domain local, global, and universal scopes interact, and how permissions and group memberships work.

Organize a domain with containers and OUs; containers are created by default, cannot be deleted, and cannot host GPOs; OUs host GPOs and enable delegation for user and computer accounts.

Learn to create and manage organizational units in Active Directory, protect them from accidental deletion, enable advanced features, and delegate control to groups to tailor group policy scope.

Follow the client logon flow from a configured IP and DNS to authenticating with a domain controller via Kerberos, guided by DNS service location records and potential failures.

Learn how group policy reduces misconfigurations by applying consistent security and application settings across thousands of users and computers, using local, site, domain, and OU levels, with MSI deployment.

Learn how to create and link group policy objects in the group policy management console, assign them to organizational units, sites, or domains, and understand computer versus user configuration.

Explore how group policy processing order determines precedence from local to domain to OU, and learn mechanisms like block inheritance, enforce, security filtering, and WMI filtering to control policy application.

Master multi-master replication in Active Directory by managing forest and domain operations masters, domain naming, schema, RID, infrastructure, and PDC masters, for reliable object creation, schema changes, and password synchronization.

Locate and manage domain-level operations masters in Active Directory through ADUC and domains and trusts, then transfer or seize roles using ntdsutil for schema, PDC, domain naming, and infrastructure masters.

Domain and forest functional levels require domain controllers to run specific Windows Server versions; raising levels is one-way and forest levels support features like renames and read-only domain controllers.

Raise the domain and forest functional levels using the Active Directory Administrative Center and PowerShell, noting current levels (2012 R2) and the irreversible upgrade to 2016 across the forest.

Deploy a read only domain controller to branch offices with less physical security. Use one-way inbound replication and the allowed and denied Roddick password replication groups to govern account replication.

Learn to deploy a read only domain controller by pre-creating the ROTC account, choosing DNS server and global catalog options, and configuring password replication groups for the Boston branch.