IT Field Manual

This page is the full manual, rendered. It is long on purpose - it is built to be searched, not read front to back. Use Ctrl+F (Cmd+F on a Mac) and search the bracketed tag, for example [GPO-TRIAGE] or [HYB-SCP]. Prefer it offline? Download the raw Markdown

• it opens in VS Code, Obsidian, or any text editor.

A living, searchable operational reference for Windows, Active Directory, Microsoft 365, Entra ID, Intune, and Azure.

CONTENTS

Fast paths — the five things you will look up most

00 — HOW TO USE THIS MANUAL

00.1 — Search tags

Every major block carries a bracketed tag. Search the tag, not the prose. Tags are stable across versions, so a note you write today that says “see [AD-JOIN-FAIL]” still resolves in version 12.

00.2 — Conventions

Placeholders used throughout:

00.3 — Maintenance protocol (how to add to this manual)

This document is only useful if adding to it is frictionless. The rule is: capture on the day it happened, in the format below, and file it under the right tag.

When you learn something, write these seven fields and nothing else:

### [TAG-NN] Short imperative title
Symptom:        What the user or the system reported.
Environment:    OS, role, product version. Enough that Future You knows if it applies.
Actual cause:   The real one, not the first theory.
Fix:            Numbered steps. Commands in full.
Verify:         The command or observation that proves it worked.
Prevention:     What would have stopped this from happening.
Date / source:  When, and who or what told you.

Three rules for the manual:

1. Strip the client. Never file a real hostname, IP, username, or domain. Replace with the placeholder set in §00.2 at the moment of writing, not later. A manual full of MOCKBIZ01 is a manual you cannot hand anyone.
2. Record the fix, not the workaround — and if you used a workaround, label it. A workaround is a modification to the environment, and the environment remembers it long after you forget. Unlabeled workarounds are the single most expensive category of self-inflicted troubleshooting.
3. Date anything Microsoft can change. Portal click-paths, product names, and CLI switches rot. Facts about protocols (Kerberos skew, DNS SRV, NTFS evaluation order) do not. Date the first kind; don’t clutter the second.

Quarterly review, 20 minutes: re-read the 🔄 UPDATED entries and Appendix C. Confirm anything with a date older than a year still holds. Delete anything you have never once searched for.

01 — TROUBLESHOOTING DOCTRINE [DOCTRINE]

Read this section once a year. It is the part that transfers between every technology in this manual, and it is worth more than any individual command.

[DOCTRINE-01] Confirm the component is in the path before you troubleshoot it

Before spending an hour on a component, ask: what mechanism is actually supposed to deliver this?

• Microsoft 365 Apps → the Office CSP over the standard MDM channel.
• A packaged .intunewin Win32 app, a PowerShell script, a remediation → the Intune Management Extension.
• A configuration profile → OMA-DM.
• A drive map → Group Policy Preferences, at logon.
• A domain join → DNS SRV lookup, then Kerberos.

Different pipes, different failure modes. Chasing the wrong pipe is how an afternoon disappears. The classic version: spending hours forcing the Intune Management Extension to install in order to fix a Microsoft 365 Apps deployment — the IME is not in that path at all, and its absence was a symptom of the real problem, not the cause.

[DOCTRINE-02] Read the error text before forming a theory

When a command fails, read what it actually says. Rewriting correct code because you misread an error costs time twice: once to make the change, and again later when the same error reappears and your earlier “fix” is now confusing evidence.

Worked example: New-SmbShare throws “The name has already been shared” (Windows system error 2118). That is not a missing-parameter problem. It is the share already existing from a previous partial run. The error names the cause precisely.

[DOCTRINE-03] Know a diagnostic’s precondition before you run it

Time spent interpreting the output of an inapplicable test is worse than wasted — it injects noise into the picture you are building. Running Test-ComputerSecureChannel on a machine that has not yet joined the domain returns “the local computer is not currently part of a domain,” which is the only answer it could have given.

When a diagnostic returns something confusing, first ask whether it was valid to run at all.

[DOCTRINE-04] The error message describes the symptom, not the cause

Windows error text is generated at the point of failure, not the point of origin.

• “An Active Directory Domain Controller could not be contacted” covers at least five unrelated failures, one of which is a wrong time zone. The DC was contacted. It said no.
• “Bad credentials” on a DC promotion is frequently name resolution or a time hierarchy problem.
• “The device isn’t in Intune” is frequently an empty licensing group two phases upstream.

Decode the message into its candidate causes and test them in order of cheapness. See [ERR] — the master index in §18.

[DOCTRINE-05] A workaround is a change to the environment. Write it down.

The most expensive troubleshooting sessions are the ones where the cause was introduced by you, days earlier, in a step you no longer remember taking.

Canonical example: manually adding a work account through Settings to get past a broken auto-enrollment. It works. Three days later, application deployments silently never install, because that manual method marked the device Personal and Personal-owned devices have deliberately reduced management capability. Nobody connects the two events.

[DOCTRINE-06] Verify negatively, not just positively

“John can open the Sales folder” is half a test. The other half is “Sarah cannot, and cannot even see that it exists.”

Every permission, every targeting rule, every filter has two correct outcomes. Test both or you have tested nothing.

[DOCTRINE-07] A backup you have never restored from is a hypothesis

Same for failover. Same for a LAPS deployment where you never actually retrieved a password. Same for a monitoring alert that has never fired. Proving a control works is a separate task from configuring it, and it is the task that gets skipped.

Record the date you tested. “Backup configured” is not a deliverable; “restore tested 2026-08-14” is.

[DOCTRINE-08] On an inherited system: document first, change second, one thing at a time

If you change five things and something breaks, you have five suspects and no way to bisect.

And: assume anything odd is load-bearing until proven otherwise. The strange scheduled task, the share nobody can explain, the ancient VM everyone forgot — that is frequently how payroll runs.

[DOCTRINE-09] Build foundation before there are users to disturb

OU structure, security groups, share permissions, GPOs, the UPN suffix, and the MDM enrollment policy are all foundation. Build them after you have users and machines and every change requires you to log into client machines, log off, log back on, clear caches, and retest. Build them first and the first user who logs in gets a finished environment.

This is the single largest efficiency difference between a first build and a fifth build.

[DOCTRINE-10] Escalate on cost of being wrong, not on difficulty

Some things you fix. Some things you flag, document, and hand up. The dividing line is not “is this hard” — it is “what happens if my understanding is incomplete.” RDP exposed to the internet, a Domain Admins group with fifteen members, a single point of failure holding all five FSMO roles: report these on day one even when you could technically fix them yourself, because the client needs to own the risk decision.

[DOCTRINE-11] An override makes your diagnostics lie

A configuration override does not only change behavior. It changes what your tests report — and it does so silently. The test still runs, still returns a result, and the result still looks like an answer.

Three unrelated products, three instances of the same failure:

The rules:

1. Remove overrides before testing, not after. A revert verified while an override is active is not verified.
2. Verify at the far end. DNS answering is not mail flowing. A policy tip is not enforcement. Check what the recipient actually received, not what the system reported sending.
3. When a result matches your expectation, ask what the test could not have told you. Agreement is not confirmation. A test that cannot fail is not a test.
4. In an inherited environment, inventory the overrides before you trust any diagnostic. Wildcard DNS records, allow lists, disabled policies, simulation-mode policies, and preset security policies are all invisible until you look for them specifically. Add the inventory to [ASSESS-02].

WHY this ranks alongside [DOCTRINE-07]: an untested backup is a hypothesis. A diagnostic run against an overridden system is worse than a hypothesis — it is a false confirmation, and you will build three more conclusions on top of it before anything contradicts you.

[DOCTRINE-12] Read the screen before you diagnose

Three separate incidents in one project were solved by information already displayed on screen, after time had been spent hunting elsewhere.

The rule: before you form a theory, re-read every banner, confirmation, and error detail already in front of you. Expand the truncated ones.

Diagnostic effort spent before this step is usually wasted, and it is worse than wasted when it produces a plausible wrong theory that then has to be unwound. The screen is a source. Treat it like one.

[DOCTRINE-13] A search that returns only aggregators has told you the company is dead

A directory listing proves a filing existed once. It does not prove a company is trading.

When a company-name search returns nothing but scraped-directory aggregators — ZoomInfo, Manta, Dun & Bradstreet, Yelp, Birdeye, Seamless.AI, yellow.place, government vendor registries — and not one result is the company’s own website — that pattern is the signature of a defunct business. Aggregators never delete records; they are populated once from a public filing and persist indefinitely, which is exactly why a dead company looks well-documented.

The failure mode is reading volume as vitality. Nine hits feels like evidence. It is nine copies of one filing.

Before asserting a company is active, require one of the two strong positives. The state business-entity registry settles the question in about two minutes — active versus administratively dissolved — but most state registries are form-driven applications, so this is a human step, not something you can script or fetch.

Generalizes beyond companies: the same shape appears wherever a record outlives the thing it describes — a DNS record for a decommissioned host, a monitoring entry for a retired server, a license seat for a machine that no longer exists. Ask what would have deleted this record if the thing were gone. If the answer is “nothing,” the record proves nothing. See [VEND-01].

[DOCTRINE-14] Physical inspection answers what documents cannot

Paper describes the part of the world its author touched. Nothing else.

A complete, reconciled set of one vendor’s invoices can be read exhaustively and still say nothing about a second vendor, a decommissioned appliance, an unlabeled system, or anything installed before the first invoice in the set. This is not a defect in the documents — it is the definition of their scope, and it is invisible from inside them because the documents carry no marker where their coverage ends.

One hour walking an environment with a written shot list routinely surfaces things weeks of document analysis cannot: equipment nobody bills for, a device that is racked and cabled but powered off, a vendor sticker from a company that no longer exists, a serial number that converts an estimate into a manufacturer-stated fact. Full procedure at [SITE].

Corollary — front-panel LEDs are primary evidence of operating state and cost nothing to read. A device with every front LED dark is not in service, whatever the cabling, rack position, or documentation says. Photograph the LED panel of every powered device, straight on, and read the states later. A racked appliance that is dark is either abandoned in place or a fault nobody has noticed — different findings, different urgency.

WHY this ranks alongside [DOCTRINE-07]: an untested backup is a hypothesis; a document set assumed to be complete is the same hypothesis wearing different clothes.

[DOCTRINE-15] A cloud migration’s real savings for a small organization is avoided capital spend, not a recurring discount

The generic pitch — “moving to the cloud saves you money on IT” — is not reliably true for a small organization, and treating it as automatically true is a credibility risk with a technically literate buyer. Work the comparison in two separate halves instead of one blended claim.

Recurring cost is usually close to even, sometimes a small win, rarely a dramatic one — and the direction depends entirely on what the organization already owns. If it already holds a license tier that includes cloud storage and identity capacity it isn’t using, the marginal recurring cost of using that capacity is close to zero, because it’s sunk cost. If it does not already own that capacity, a cloud migration is a new recurring cost being introduced, not a savings. Check which situation applies before making any recurring-cost claim — the two produce opposite answers from the same migration.

Capital cost is where the real, defensible number usually lives. Aging on-premises hardware needs periodic replacement regardless of the cloud decision — if any on-premises role survives a migration decision, that capital cost still arrives on schedule. A migration to fully cloud-hosted infrastructure is frequently the only path that actually avoids that recurring capital cycle, not because the cloud is inherently cheaper, but because there is no hardware left to refresh. This is the number to lead with when a decision-maker asks “will this actually save us money” — not a vague claim about operating costs.

Administrative labor does not disappear; it changes shape. A common unstated assumption behind “the cloud needs less maintenance” is that maintenance work goes away. It does not — cloud identity, access, and policy administration still needs a person. What changes is the category of risk: physical hardware failure, with its unplanned emergency-recovery labor, is replaced by the infrastructure provider’s own redundancy, while day-to-day administrative labor continues largely unchanged. State this distinction plainly to a buyer rather than letting “less maintenance” imply “less need for a technician” — overclaiming here is the kind of thing a client remembers and checks against reality within the first year.

Generalization: any total-cost argument that blends a one-time cost with a recurring cost into a single “savings” number should be distrusted until it’s split back into its two halves. The blended number is where the persuasive-but-misleading version of the pitch usually hides. File-share migration mechanics: [FILE-10].

02 — POWERSHELL FUNDAMENTALS [PS]

[PS-01] Discovery — the four commands that make the rest unnecessary

Get-Help <cmdlet>                    # Full help for any cmdlet
Get-Help <cmdlet> -Examples          # Practical usage. Use this one.
Get-Help <cmdlet> -Online            # Opens current Microsoft Learn page in a browser
Get-Command *keyword*                # Find cmdlets by keyword, e.g. Get-Command *user*
Get-Command -Module ActiveDirectory  # Everything a module exposes
Get-Alias                            # Built-in aliases (ls, dir, cls, gci...)
$PSVersionTable                      # Version, edition, OS, build
Update-Help                          # Help files ship empty. Run once per machine, elevated.

Tab autocompletes cmdlets, parameters, and paths. Up arrow cycles history. Ctrl+R reverse-searches history in PS7.

[PS-02] Pipeline and filtering

Command1 | Command2                                    # Pipe objects, not text
Get-Service | Where-Object { $_.Status -eq "Stopped" } # Filter by property; $_ = current object
Get-Process | Sort-Object CPU -Descending
Get-ADUser -Filter * | Select-Object Name, SamAccountName, Enabled
Get-Process | Where-Object CPU -gt 100                 # Simplified syntax, PS3+; no braces needed

Filter left, format right. Push filtering as far upstream as possible — use a cmdlet’s own -Filter parameter before piping to Where-Object. Get-ADUser -Filter * pulls the entire directory across the wire and then discards it locally; Get-ADUser -Filter "Department -eq 'Sales'" filters at the domain controller. On a 20-user lab this is invisible. On a 4,000-user client it is the difference between two seconds and two minutes.

[PS-03] Output and export

Select-Object -Property Name, Value          # Pick properties
Select-Object -First 10 / -Last 10
Format-Table -AutoSize                       # Wide data. ALWAYS LAST in a pipeline.
Format-List                                  # Detail view, property per line
Out-GridView                                 # Sortable/filterable GUI grid (Windows PS)
Export-Csv -Path "file.csv" -NoTypeInformation
Export-Clixml -Path "file.xml"               # Preserves object structure; use for ACL backups
Out-File -FilePath "output.txt"
Get-Content "file.txt"
Get-Content "file.txt" -Tail 20 -Wait        # Live tail, like Linux tail -f

⚠ TRAP — Format-* destroys objects. Anything after Format-Table in a pipeline receives formatting instructions, not data. Get-Process | Format-Table | Export-Csv out.csv produces garbage. Format last, always.

Timestamp your exports so re-runs don’t overwrite:

$Results | Export-Csv -Path "scan_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation

[PS-04] Variables, logic, loops

$var = "value"
$Ports = @(22, 80, 443, 3389)                       # Array
$Config = @{ Domain = "contoso.com"; Site = "RC" }  # Hashtable

if ($x -eq 1) { "Yes" } else { "No" }
foreach ($item in $collection) { $item }            # Statement — faster on large sets
$collection | ForEach-Object { $_ }                 # Pipeline — streams, lower memory

[PSCustomObject]@{ Name = "x"; Value = 1 }          # Build a clean output object

[PS-05] Operators and common parameters

⚠ TRAP — -ErrorAction SilentlyContinue hides the thing you needed to see. It is correct for existence checks (Get-ADUser ... -ErrorAction SilentlyContinue to test whether a user exists). It is wrong as a general habit, because it converts “this failed for a reason” into “this returned nothing.” If a script is silently doing less than you expect, this flag is the first suspect.

[PS-06] Execution policy [PS-EXEC]

Get-ExecutionPolicy -List                                   # See all scopes at once
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass  # This window only; reverts on close
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned
Get-ChildItem .\scripts\*.ps1 | Unblock-File                # Clears mark-of-the-web on copied files

🛑 DANGER — never set Bypass machine-wide on a client’s server. If a persistent setting is genuinely needed, RemoteSigned is the correct one.

[PS-07] Safe-script header template

<#
.SYNOPSIS   One line.
.DESCRIPTION What it does and what it assumes.
Purpose:
Author:
Date:
Environment:      Which client / which tier
Risk Level:       Read-only | Modifies config | Destructive
Rollback Plan:
Tested With -WhatIf:  Yes/No
#>

[PS-08] Bulk operation safety pattern [PS-BULK]

Never run a bulk change straight from a filter. Four steps, always:

# 1. QUERY first — build the target list, change nothing
$Targets = Get-ADUser -Filter * -SearchBase "OU=Employees,OU=Contoso,DC=ad,DC=contoso,DC=com"

# 2. REVIEW the list with your own eyes. Count it. Does the count match expectation?
$Targets | Select-Object Name, SamAccountName
$Targets.Count

# 3. DRY RUN with -WhatIf
$Targets | ForEach-Object { Disable-ADAccount -Identity $_.SamAccountName -WhatIf }

# 4. EXECUTE — only after the -WhatIf output was read, not skimmed

WHY: -WhatIf output is worthless if you scroll past it. The step that catches mistakes is step 2, where the count is wrong and you notice.

[PS-09] Splatting — kills the backtick problem permanently

# FRAGILE — a single trailing space after a backtick breaks this with a confusing parse error
New-ADUser -Name "John Smith" `
    -GivenName "John" `
    -Surname "Smith"

# ROBUST — no continuation characters at all
$Params = @{
    Name           = "John Smith"
    GivenName      = "John"
    Surname        = "Smith"
    SamAccountName = "jsmith"
    Enabled        = $true
}
New-ADUser @Params

⚠ TRAP — the backtick is a line-continuation character and must be the **last character on the line.** A single trailing space after it breaks the command. When a pasted multi-line command fails for no visible reason, collapse it to one line before troubleshooting anything else. Splatting removes this failure mode entirely and is easier to read.

[PS-10] Idempotence — write scripts that survive a partial run

The most common script failure in the field is not a bug. It is re-running a script after it half-succeeded. Guard every create operation:

# Existence check + continue
if (Get-ADUser -Filter "SamAccountName -eq '$Sam'" -ErrorAction SilentlyContinue) {
    Write-Warning "$Sam already exists - skipping"
    continue
}

# Create-or-update instead of create-or-fail
if (Get-SmbShare -Name $Name -ErrorAction SilentlyContinue) {
    Set-SmbShare -Name $Name -FolderEnumerationMode AccessBased -Force
} else {
    New-SmbShare -Name $Name -Path $Path -FullAccess "Authenticated Users" -FolderEnumerationMode AccessBased
}

# Per-item try/catch so one bad row does not abort the other 39
foreach ($U in $Users) {
    try   { New-ADUser @Params }
    catch { Write-Host "FAILED $($U.Sam): $_" -ForegroundColor Red }
}

[PS-11] PowerShell 5.1 vs PowerShell 7 — what actually differs in the field

Practical rule: write scripts you will hand to a client in 5.1-compatible syntax, because 5.1 is on every machine and 7 is not. Use 7 interactively on your own workstation where the better ergonomics pay off.

🔄 UPDATED — cmdlets to stop typing:

03 — CMD ↔ POWERSHELL EQUIVALENTS [PS-CMD]

Both columns work. CMD is often faster to type on someone else’s machine; PowerShell returns objects you can filter and export.

[WIN-INV] Installed-software inventory that actually works

Get-Package and wmic product both miss things. This registry query catches 32-bit and 64-bit MSI and most EXE installers:

$Paths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty $Paths -ErrorAction SilentlyContinue |
    Where-Object DisplayName |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate |
    Sort-Object DisplayName

Per-user installs also live under HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* — add it if you are chasing something a user installed themselves.

Modern alternative when winget is present: winget list. Faster, but only sees what winget knows about.

04 — NETWORK DIAGNOSTICS [NET]

This section is the commands. Section 22 [NETF] is the reasoning. If a result here does not make sense — a ping fails but the port is open, a host has an address but reaches nothing — go to [NETF-01] and work the layers bottom up.

[NET-01] Test-NetConnection — the single most useful networking cmdlet on Windows

Built into PowerShell 5.1+ on every modern Windows machine. Tests DNS resolution, ICMP, and a TCP handshake in one call and returns a structured object.

Test-NetConnection -ComputerName 10.10.10.10 -Port 445
Test-NetConnection -ComputerName fileserver.ad.contoso.com -Port 445
Test-NetConnection -ComputerName 8.8.8.8 -TraceRoute
Test-NetConnection -ComputerName 10.10.10.10 -InformationLevel Quiet   # returns bare $true/$false

⚠ Limitation: one port per call. Loop it ([NET-02]) for a small port list.

⚠ TRAP — ping proves less than you think. A successful ping tests IP reachability to an address you supplied by hand. Domain join uses DNS SRV lookup and Kerberos, and both can fail completely on a network where ping works perfectly. When someone says “but I can ping the server,” that is not evidence about authentication.

[NET-02] Multi-port scan loop (no modules required, PS 5.1+)

$Target = "10.10.10.10"
$Ports  = @(22, 53, 80, 88, 389, 443, 445, 3389)

$Ports | ForEach-Object {
    $r = Test-NetConnection -ComputerName $Target -Port $_ `
            -WarningAction SilentlyContinue -InformationLevel Quiet
    [PSCustomObject]@{
        Port   = $_
        Status = if ($r) { "OPEN" } else { "CLOSED/FILTERED" }
    }
} | Format-Table -AutoSize

Sequential — fine for 5–10 ports, noticeably slow past 50. For larger ranges or whole subnets, use [NET-03].

Change only $Target and $Ports. Everything below those two lines is the engine.

[NET-03] PSnmap — subnet and port-range scanning

Community module that mirrors nmap behavior and returns pipeable objects.

Install-Module -Name PSnmap -Scope CurrentUser      # one-time, needs internet; no admin rights needed

Invoke-PSnmap -ComputerName 10.10.10.10 -Port 22,80,443,3389
Invoke-PSnmap -ComputerName 10.10.10.0/24 -Port 80,443
Invoke-PSnmap -ComputerName 10.10.10.0/24 -Port 22,80,443 -Timeout 500   # ms; raise on slow links

Invoke-PSnmap -ComputerName 10.10.10.0/24 -Port 22,80,443 |
    Where-Object { $_.Open -eq $true } |
    Export-Csv -Path "subnet_scan_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

🛑 DANGER — get written authorization before scanning a client’s network. A port scan is indistinguishable from reconnaissance on the wire, will trip any competent IDS, and can be a contract or legal problem. Scan your own lab freely; scan a client only with a scope in writing.

[NET-04] Traceroute, three ways

# Built in, PS 5.1+ — structured output
Test-NetConnection -ComputerName 8.8.8.8 -TraceRoute

# PS 7+ only — per-hop latency and status
Test-Connection -TargetName 8.8.8.8 -Traceroute
Test-Connection -TargetName 8.8.8.8 -Traceroute -MaxHops 20

# CMD fallback, works anywhere, plain text
tracert 8.8.8.8
tracert -d 8.8.8.8        # skip reverse DNS — much faster
tracert -h 15 8.8.8.8     # hop limit

Numbered hop display from the built-in cmdlet:

$trace = Test-NetConnection -ComputerName 8.8.8.8 -TraceRoute
Write-Host "Destination : $($trace.RemoteAddress)"
Write-Host "Ping Result : $($trace.PingSucceeded)`n"
$n = 1
$trace.TraceRoute | ForEach-Object { Write-Host ("  Hop {0:D2}  ->  {1}" -f $n, $_); $n++ }

A hop showing * is normal. It means that router did not respond to ICMP TTL-exceeded probes. Many ISP and cloud routers drop these silently. It does not indicate a broken route — subsequent hops usually resolve fine.

[NET-05] DNS troubleshooting

Resolve-DnsName ad.contoso.com
Resolve-DnsName ad.contoso.com -Server 10.10.10.10      # bypass the client's configured resolver
Resolve-DnsName -Name _ldap._tcp.dc._msdcs.ad.contoso.com -Type SRV
Resolve-DnsName 10.10.10.10 -Type PTR                    # reverse lookup
Clear-DnsClientCache
Get-DnsClientServerAddress -AddressFamily IPv4           # which DNS servers this NIC is using

nslookup -type=SRV _ldap._tcp.dc._msdcs.ad.contoso.com   # CMD equivalent

Order of DNS suspicion, cheapest first:

1. Is the client pointed at a domain controller for DNS, or at the router / a public resolver? ipconfig /all.
2. Does the domain FQDN resolve to the DC’s LAN address — not a public IP, not an IPv6 global?
3. Do the _ldap._tcp SRV records resolve? This is how a DC is located. An A record alone is not enough.
4. Is there a stale record? Compare Resolve-DnsName output against what the server actually holds.

[NET-06] Standard connectivity triage [NET-TRIAGE]

Work outward. Stop at the first failure — that is your layer.

# 1. Local IP stack
Get-NetIPAddress | Where-Object {$_.AddressFamily -eq "IPv4" -and $_.IPAddress -ne "127.0.0.1"}
Get-NetAdapter | Where-Object Status -eq "Up"

# 2. Default gateway reachable
Get-NetRoute | Where-Object {$_.DestinationPrefix -eq "0.0.0.0/0"}
Test-NetConnection -ComputerName <gateway IP>

# 3. Off-LAN reachability, by IP (removes DNS from the equation)
Test-NetConnection -ComputerName 8.8.8.8 -Port 443

# 4. DNS resolution
Resolve-DnsName google.com
Clear-DnsClientCache

# 5. Internal name resolution / DC location
Resolve-DnsName ad.contoso.com
nltest /dsgetdc:ad.contoso.com

# 6. Specific service reachability
Test-NetConnection fileserver -Port 445

Checklist for the ticket: adapter up → IPv4 address sane (not 169.254.x.x APIPA) → gateway responds → external IP responds → DNS resolves → internal names resolve → target service port open. Escalate when the failure is upstream of the gateway (ISP, firewall, VLAN routing).

169.254.x.x means DHCP failed. The machine self-assigned. Check the DHCP scope for exhaustion, the VLAN assignment on the switch port, and whether a DHCP relay is needed.

[NET-07] Combined port scan + traceroute script

# ============================================================
# Network Scanner + Traceroute
# EDIT ONLY THESE THREE LINES
# ============================================================
$Target      = "10.10.10.10"                # IP or hostname
$PortsToScan = @(22, 80, 443, 3389, 8080)   # TCP ports
$Timeout     = 1000                          # ms. 500-1000 LAN, 3000-5000 VPN/WAN

# ============================================================
# PART 1: PORT SCAN
# ============================================================
Write-Host "`n=== PORT SCAN: $Target ===" -ForegroundColor Cyan
Write-Host "Scanning ports: $($PortsToScan -join ', ')`n"

$ScanResults = $PortsToScan | ForEach-Object {
    $port = $_
    try {
        $result = Test-NetConnection -ComputerName $Target -Port $port `
                    -WarningAction SilentlyContinue -InformationLevel Quiet
        [PSCustomObject]@{ Port = $port; Status = if ($result) { "OPEN" } else { "CLOSED/FILTERED" } }
    } catch {
        [PSCustomObject]@{ Port = $port; Status = "ERROR" }
    }
}
$ScanResults | Format-Table -AutoSize

# ============================================================
# PART 2: TRACEROUTE
# A '*' hop means that router ignored the probe. Not a broken route.
# ============================================================
Write-Host "`n=== TRACEROUTE: $Target ===" -ForegroundColor Cyan
try {
    $TraceResult = Test-NetConnection -ComputerName $Target -TraceRoute -WarningAction SilentlyContinue
    Write-Host "`nDestination : $($TraceResult.RemoteAddress)"
    Write-Host "Ping Success: $($TraceResult.PingSucceeded)`n"
    $HopNumber = 1
    foreach ($Hop in $TraceResult.TraceRoute) {
        Write-Host ("  Hop {0:D2}  ->  {1}" -f $HopNumber, $Hop); $HopNumber++
    }
} catch {
    Write-Host "Traceroute failed: $_" -ForegroundColor Red
}
Write-Host "`n=== Scan Complete ===" -ForegroundColor Green

[NET-08] Port reference — infrastructure

[NET-09] Port reference — services and homelab

Starter $PortsToScan arrays by target type:

[NET-10] DHCP option reference — the two that matter for AD

Configured on whatever serves DHCP, whether that is Windows Server, a firewall, or a router.

Options to leave alone unless you specifically need them:

• 60 / 66 / 67 — PXE boot. Setting these without a PXE server breaks nothing, but setting them wrong will hang machines at boot.
• 44 / 45 — WINS. Unnecessary in any modern environment.

⚠ TRAP — the hidden second field. Many firewall and router appliances have a separate “Domain Name” or “Search Domain” field alongside the numbered DHCP options, and ship with it defaulted to lan or local. If that field disagrees with option 15, clients get an inconsistent suffix and short-name resolution behaves unpredictably. Set both to the AD domain.

🛑 NEVER set client DNS statically. This is the single decision that silently destroys domain controller redundancy — see [AD-FAILOVER]. Option 6 is the correct delivery mechanism: it scales, it survives an IP change, and it is what makes a second DC mean something.

[NET-11] DHCP relay / IP helper

If you want a Windows Server to serve DHCP for a VLAN it does not sit on:

1. Disable DHCP on the router for that VLAN.
2. Configure a DHCP relay (also called IP helper) on the router’s VLAN interface, pointing at the Windows DHCP server’s IP.

WHY: DHCP DISCOVER is a broadcast, and broadcasts do not cross a router. The relay agent forwards them as unicast to the server you name. Prefer Windows DHCP when a server exists — it integrates with DNS registration and is centrally auditable, which a firewall’s DHCP is not.

05 — ACTIVE DIRECTORY OPERATIONS [AD]

[AD-00] Load the module and confirm you can reach a DC

Import-Module ActiveDirectory
Get-ADDomain                         # Fails fast if you can't reach a DC or lack rights
Get-Command -Module ActiveDirectory  # ~150 cmdlets

If Import-Module ActiveDirectory fails on a workstation, RSAT is not installed — see [AD-RSAT]. If it fails on a server, add the feature: Install-WindowsFeature RSAT-AD-PowerShell.

The module talks to AD Web Services on TCP 9389, not LDAP directly. If cmdlets fail while nslookup and ping work, check 9389 and that the ADWS service is running on the DC.

[AD-RSAT] Build a management workstation — stop administering from the DC

# On a Windows 10/11 admin workstation, elevated
Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
Add-WindowsCapability -Online -Name Rsat.DHCP.Tools~~~~0.0.1.0
Add-WindowsCapability -Online -Name Rsat.Dns.Tools~~~~0.0.1.0
Add-WindowsCapability -Online -Name Rsat.FileServices.Tools~~~~0.0.1.0
Add-WindowsCapability -Online -Name Rsat.CertificateServices.Tools~~~~0.0.1.0

# See everything available and its state
Get-WindowsCapability -Online -Name "Rsat*" | Select-Object Name, State

WHY this matters more than it looks: every browser session, every downloaded installer, and every logged-in admin token on a domain controller is a security exposure on the most sensitive machine in the environment. It is also operationally fragile — when DC01 goes offline, the management console you were using goes with it. A management workstation costs nothing and removes both problems.

[AD-01] User lookup

Get-ADUser -Identity "jdoe"
Get-ADUser -Identity "jdoe" -Properties *                       # everything
Get-ADUser -Identity "jdoe" -Properties LastLogonDate, PasswordLastSet, PasswordExpired, LockedOut, MemberOf
Get-ADUser -Filter "Name -like '*Smith*'" -Properties Department
Get-ADUser -Filter * -SearchBase "OU=Staff,DC=ad,DC=contoso,DC=com" |
    Select-Object Name, SamAccountName, Enabled
Get-ADUser -Filter "EmailAddress -eq 'jdoe@contoso.com'"

⚠ TRAP — -Properties * is not free. It pulls every attribute for every matched object. Fine for one user, punishing on a directory-wide query. Name the properties you need.

⚠ TRAP — -Filter quoting. Prefer double-quoted strings with single quotes inside: -Filter "Name -eq 'jdoe'". The {scriptblock} form (-Filter {Name -eq $x}) works but silently mishandles variables in some contexts. The string form is more predictable.

[AD-02] User account actions

Enable-ADAccount  -Identity "jdoe"
Disable-ADAccount -Identity "jdoe"
Unlock-ADAccount  -Identity "jdoe"

Set-ADAccountPassword -Identity "jdoe" -Reset -NewPassword (Read-Host -AsSecureString)
Set-ADUser -Identity "jdoe" -ChangePasswordAtLogon $true

Set-ADUser -Identity "jdoe" -Title "IT Technician" -Department "IT" -Manager "asmith"
Set-ADUser -Identity "jdoe" -UserPrincipalName "jdoe@contoso.com"
Set-ADUser -Identity "jdoe" -Clear Manager                       # remove a value
Set-ADUser -Identity "jdoe" -Replace @{extensionAttribute1="X"}  # arbitrary attribute

Move-ADObject -Identity "CN=John Doe,OU=Employees,..." -TargetPath "OU=Disabled,OU=Contoso,..."

[AD-03] Group management

Get-ADGroup -Identity "HelpDesk" -Properties Description, Members
Get-ADGroupMember -Identity "HelpDesk" | Select-Object Name, objectClass
Get-ADGroupMember -Identity "HelpDesk" -Recursive                    # flattens nested groups
Get-ADPrincipalGroupMembership -Identity "jdoe" | Select-Object Name # every group a user is in

Add-ADGroupMember    -Identity "HelpDesk" -Members "jdoe","asmith"
Remove-ADGroupMember -Identity "HelpDesk" -Members "jdoe" -Confirm:$false

New-ADGroup -Name "GG-Sales" -GroupScope Global -GroupCategory Security -Path "OU=Groups,..."

⚠ Group membership does not take effect until a new logon token is issued. Adding someone to a group and having them “refresh” changes nothing — the token was built at logon. A full log off and log back on is required; locking and unlocking the screen is not a logoff. Verify with whoami /groups on the client.

[AD-04] Computer objects and OUs

Get-ADComputer -Identity "PC001" -Properties *
Get-ADComputer -Filter * -SearchBase "OU=Workstations,..." |
    Select-Object Name, DNSHostName, OperatingSystem, LastLogonDate

Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName
New-ADOrganizationalUnit -Name "Sales" -Path "OU=Contoso,DC=ad,DC=contoso,DC=com" `
    -ProtectedFromAccidentalDeletion $true

[AD-05] Account discovery and hygiene

Search-ADAccount -LockedOut               | Select-Object Name, SamAccountName, LastLogonDate
Search-ADAccount -AccountDisabled -UsersOnly | Select-Object Name, DistinguishedName
Search-ADAccount -AccountExpired
Search-ADAccount -PasswordExpired -UsersOnly
Search-ADAccount -PasswordNeverExpires -UsersOnly | Select-Object Name   # audit finding
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly     | Select-Object Name, LastLogonDate
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -ComputersOnly | Select-Object Name

⚠ LastLogonDate is approximate. It derives from lastLogonTimestamp, which replicates lazily — by default within a 9–14 day window. It is correct for “has this account been used in the last 90 days” and wrong for “did they log in this morning.” For precise data you must query lastLogon on every DC and take the highest value, or read Security event 4624.

[AD-06] Health and infrastructure checks [AD-HEALTH]

# Directory health — run after any change and during every maintenance window
dcdiag /v
dcdiag /test:dns
dcdiag /test:replications

# Replication
repadmin /replsummary            # any error here is urgent
repadmin /showrepl
repadmin /showrepl * /csv > repl.csv
repadmin /syncall /AdeP          # force replication from this DC to all partners

# Roles and topology
netdom query fsmo
Get-ADDomainController -Filter * | Format-Table Name, HostName, IPv4Address, Site, IsGlobalCatalog, OperatingSystem
Get-ADForest  | Format-List Name, ForestMode, DomainNamingMaster, SchemaMaster, GlobalCatalogs
Get-ADDomain  | Format-List Name, DNSRoot, NetBIOSName, DomainMode, PDCEmulator, RIDMaster, InfrastructureMaster

# Time — a Kerberos dependency
w32tm /query /status
w32tm /query /source        # must NOT be "Local CMOS Clock" on the PDC emulator
w32tm /monitor              # offset across every DC in the domain

# Licensing / evaluation expiry
slmgr /dlv

[AD-07] Time configuration — a foundation item, not an afterthought [AD-TIME]

Why 5 minutes and not some other number: Kerberos authenticates using an encrypted timestamp, so skew beyond the tolerance is rejected as a possible replay attack. The full ticket exchange is at [SECF-10]. Clock skew is also what silently destroys log correlation — [SECF-17].

Kerberos rejects tickets with more than five minutes of clock skew. Every domain member slaves its clock to the PDC emulator. If the PDC drifts, every authentication in the environment fails at once — and it presents to users as “everything is broken,” not as a clock problem.

On the PDC emulator (the first DC by default) — anchor to an external source:

w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9" /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /resync
w32tm /query /status

On every other DC and every member server — follow the domain hierarchy:

w32tm /config /syncfromflags:domhier /update
Restart-Service w32time
w32tm /resync
w32tm /query /source

🛑 On a virtualized domain controller, disable host time synchronization. A VM pulling time from the Hyper-V Time Synchronization integration service believes it is an authoritative stratum-1 source, while Active Directory expects it to take time from the hierarchy rooted at the PDC emulator. The result is a competing time hierarchy and intermittent, hard-to-diagnose Kerberos failures.

# On the Hyper-V host
Get-VMIntegrationService -VMName "DC02" -Name "Time Synchronization" | Disable-VMIntegrationService

# On the DC after promotion
w32tm /config /syncfromflags:domhier /update
Restart-Service w32time
w32tm /query /source     # must NOT say "VM IC Time Synchronization Provider"

Check skew between a client and a DC in five seconds:

w32tm /stripchart /computer:10.10.10.10 /samples:3 /dataonly

⚠ Time zone is a Kerberos dependency. A laptop imaged in one time zone and deployed in another has a one-hour offset. Kerberos tolerates five minutes. The domain join fails with “An Active Directory Domain Controller could not be contacted” — which says nothing about clocks. Set the time zone before attempting any join.

[AD-08] The AGDLP group model [AD-AGDLP]

Accounts into Global groups, Global groups into Domain Local groups, Permissions onto the Domain Local group.

$OU = "OU=Groups,OU=Contoso,DC=ad,DC=contoso,DC=com"

# Tier 1 — role groups (WHO SOMEONE IS)
"GG-Sales","GG-Accounting","GG-IT","GG-AllEmployees" | ForEach-Object {
    New-ADGroup -Name $_ -GroupScope Global -GroupCategory Security -Path $OU
}
Add-ADGroupMember -Identity "GG-AllEmployees" -Members "GG-Sales","GG-Accounting","GG-IT"

# Tier 2 — resource groups (WHAT ACCESS IS GRANTED)
"DL-Company-Modify","DL-Sales-Modify","DL-Sales-Read","DL-Accounting-Modify","DL-IT-Modify" |
  ForEach-Object {
    New-ADGroup -Name $_ -GroupScope DomainLocal -GroupCategory Security -Path $OU
}

# Nest role into resource
Add-ADGroupMember -Identity "DL-Company-Modify"    -Members "GG-AllEmployees"
Add-ADGroupMember -Identity "DL-Sales-Modify"      -Members "GG-Sales"
Add-ADGroupMember -Identity "DL-Accounting-Modify" -Members "GG-Accounting"
Add-ADGroupMember -Identity "DL-IT-Modify"         -Members "GG-IT"

WHY two tiers when one works? In a single domain you can put a Global group directly on an ACL and it functions. The separation buys you this: when someone asks why can Sales write to this folder, the answer is one entry on that folder’s ACL. When auditors need read access for a month, you add them to DL-Sales-Read and remove them later — you never touch the folder again. Changing group membership is instant and reversible. Re-permissioning a folder tree is neither.

🛑 NEVER assign permissions to an individual user account. Not once, not temporarily. Direct user entries on an ACL are invisible to any group-based audit, and they are why departed employees keep access to things nobody can explain.

[AD-09] UPN suffix management [AD-UPN]

# Add the routable suffix first (GUI: AD Domains and Trusts > right-click top node > Properties > UPN Suffixes)
# Then rewrite existing users:
Get-ADUser -Filter * -SearchBase "OU=Employees,OU=Contoso,DC=ad,DC=contoso,DC=com" |
    ForEach-Object { Set-ADUser $_ -UserPrincipalName "$($_.SamAccountName)@contoso.com" }

# Single user
Set-ADUser -Identity jsmith -UserPrincipalName "jsmith@contoso.com"

# Verify before and after
Get-ADUser -Filter * -SearchBase "OU=Employees,..." -Properties UserPrincipalName |
    Select-Object SamAccountName, UserPrincipalName | Sort-Object SamAccountName

WHY this exists: the UPN suffix must be a domain the organization actually owns and has verified in Entra ID, because it becomes the cloud sign-in name. A .local internal domain can never be verified, so every account has to be rewritten before hybrid identity will work. Set the suffix in Phase 9 before creating any users and this step disappears permanently — see [AD-BUILD].

[AD-10] Bulk user creation with unique passwords

Import-Module ActiveDirectory
$OU        = "OU=Employees,OU=Contoso,DC=ad,DC=contoso,DC=com"
$UPNSuffix = "contoso.com"
$HomeShare = "\\SITE-DC01\Home"

function New-StrongPassword {
    # Ambiguous characters (0/O, 1/l/I) deliberately omitted — they generate support calls
    $chars = 'abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%'
    -join ((1..16) | ForEach-Object { $chars[(Get-Random -Maximum $chars.Length)] })
}

$Users = @(
    @{Sam="jsmith";   First="John";  Last="Smith";   Dept="Sales";      Group="GG-Sales"},
    @{Sam="sjohnson"; First="Sarah"; Last="Johnson"; Dept="Accounting"; Group="GG-Accounting"},
    @{Sam="mtorres";  First="Mike";  Last="Torres";  Dept="IT";         Group="GG-IT"}
)

$Report = foreach ($U in $Users) {
    if (Get-ADUser -Filter "SamAccountName -eq '$($U.Sam)'" -ErrorAction SilentlyContinue) {
        Write-Warning "$($U.Sam) already exists - skipping"; continue
    }
    $Password = New-StrongPassword
    try {
        $Params = @{
            Name                  = "$($U.First) $($U.Last)"
            GivenName             = $U.First
            Surname               = $U.Last
            SamAccountName        = $U.Sam
            UserPrincipalName     = "$($U.Sam)@$UPNSuffix"
            DisplayName           = "$($U.First) $($U.Last)"
            Department            = $U.Dept
            Path                  = $OU
            AccountPassword       = (ConvertTo-SecureString $Password -AsPlainText -Force)
            Enabled               = $true
            ChangePasswordAtLogon = $true
            HomeDrive             = "H:"
            HomeDirectory         = "$HomeShare\$($U.Sam)"
        }
        New-ADUser @Params
        Add-ADGroupMember -Identity $U.Group -Members $U.Sam
        Write-Host "Created $($U.Sam)" -ForegroundColor Green
        [PSCustomObject]@{ User=$U.Sam; UPN="$($U.Sam)@$UPNSuffix"; Password=$Password }
    }
    catch { Write-Host "FAILED $($U.Sam): $_" -ForegroundColor Red }
}

$Report | Export-Csv "C:\Temp\NewUsers.csv" -NoTypeInformation
Write-Host "`nCredentials at C:\Temp\NewUsers.csv - deliver securely, then DELETE." -ForegroundColor Yellow

🛑 Unique passwords, never a shared default. Generating one per account and forcing a change at first logon is barely more work, and a shared default is a finding in every security review ever written. Build the habit where it costs nothing.

🛑 The credential CSV is a live secret. Deliver by a channel separate from the usernames, then delete the file. Do not leave it in C:\Temp on a client’s server.

[AD-11] FSMO roles — what they are and what breaks

netdom query fsmo

# Graceful transfer (current holder is online and healthy)
Move-ADDirectoryServerOperationMasterRole -Identity "SITE-DC02" `
    -OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster

# Seizure (holder is permanently gone) — see SOP-07 before running this
Move-ADDirectoryServerOperationMasterRole -Identity "SITE-DC02" `
    -OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster,SchemaMaster,DomainNamingMaster -Force

🛑 -Force performs a seizure and it is one-way. The old holder must never be brought back online afterward. If the DC is recoverable, repair it and let replication converge instead.

[AD-12] AD Recycle Bin

Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target 'ad.contoso.com'
Get-ADOptionalFeature -Filter 'name -like "Recycle Bin Feature"'

# Restore a deleted user
Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*Smith*"' -IncludeDeletedObjects
Get-ADObject -Filter 'SamAccountName -eq "jsmith"' -IncludeDeletedObjects | Restore-ADObject

🛑 Enable it before you need it. The Recycle Bin only protects objects deleted after it is enabled, and it cannot be turned off once on. It converts “restore the whole directory from backup” into a two-minute undelete. There is no reason not to enable it on day one, and almost every environment you inherit will not have it.

[AD-13] System State backup

Install-WindowsFeature Windows-Server-Backup

# One-off
wbadmin start systemstatebackup -backupTarget:E: -quiet

# Scheduled nightly
$Policy = New-WBPolicy
Add-WBSystemState -Policy $Policy
$Target = New-WBBackupTarget -VolumePath "E:"
Add-WBBackupTarget -Policy $Policy -Target $Target
Set-WBSchedule -Policy $Policy -Schedule 22:00
Set-WBPolicy -Policy $Policy -Force

Get-WBSummary        # verify

Then test a restore, and write down the date you tested it. See [DOCTRINE-07].

[AD-14] Windows LAPS [SEC-LAPS]

The reason LAPS exists in one line: the SAM stores password hashes, and a hash from one machine authenticates to every other machine sharing that local password — no cracking required. See [SYSF-05].

# One-time forest schema extension — run as a Schema Admin
Update-LapsADSchema -Verbose

# Allow computers in an OU to write their own password
Set-LapsADComputerSelfPermission -Identity "OU=Workstations,OU=Contoso,DC=ad,DC=contoso,DC=com"

# Who can READ the passwords for that OU?
Find-LapsADExtendedRights -Identity "OU=Workstations,OU=Contoso,DC=ad,DC=contoso,DC=com"

# Retrieve a password — THIS is the step that proves the pipeline works
Get-LapsADPassword -Identity "WS-SALES01" -AsPlainText

# Force an immediate rotation (e.g. after a technician used the password)
Reset-LapsPassword

# Force a policy processing cycle on the client
Invoke-LapsPolicyProcessing

# Collect diagnostics when it isn't working
Get-LapsDiagnostics

GPO settings — Computer Configuration > Policies > Administrative Templates > System > LAPS:

• Configure password backup directory = Active Directory (or Microsoft Entra ID for cloud-only devices)
• Password Settings = all four character sets, length 14+, age 30 days
• Enable password encryption = Enabled (requires Windows Server 2016 domain functional level or higher)

🛑 LAPS is not optional. Without it, every workstation shares one local administrator password. One compromised machine hands an attacker local administrator on every machine in the environment — this is the standard lateral movement path in ransomware incidents. Windows LAPS is built into current Windows at no cost. Its absence is a finding on any security assessment.

Deploying it is half the job. Retrieving an actual password is the other half. A LAPS GPO that was never verified end to end is a LAPS deployment you cannot rely on during an incident.

[AD-15] Account lockout triage — the source matters more than the unlock [AD-LOCKOUT]

Before tightening the lockout threshold, read [SECF-02]. A low threshold does little against password spraying and turns it into a denial-of-service against your own users. MFA is the control; lockout is not.

# 1. Confirm the lockout
Search-ADAccount -LockedOut | Select-Object Name, SamAccountName, LastLogonDate

# 2. Find WHERE the bad attempts came from — run on the PDC emulator
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4740} -MaxEvents 20 |
    Format-List TimeCreated, Message

# Bad password attempts (4771 Kerberos pre-auth failed / 4625 logon failure)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4771; StartTime=(Get-Date).AddHours(-2)} |
    Select-Object TimeCreated, @{n='User';e={$_.Properties[0].Value}}, @{n='Client';e={$_.Properties[6].Value}}

# 3. Unlock only after finding the source
Unlock-ADAccount -Identity "jdoe"

# 4. Clear stale credentials on the offending device
cmdkey /list
cmdkey /delete:<target-name>

Event 4740 names the calling computer. That is your actual culprit.

Real causes, in order of frequency:

1. A phone or tablet with a stale saved Wi-Fi / Exchange / VPN password
2. A mapped drive reconnecting with cached credentials
3. A scheduled task or Windows service running as the user
4. A stale RDP or console session on another machine
5. Credential Manager entries
6. An actual forgotten password — least common

Unlocking without finding the source means it locks again in minutes and you have taught the user that IT does not fix things.

06 — GREENFIELD BUILD ORDER [AD-BUILD]

The order below is deliberate. Every phase assumes the previous one is complete and verified. Follow it top to bottom and you will not have to redo anything.

Estimated time on a competent second pass: Phases 0–9 in one working day, 10–14 in a second. The first time takes three times that, and that is normal.

PHASE 0 — Design decisions [BUILD-P0]

Do this on paper before touching hardware.

0.1 Domain name

🛑 WHY .local is a permanent tax:

• Reserved by RFC 6762 for multicast DNS. It is not a real top-level domain, cannot be registered, and can never be verified in Entra ID.
• Public certificate authorities will not issue certificates for it.
• It collides with Bonjour/Avahi service discovery on macOS, iOS, printers, and Linux.
• It forces split-brain DNS workarounds later.
• Microsoft has advised against it since the Server 2008 era.

You will inherit this. A large share of SMB domains in the field are .local. Renaming an AD domain is technically possible (rendom) but disruptive enough that the standard answer is to live with it and add a routable UPN suffix ([AD-UPN]). Know the workaround, know why it is needed, and never create a new one.

0.2 Naming conventions

0.3 Addressing plan

Write down and keep: server subnet and VLAN · static range reserved for infrastructure (typically .1–.50) · DHCP scope range · gateway · DNS servers to hand out · planned IP of every server.

0.4 Cloud tenant

Create the tenant during design, not during Phase 9. Tenant names are globally unique and first-come. The name you want may already be taken, and you want to discover that before anything is built around it.

0.5 Licensing prerequisites

🛑 You cannot convert an evaluation Windows Server to licensed while it holds the AD DS role. Microsoft blocks in-place conversion on a domain controller. To convert you must demote, convert, then re-promote. Check remaining time with slmgr /dlv and plan before the timer runs out.

0.6 Public DNS and mail — decide before you build

The client’s public DNS is a design input, not a Phase 9 detail. Establish three things on paper:

🛑 Check for DNSSEC before choosing a DNS hosting model, not after starting the migration. Discovering it mid-cutover costs a day and a mail outage.

0.7 Credential handling

Create the vault entry before creating the first password. It must contain:

• Local administrator password
• DSRM password — needed exactly once, during directory recovery, and reliably the one nobody wrote down
• Domain administrator account
• A dedicated break-glass account
• Tenant global administrator

WHY break-glass: so a Conditional Access misconfiguration cannot lock every administrator out of the tenant at once. Make it cloud-only on .onmicrosoft.com, exclude it from all CA policies, secure it with a hardware key, and alert on its use. It should be sterile: no mailbox, no daily use, no licensed services beyond what sign-in requires.

PHASE 1 — Server base build [BUILD-P1]

Steps 5 and 6 are painful to reverse after promotion.

1. Install Windows Server, Standard edition, Desktop Experience.
2. Set a strong local Administrator password. Record it in the vault immediately.
3. Patch fully. Reboot. Patch again until no updates remain.
4. Set the correct time zone.
5. Rename the server to its final hostname. Reboot.
6. Set the static IP: address, mask, gateway per 0.3. Preferred DNS = the server’s own static IP; Alternate DNS = 127.0.0.1.
7. Configure storage: OS on one volume, data on a separate volume.
8. Install vendor drivers and update firmware.

WHY rename before promotion: renaming a member server is a reboot. Renaming a domain controller requires netdom computername plus service principal name cleanup and carries real risk. Two minutes of forethought avoids an hour of repair.

✅ VERIFY

Get-ComputerInfo | Select-Object CsName, OsName, WindowsVersion, TimeZone
Get-NetIPConfiguration
Get-Volume

PHASE 2 — First domain controller, DNS, time [BUILD-P2]

2.1 Promotion

1. Server Manager → Add Roles and Features → Active Directory Domain Services. DNS installs with it.
2. Click the notification flag → Promote this server to a domain controller.
3. Add a new forest, root domain name from 0.1.
4. Forest and domain functional level: highest available.
5. Check DNS server and Global Catalog.
6. Set the DSRM password. Record it in the vault now.
7. The DNS delegation warning is expected for a new forest. Continue.
8. Reboot.

PowerShell equivalent:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName "ad.contoso.com" -DomainNetbiosName "CONTOSO" `
    -InstallDns -DomainMode WinThreshold -ForestMode WinThreshold `
    -SafeModeAdministratorPassword (Read-Host -AsSecureString -Prompt "DSRM password")

2.2 DNS hygiene — immediately after reboot

1. Forwarders. DNS Manager → server Properties → Forwarders. Add upstream resolvers (1.1.1.1, 8.8.8.8) or the client’s filtering service.

   Add-DnsServerForwarder -IPAddress 1.1.1.1, 8.8.8.8
   Get-DnsServerForwarder
   

2. Reverse lookup zone for the server subnet. Two minutes, and it is what makes nslookup <ip> work when you are troubleshooting under pressure.

   Add-DnsServerPrimaryZone -NetworkID "10.10.10.0/24" -ReplicationScope Domain
   

3. Scavenging. DNS server Properties → Advanced → Enable automatic scavenging, 7 days. Set aging on the forward zone.

   Set-DnsServerScavenging -ScavengingState $true -ScavengingInterval 7.00:00:00 -ApplyOnAllZones
   

⚠ TRAP — IPv6 registration on a DC.

Run Resolve-DnsName ad.contoso.com. If public IPv6 addresses appear (typically ISP-assigned 2xxx: globals), domain members will try to reach the DC over an address that is not reliably routable inside the VLAN. This produces credential errors and DC promotion failures that look like authentication problems.

🛑 Do NOT unbind IPv6 from the adapter. Microsoft explicitly recommends against disabling IPv6 on domain controllers; Windows components assume it is present and unbinding produces obscure failures harder to diagnose than whatever it was meant to fix.

Correct fixes, in order of preference:

1. Stop the router from advertising a global IPv6 prefix on the server VLAN. Router-side change, fixes the cause.
2. If IPv6 is wanted internally, use Unique Local Addresses with stable router advertisements rather than dynamic ISP prefixes.
3. Prevent registration of the unwanted addresses in DNS rather than disabling the stack.

Turning off router advertisements is only step one. Addresses already on the NIC persist until the interface drops them, and AAAA records already in the zone persist until removed or scavenged. Restarting the adapter is not enough.

# 1. See what the DC actually holds now
Get-NetIPAddress -AddressFamily IPv6 | Select-Object InterfaceAlias, IPAddress, PrefixOrigin, SuffixOrigin

# 2. Reboot after disabling router advertisements — this drops SLAAC-assigned addresses

# 3. Delete the stale AAAA records
Get-DnsServerResourceRecord -ZoneName "ad.contoso.com" -RRType AAAA |
    Remove-DnsServerResourceRecord -ZoneName "ad.contoso.com" -Force

# 4. Force re-registration
ipconfig /registerdns
Restart-Service netlogon

# 5. Verify — only the A record should remain
Resolve-DnsName ad.contoso.com

2.3 Time

See [AD-TIME]. Configure the external anchor on the PDC emulator now, not later.

✅ VERIFY BEFORE PHASE 3

dcdiag /v                  # expect all tests passing
nslookup ad.contoso.com    # returns the DC's LAN IP, nothing else
netdom query fsmo          # all five roles listed
w32tm /query /source       # an external NTP server, NOT "Local CMOS Clock"
Get-DnsServerForwarder

PHASE 3 — Backup and AD Recycle Bin [BUILD-P3]

Do this before creating a single object. See [AD-12] and [AD-13].

PHASE 4 — DHCP and client DNS delivery [BUILD-P4]

Install-WindowsFeature DHCP -IncludeManagementTools
Add-DhcpServerInDC

Add-DhcpServerv4Scope -Name "LAN" -StartRange 10.10.10.100 -EndRange 10.10.10.200 `
    -SubnetMask 255.255.255.0

# Hand out BOTH domain controllers as DNS, in order
Set-DhcpServerv4OptionValue -ScopeId 10.10.10.0 `
    -DnsServer 10.10.10.10,10.10.10.11 `
    -DnsDomain "ad.contoso.com" `
    -Router 10.10.10.1

🛑 The DHCP pool must not overlap your static addresses.

This is the most commonly missed step on consumer and prosumer firewalls, which frequently default the pool to the entire subnet — .1 through .254. If your gateway is .1 and your DCs are .10 and .20, those addresses sit inside the pool and DHCP is free to lease them to a client.

The failure is intermittent and vicious. Everything works until the day a laptop is handed the DC’s address. Then authentication, DNS, and file services fail simultaneously across the whole site, and the cause is invisible from the server.

Add-DhcpServerv4ExclusionRange -ScopeId 10.10.10.0 -StartRange 10.10.10.1 -EndRange 10.10.10.99
Get-DhcpServerv4ExclusionRange -ScopeId 10.10.10.0

On a firewall appliance, set the pool’s start address above your static block instead. Also check for a separate Search Domain / Domain Name field — see the trap in [NET-10].

✅ VERIFY FROM A CLIENT, NOT FROM THE SERVER

ipconfig /all                      # both DCs listed as DNS servers
nslookup ad.contoso.com
nltest /dsgetdc:ad.contoso.com

PHASE 5 — OU structure and container redirection [BUILD-P5]

$Root = "DC=ad,DC=contoso,DC=com"
New-ADOrganizationalUnit -Name "Contoso" -Path $Root -ProtectedFromAccidentalDeletion $true
$Org = "OU=Contoso,$Root"

"Employees","Workstations","Servers","Groups","ServiceAccounts","Disabled" | ForEach-Object {
    New-ADOrganizationalUnit -Name $_ -Path $Org -ProtectedFromAccidentalDeletion $true
}

Resulting tree:

ad.contoso.com
├── Domain Controllers        (built-in — leave alone)
├── CN=Users                  (built-in container — NO GPO reaches here)
├── CN=Computers              (built-in container — NO GPO reaches here)
└── OU=Contoso                ← everything you build
    ├── OU=Employees
    ├── OU=Workstations
    ├── OU=Servers
    ├── OU=Groups
    ├── OU=ServiceAccounts
    └── OU=Disabled

🛑 Do NOT name top-level OUs “Users” or “Computers”. Those names collide with the built-in containers CN=Users and CN=Computers, which already exist at the domain root. Beyond the collision, those containers have two hard limitations: you cannot create OUs inside them, and you cannot link a GPO to them. Anything sitting in them receives only the Default Domain Policy.

5.2 Redirect the default containers — the one command nobody runs

redircmp "OU=Workstations,OU=Contoso,DC=ad,DC=contoso,DC=com"
redirusr "OU=Employees,OU=Contoso,DC=ad,DC=contoso,DC=com"

WHY this matters so much: by default, every machine that joins the domain lands in CN=Computers, where no GPO can reach it. That is the number one cause of “the new PC didn’t get its settings.” redircmp changes the default landing spot to a real OU, so every future machine receives the workstation baseline automatically with no manual step. It converts a checklist item everyone forgets into something that cannot be forgotten.

✅ VERIFY

Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName
Get-ADDomain | Select-Object ComputersContainer, UsersContainer

PHASE 6 — Security groups [BUILD-P6]

See [AD-AGDLP]. Build both tiers before any user or any permission exists.

PHASE 7 — File services [BUILD-P7]

See [FILE] — Section 08.

PHASE 8 — Group Policy [BUILD-P8]

See [GPO] — Section 07.

PHASE 9 — Cloud identity, before creating users [BUILD-P9]

See [HYB] — Section 09. This phase sits here for one reason: the UPN suffix is a property of every user account. Setting it correctly at creation costs nothing. Fixing it afterward means rewriting every account in the directory.

🔄 Complete the full public DNS record set in this phase, at the same sitting as domain verification. Verifying a domain (the MS= TXT record) is enough to set a UPN suffix and run Entra Connect, so it is tempting to stop there and move on to identity work. That defers work that has to be done anyway and does it later under worse conditions — with users already synced, already licensed, and already expecting a working mailbox. A verified-but-unconfigured domain is the most common half-finished state in an SMB tenant, and its signature is “we can send but we can’t receive.” Full record set and procedure: §28 [DNS-MAIL-00]; pre-flight: [DNS-MAIL-PRE].

PHASE 10 — Create users [BUILD-P10]

See [AD-10]. Script it from the first user, not the tenth. The script is the documentation.

PHASE 11 — Build and join workstations [BUILD-P11]

See [WIN] — Section 13.

PHASE 12 — Intune policy and applications [BUILD-P12]

See [MDM] — Section 10.

PHASE 13 — Second DC and real redundancy [BUILD-P13] [AD-FAILOVER]

Adding DC02 is the easy part. Making the environment actually fail over is the part that gets skipped.

13.1 Build DC02

1. Independent hardware, or a VM on an always-on hypervisor host. Not a desktop that gets powered off.
2. If virtualized on Hyper-V, attach to an External virtual switch. The Default Switch is NAT and cannot reach the LAN.
3. Disable host time synchronization before promotion — see [AD-TIME].
4. Base build as Phase 1. Static IP. Preferred DNS = DC01, Alternate = 127.0.0.1.
5. Join to the domain as a member server first, reboot, then promote. Direct promotion of a non-joined server fails more often and the credential error it produces is misleading.
6. Add AD DS role → Promote → Add a domain controller to an existing domain → DNS server checked → Global Catalog checked → DSRM password to the vault → replicate from DC01.
7. Install management tools: Install-WindowsFeature GPMC, RSAT-AD-Tools, RSAT-DNS-Server
8. Set time to follow the domain hierarchy.

⚠ Domain controllers do not live in your OU=Servers. Promoting a server moves its computer object into the built-in Domain Controllers OU, and it stays there. That OU is where the Default Domain Controllers Policy is linked, and that policy grants the user rights a DC needs to function. Moving a DC out of it breaks authentication in ways that are difficult to diagnose. OU=Servers is for member servers; in a single-server lab it will legitimately sit empty. Build it anyway.

13.2 Wire up the redundancy — the part that is usually missed

# Cross-point DNS client settings
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("10.10.10.11","127.0.0.1")  # on DC01
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("10.10.10.10","127.0.0.1")  # on DC02

# DHCP failover
Add-DhcpServerv4Failover -Name "DC01-DC02" -PartnerServer "SITE-DC02.ad.contoso.com" `
    -ScopeId 10.10.10.0 -LoadBalancePercent 50

🛑 A second DC does not create redundancy by itself. If clients have only one DNS server address they cannot locate the second DC when the first is down, because they cannot resolve the _ldap._tcp SRV records that find a domain controller.

🛑 A DC on a machine that gets turned off is worse than no second DC. It accumulates replication lag and can serve stale directory data when it comes back. Either give it always-on hardware or demote it properly when the lab is idle.

13.3 How to test failover correctly

The naive test is worthless. Powering off DC01 and logging into a client proves nothing: Windows caches the last several domain logons locally and will authenticate a previously-seen user with no domain controller reachable at all.

Do this instead:

1. Fix client DNS delivery first — both DCs, via DHCP. Without this, the test is meaningless.
2. On a test client, use an account that has never logged into that machine (or clear cached credentials for the test account). Cached credentials are exactly what invalidates the naive test.
3. Power off DC01.
4. On the client: nltest /dsgetdc:ad.contoso.com — it must return DC02.
5. Log in with the never-before-used account. Success proves live authentication against DC02.
6. gpresult /r — confirm policy applied and note which DC it came from.
7. Open a mapped drive. If shares live only on DC01, they are gone — file services were never made redundant, only the directory was.
8. Power DC01 back on. Run repadmin /replsummary and confirm replication converges with no errors.

Supporting evidence that an environment still assumes one DC: Group Policy Management fails to open while DC01 is down and has to be manually pointed at DC02. That is the environment telling you.

✅ VERIFY REPLICATION

Get-ADDomainController -Filter * | Format-Table Name, HostName, Site, IsGlobalCatalog
repadmin /replsummary        # no errors, no large deltas
repadmin /showrepl
dcdiag /v
dcdiag /test:dns

PHASE 13.5 — Azure Arc (optional) [AZ-ARC]

Azure Arc projects on-premises servers into Azure as managed resources — single inventory, Azure Policy compliance, Update Manager, Log Analytics, and Defender for Cloud across on-prem and cloud.

Prerequisites that are not obvious:

• An Azure subscription. A Microsoft 365 subscription is not one. They are separate billing constructs.
• Azure RBAC, which is separate from Entra roles. Being Global Administrator in Entra grants you nothing in Azure. See [AZ-RBAC-VS-ENTRA].
• The Azure Connected Machine Onboarding or Contributor role at the target resource group.

Azure portal > Subscriptions > [subscription] > Access control (IAM)
  > Add role assignment > Contributor > assign to your daily admin account

# If NO account has access at all:
Entra admin center > Properties
  > Access management for Azure resources = Yes   (temporarily elevates the Global Admin)
  > assign a proper RBAC role, then set this back to No

Onboard: Azure portal → Azure Arc → Machines → Add → Generate script → run on each server as administrator.

Two failures you will hit:

# 1. "azcmagent is not recognized" — the installer added it to PATH, but your session predates that
& "C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe" show

# 2. InvalidOnboardToken — the generated script's token is short-lived
& "C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe" disconnect --force
& "C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe" connect `
    --resource-group "rg-name" --tenant-id "<tenant>" `
    --location "<region>" --subscription-id "<sub>"

✅ VERIFY: azcmagent show → Agent Status : Connected, and the machine appears as Connected in Azure Arc → Machines.

PHASE 14 — Operations and handover [BUILD-P14]

None of this is interesting. All of it is what keeps you on the account.

14.1 Backup and recovery

• System State backup of every DC, nightly, written off the server
• File data backed up with versioning and an offsite copy
• 3-2-1: three copies, two media types, one offsite
• Test a restore and record the date you tested it

14.2 Documentation — these are deliverables, not notes

• Network topology diagram, one page, current
• IP and hostname register
• AD structure: OUs, groups, and what each group grants
• GPO register: name, link, purpose, last reviewed
• Credential vault entries, complete, including DSRM and break-glass
• Runbooks — the SOPs in Section 15
• Licensing register: what is owned, what it entitles, renewal dates
• Evaluation and certificate expiry dates, with calendar reminders

14.3 Security hygiene

• LAPS deployed and verified retrievable
• Separate accounts: daily user, admin account, break-glass. Never browse the internet from a DC.
• MFA on every administrator
• Domain Admins membership reviewed quarterly — it should be nearly empty
• Remote access via RMM or VPN. Never RDP exposed to the internet.
• A Disabled OU with a defined retention period

14.4 Monitoring

• Backup success/failure alerting — the single most valuable alert you can configure
• Disk space on every server volume
• AD replication health
• Certificate and license expiry
• Failed logon spikes and account lockout patterns

07 — GROUP POLICY [GPO]

[GPO-01] The rule that trips everyone

Group Policy applies based on where the user or computer object sits in the OU tree. It does not apply to groups, and it does not care where groups live.

OUs scope policy. Groups filter policy.

Linking a GPO to an OU full of security groups accomplishes exactly nothing. Groups filter — through security filtering or item-level targeting — they never scope.

Corollary: Computer Configuration links to the OU holding the computers. User Configuration links to the OU holding the users. Configuring the user half of a GPO and linking it to a computers OU produces silence.

[GPO-02] Ground rules

• Default Domain Policy: password and account lockout policy only. Those must live at the domain root to be honored for domain accounts. Nothing else goes in it.
• Default Domain Controllers Policy: leave alone entirely.
• One GPO, one purpose. A forty-setting monolith cannot be troubleshot.
• Name GPOs <Scope> - <Purpose> so the link is obvious from the name.

[GPO-03] Order of precedence

Later overwrites earlier:

L → S → D → OU — Local policy, then Site, then Domain, then OU (parent OU before child OU).

Modifiers:

• Enforced (formerly “No Override”) on a link makes it win regardless of position and survives Block Inheritance.
• Block Inheritance on an OU stops policy flowing down from above — except from Enforced links.
• Multiple GPOs linked at the same OU: lowest link order number wins (link order 1 is applied last, so it wins).

[GPO-04] GPOs to build in a standard SMB environment

A. Default Domain Policy — passwords and lockout

Computer Configuration > Policies > Windows Settings > Security Settings
  > Account Policies > Password Policy
      Minimum password length: 14
      Password must meet complexity requirements: Enabled
  > Account Lockout Policy
      Account lockout threshold: 10
      Reset counter after: 15 minutes
      Account lockout duration: 15 minutes

B. Workstations - Baseline Security → linked to OU=Workstations

Computer Configuration > Policies > Windows Settings > Security Settings
  > Local Policies > Security Options
      Interactive logon: Message title for users attempting to log on
      Interactive logon: Message text for users attempting to log on
      Accounts: Guest account status = Disabled
      Interactive logon: Don't display last signed-in = Enabled

Computer Configuration > Policies > Administrative Templates > System > Logon
      Always wait for the network at computer startup and logon = Enabled

⚠ “Always wait for the network” is not optional in practice. Windows uses fast logon optimization by default, processing policy in the background from a cache. Drive maps, Folder Redirection, and software installation all need the network available during logon. Without this setting they can take two or three reboots to appear. When a user says “the drive shows up eventually,” this is why.

C. Workstations - LAPS → linked to OU=Workstations

See [SEC-LAPS].

D. Workstations - MDM Auto-Enrollment → linked to OU=Workstations

Computer Configuration > Policies > Administrative Templates > Windows Components > MDM
      Enable automatic MDM enrollment using default Azure AD credentials = Enabled
      Select Credential Type to Use = User Credential

Build this now even if the tenant does not exist yet. It does nothing until hybrid join is configured, and then it simply works.

WHY this specific GPO saves days: this is the method that produces Corporate device ownership and full management capability. Manually adding a work account through Settings produces Personal ownership and a crippled device. Having this GPO in place before the first machine joins means you never take the manual shortcut and never inherit its consequences. See [MDM-OWNERSHIP].

E. Employees - Drive Maps → linked to OU=Employees

User Configuration > Preferences > Windows Settings > Drive Maps

One item per department, targeting the matching GG- group. Use letters from the end of the alphabet. Avoid A: and B: — legacy floppy letters that some line-of-business software still treats as removable media.

[GPO-DRIVEMAP] Drive Maps action reference — the one that causes hangs

🛑 Replace hangs gpupdate /force. It deletes and recreates the mapping on every refresh. If the drive is open in Explorer, or a file on it is in use, the delete blocks and the policy engine stalls — requiring a power cycle. Change the action to Update.

F. Employees - Folder Redirection → linked to OU=Employees

User Configuration > Policies > Windows Settings > Folder Redirection
For Documents, Desktop, Pictures:
    Setting: Basic - Redirect everyone's folder to the same location
    Target:  Create a folder for each user under the root path
    Root path: \\SERVER\Redirected          <-- NOT the Home root
    Policy Removal: Leave the folder in the new location
    Grant the user exclusive rights: Enabled  (safe once the roots are separate)

🛑 Folder Redirection applies at logon only. gpupdate /force will never show you the result. The user must fully log off and log back on. Locking and unlocking is not a logoff.

🛑 Home folders and redirected folders must use separate roots — see [FILE-502].

G. Workstations - Remote Access → linked to OU=Workstations (optional)

Computer Configuration > Policies > Administrative Templates > Windows Components
  > Remote Desktop Services > Remote Desktop Session Host
    > Connections
        Allow users to connect remotely by using Remote Desktop Services = Enabled
    > Security
        Require user authentication for remote connections by using
        Network Level Authentication = Enabled

Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups
    Action: Update, Group: Remote Desktop Users
    Add: GG-IT     (scope who may connect — do not leave it open)

⚠ RDP is the wrong tool for helpdesk. Windows client operating systems support one interactive session. When you RDP into a user’s workstation, that user is disconnected from their own desktop. You cannot watch what they are doing, you cannot show them anything, and you have interrupted them in order to help them.

🛑 NEVER expose RDP to the internet. Not on 3389, not on an obscure high port. Internet-facing RDP is among the most common ransomware entry points in the SMB space. If you assess a client network and find RDP open to the world, that is your first finding and it is urgent. Acceptable paths: RMM agent, VPN then RDP, RD Gateway with MFA, or Azure Bastion.

[GPO-05] Group Policy troubleshooting [GPO-TRIAGE]

gpupdate /force
gpresult /r                                  # quick list of applied GPOs
gpresult /h C:\gpo.html; start C:\gpo.html   # THE readable report — use this one
gpresult /r /scope:computer
gpresult /scope:user /v
whoami /groups                               # did group membership actually resolve?

Decision tree — “Group Policy isn’t applying”:

1. Run gpresult /h C:\gpo.html and read it. This answers most of these tickets by itself.
2. Is the GPO listed as applied or denied? Denied tells you it is a filtering problem, not a linking problem.
3. Not listed at all? Is the GPO linked to an OU that actually contains this object? Check where the object lives, not where you think it lives.

   Get-ADComputer PC001 | Select-Object DistinguishedName
   Get-ADUser jdoe      | Select-Object DistinguishedName
   

4. Is the object in CN=Computers or CN=Users? No GPO reaches there. Run redircmp/redirusr and move the existing objects.
5. Is the link enabled? Is the GPO status enabled for the half you need (user vs computer settings can be disabled independently)?
6. Security filtering: does the object have both Read and Apply group policy?
7. Did you configure User settings on a computer OU, or vice versa?
8. Folder Redirection or drive maps: did the user fully log off, or just lock the screen?
9. Group membership recently changed? A new token requires a full logoff. whoami /groups proves it.
10. Is SYSVOL reachable? \\ad.contoso.com\SYSVOL — policy is delivered over SMB 445.

Server-side inventory:

Get-GPO -All | Sort-Object DisplayName | Format-Table DisplayName, GpoStatus, ModificationTime
Get-GPOReport -All -ReportType Html -Path C:\Temp\AllGPOs.html
Get-GPInheritance -Target "OU=Workstations,OU=Contoso,DC=ad,DC=contoso,DC=com"
Backup-GPO -All -Path C:\Temp\GPOBackup        # before changing anything on an inherited network

[GPO-06] Group Policy vs Intune — decide who owns what, in writing

When both systems target the same setting, the result is not reliably predictable. Decide per category and write the decision down.

08 — FILE SERVICES AND PERMISSIONS [FILE]

[FILE-01] Folder layout

D:\
├── Company\        company-wide files
├── Departments\
│   ├── Sales\
│   ├── Accounting\
│   └── IT\
├── Home\           H: home drives
└── Redirected\     Folder Redirection target — SEPARATE ROOT from Home

[FILE-02] The standard permission model — the one that saves you

WHY leave the share layer wide open? Share and NTFS permissions are evaluated together and the more restrictive wins. Enforcing security at both layers means every access problem has two candidate causes, and you will troubleshoot the wrong one about half the time. The industry standard is to open the share and let NTFS carry all the real control.

🛑 Two rules that protect you:

1. Never remove SYSTEM or the administrative group from an ACL. The operating system needs SYSTEM. Removing it can lock the server out of its own data, and recovery means taking ownership and rebuilding the ACL from scratch.
2. “Replace all child object permission entries” is destructive and irreversible. It erases every explicit permission beneath the folder. On a new empty tree it is harmless. On a client’s production file server with a decade of accumulated per-folder permissions, it destroys the entire permission model with no undo.

Before touching any existing ACL:

Get-Acl D:\Departments\Sales | Export-Clixml C:\Temp\acl-backup-sales.xml
# Restore:  Get-Content is not enough — use:
# $acl = Import-Clixml C:\Temp\acl-backup-sales.xml ; Set-Acl -Path D:\Departments\Sales -AclObject $acl

[FILE-03] Create shares — idempotent version

$Shares = @(
    @{Name="Company";     Path="D:\Company"},
    @{Name="Departments"; Path="D:\Departments"},
    @{Name="Home";        Path="D:\Home"},
    @{Name="Redirected";  Path="D:\Redirected"}
)

foreach ($S in $Shares) {
    if (-not (Test-Path $S.Path)) { New-Item -Path $S.Path -ItemType Directory -Force | Out-Null }

    if (Get-SmbShare -Name $S.Name -ErrorAction SilentlyContinue) {
        Write-Warning "$($S.Name) already shared - updating instead of creating"
        Set-SmbShare -Name $S.Name -FolderEnumerationMode AccessBased -Force
    }
    else {
        New-SmbShare -Name $S.Name -Path $S.Path `
            -FullAccess "Authenticated Users" `
            -FolderEnumerationMode AccessBased
        Write-Host "Created share $($S.Name)" -ForegroundColor Green
    }
}

Get-SmbShare | Where-Object { $_.Name -notlike "*$" } |
    Select-Object Name, Path, FolderEnumerationMode

⚠ “The name has already been shared” — Windows system error 2118. New-SmbShare creates only. If the share name exists it throws 2118 and does nothing — it will not update the existing share. Partially completing this step and re-running the whole block produces a wall of these errors while the shares that did succeed sit there working fine.

The error text names the cause precisely. Misattributing 2118 to a syntax or parameter problem sends you rewriting a script that was correct. To change an existing share use Set-SmbShare. To start over, Remove-SmbShare -Name X -Force then re-create.

[FILE-04] Access-Based Enumeration (ABE)

Set-SmbShare -Name "Departments" -FolderEnumerationMode AccessBased -Force
Get-SmbShare | Select-Object Name, FolderEnumerationMode

Users do not see folders they lack Read access to — the Accounting folder is invisible to Sales rather than visible-but-locked.

ABE vs item-level targeting — they solve different halves of the same problem:

• Item-level targeting controls whether a drive letter appears.
• ABE controls whether a folder appears.

Without ABE, a user who types the UNC path directly sees every department folder regardless of drive mappings. Use both.

[FILE-05] NTFS permissions on a department folder

Break inheritance using Convert inherited permissions into explicit permissions, then remove what does not belong. Do not use “Replace all child object permission entries” on an existing tree.

[FILE-06] Home and Redirected root permissions — exact values

WHY the “This folder only” scoping is critical: users need to create their own folder at the root but must not inherit rights into anyone else’s. CREATOR OWNER then gives each user full control over the folder they personally created. This exact combination is what makes per-user private folders work without touching each one by hand.

⚠ Include “Traverse folder / execute file”. Omitting it usually still works, because the Bypass traverse checking user right is granted to Everyone by default and makes the traverse check unnecessary. But that default can be hardened away by a security baseline, and when it is, users suddenly cannot reach their own home folders. Include it and remove the dependency on a default you do not control.

[FILE-502] Folder Redirection Event ID 502, “Access is denied” — the fix nobody finds

Symptom: Folder Redirection is configured correctly, the GPO applies, permissions have been verified repeatedly, and redirection still fails with Event 502.

Actual cause: Home folders and redirected folders are pointed at the same root path. Active Directory’s home-folder feature creates the user’s folder when you click Apply — and the owner of that folder is the administrator account that created it, not the user. Folder Redirection with “Grant the user exclusive rights” enabled then checks ownership of the existing folder, finds it does not belong to the user, and refuses with Access Denied.

Correct fix: use separate roots.

• \\SERVER\Home for AD home folders
• \\SERVER\Redirected for Folder Redirection

The conflict then cannot occur, and you keep the tighter per-user ACL that exclusive rights provides.

⚠ Workaround vs fix: unchecking “Grant the user exclusive rights” makes redirection work, but it is a workaround. It means each user’s redirected folder does not get the locked-down per-user ACL. In a client environment that is a privacy finding waiting to be written up.

[FILE-07] UNC paths: server name vs DFS Namespace

\\SERVER\Share is correct, works, and is the right starting point.

The production upgrade is a domain-based DFS Namespace, which gives a server-agnostic path: \\ad.contoso.com\shares\Departments\Sales instead of \\FILE01\Departments\Sales

⚠ A DFS path is not automatic — the namespace must exist first. \\ad.contoso.com\shares\ does not resolve simply because it is your domain name. Until you create it, that path returns “network path was not found.”

Install-WindowsFeature FS-DFS-Namespace -IncludeManagementTools
New-DfsnRoot   -TargetPath "\\FILE01\shares" -Type DomainV2 -Path "\\ad.contoso.com\shares"
New-DfsnFolder -Path "\\ad.contoso.com\shares\Departments" -TargetPath "\\FILE01\Departments"

Decide once, before you author the drive-map GPO. Switching later means editing every preference item. If you are not setting up DFS-N on this build, use the server name and move on — that is a valid choice, not a compromise. Revisit when you have two file servers, or when a server rename or replacement is on the horizon.

[FILE-08] “I can’t get to the file share” — triage [FILE-TRIAGE]

1. Can they reach it by UNC path (\\SERVER\Share)? If yes, the problem is the drive mapping, not access.
2. Can they see it but not open files? That is NTFS, not share permissions.
3. Can they open but not save? Modify permission missing, or the “Applies to” scope is wrong.
4. Can nobody reach it? Check the server, the LanmanServer service, and the firewall (TCP 445).
5. Check effective access: folder Properties → Security → Advanced → Effective Access tab. Test with the actual user account, not yours.
6. Confirm group membership resolved on the client: whoami /groups. A recently added group requires a full logoff.
7. Check for a deny ACE. Explicit Deny beats any Allow.

Get-SmbShare | Select-Object Name, Path, FolderEnumerationMode
Get-SmbShareAccess -Name "Departments"
Get-Acl D:\Departments\Sales | Format-List
(Get-Acl D:\Departments\Sales).Access | Format-Table IdentityReference, FileSystemRights, AccessControlType, InheritanceFlags
Get-SmbOpenFile | Select-Object ClientUserName, Path        # who has files open right now
Get-SmbSession                                              # active sessions to this server

[FILE-09] Take ownership and rebuild after a lockout

When an ACL cleanup removed SYSTEM or Administrators and nobody can reach the data:

takeown /F "D:\Departments\Sales" /R /A /D Y
icacls "D:\Departments\Sales" /grant "Administrators:(OI)(CI)F" /T
icacls "D:\Departments\Sales" /grant "SYSTEM:(OI)(CI)F" /T

Then rebuild from the standard model in [FILE-05]. (OI) = object inherit (files), (CI) = container inherit (folders), /T = recurse.

[FILE-10] Migrating an on-premises file share to SharePoint/OneDrive — tooling and sequencing

Decision table — sizing the tool to the actual job:

The failure mode this table exists to prevent: defaulting to the most enterprise-sounding tool because it’s the most impressive-sounding answer, rather than sizing the tool to the actual job. Confirm real data volume before choosing — don’t reason from an assumption about how much data “a business this size” probably has.

Sequencing for minimal disruption, once actual volume is confirmed:

1. Run the migration tool’s pre-scan/validation pass before moving anything. Cloud file storage commonly rejects things a traditional file share tolerates — illegal characters, over-length paths, reserved names. Finding this before the migration avoids silently skipped files.
2. Bulk-copy while the source stays live and users keep working normally against it — schedule for off-hours if bandwidth is a shared concern.
3. Run a short delta/incremental sync immediately before the cutover date to catch anything changed since the bulk copy began.
4. Verify file counts and spot-check content on the destination before making any change to the source.
5. Cut users over to the new location on an announced date, not gradually. A soft, gradual transition produces files split across two locations that never get reconciled — pick a date and communicate it.
6. Retain the untouched source copy for a defined window after cutover (a few weeks is reasonable) before it is safe to consider it disposable.

WHY the capital-vs-recurring framing matters here: [DOCTRINE-15].

09 — HYBRID IDENTITY [HYB]

[HYB-00] 🔄 UPDATED — product names and what actually exists

Verified against Microsoft Learn, August 2026. Older references — including some AI-generated ones — describe a “modern engine” using a ConnectSync.exe /SyncCycle command line. That does not exist. Do not go looking for it.

[HYB-01] Connect Sync or Cloud Sync? The choice is determined, not preferred