ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

ACTIVE DIRECTORY
Comprehensive Study Guide — With Architecture Diagrams

Beginner → Advanced • PowerShell Commands • Visual Diagrams • All Scenarios

Disaster Recovery • Multi-Site • ADFS • Kerberos • PKI • Load Balancing • Troubleshooting

Audience IT Administrators, Engineers, Security Professionals

Level Beginner → Intermediate → Advanced

Includes Architecture Diagrams + PowerShell Commands + Step-by-Step Explanations

Page 1
 ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 01

Active Directory Fundamentals

Core concepts, components, and installation

1.1 AD Forest & Domain Architecture

Active Directory is Microsoft's LDAP/Kerberos-based directory service for centralised identity management. The
forest is the security boundary. Domains are administrative boundaries. All domains in a forest share a common
Schema, Configuration partition, and trust each other transitively.

FOREST: [Link]

Schema & Configuration Partitions (forest-wide)

[Link]
Forest Root Domain

[Link] [Link]
Child Domain Child Domain

Trust

[Link]
Global Catalog
Separate Tree (same forest)
All objects (partial)

Figure 1.1 — AD Forest Structure: Root Domain, Child Domains, Separate Tree, Global Catalog

Page 2
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

Key Terminology Quick-Reference

• [Link] — The AD database file; every DC holds a full copy of its domain partition
• Global Catalog (GC) — Partial read-only replica of ALL objects in the forest; used for UPN logon & universal
group membership
• Schema — Defines every object class (user, computer, group) and attribute; forest-wide; can only be
extended
• Trusts — Automatic two-way transitive trusts between parent/child domains; external/forest trusts are explicit
• Site — Represents a physical location; controls replication scheduling and DC locator

1.2 Domain Controller Internal Components

Every Domain Controller runs multiple interdependent services. Understanding these components helps diagnose
failures and plan capacity.
Domain Controller

LDAP :389/:636
AD DS ([Link])
Database Engine (ESE)
Kerberos :88
SYSVOL Share
Client / Server
GPO templates / scripts
DNS :53 requests services
DNS Server
SRV records, AD zones
SMB/RPC
Kerberos KDC
TGT / Service Ticket issuance
NTP :123

Figure 1.2 — DC Internal Services & Listening Ports

Installation Flow — New Forest

• Step 1: Install Windows Server, configure static IP and DNS pointing to itself ([Link])
• Step 2: Install AD DS role: Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
• Step 3: Promote to DC with Install-ADDSForest (see commands below)
• Step 4: Verify: dcdiag /test:all and repadmin /replsummary
• Step 5: Configure DNS forwarders to upstream resolvers

■ PowerShell — AD Installation & Verification

# ■■ STEP 1: Install the AD DS role ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# ■■ STEP 2: Promote to NEW FOREST ROOT DC ■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Run as local Administrator; server will reboot automatically
Install-ADDSForest `

Page 3
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

-DomainName '[Link]' `
-DomainNetBIOSName 'CORP' `
-ForestMode 'WinThreshold' `
-DomainMode 'WinThreshold' `
-InstallDNS `
-SafeModeAdministratorPassword (ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force) `
-Force

# ■■ STEP 3: Add a REPLICA DC to an existing domain ■■■■■■■■■■■■■■■■■■

Install-ADDSDomainController `
-DomainName '[Link]' `
-Credential (Get-Credential 'CORP\Administrator') `
-InstallDNS `
-SafeModeAdministratorPassword (ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force) `
-Force

# ■■ STEP 4: Add a CHILD DOMAIN ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Install-ADDSDomain `
-NewDomainName 'sales' `
-ParentDomainName '[Link]' `
-DomainType ChildDomain `
-Credential (Get-Credential 'CORP\Administrator') `
-InstallDNS `
-SafeModeAdministratorPassword (ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force) `
-Force

# ■■ STEP 5: Verify installation ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

dcdiag /test:all /v # Run all diagnostics
dcdiag /test:dns /v # DNS-specific tests
repadmin /replsummary # Replication health
Get-ADDomain | Select DomainMode, PDCEmulator, RIDMaster
Get-ADForest | Select ForestMode, SchemaMaster, DomainNamingMaster

Page 4
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 02

Users, Groups & Organizational Units

Identity management, delegation, LDAP structure

2.1 LDAP Directory Structure

Active Directory stores all objects in a hierarchical LDAP namespace. Every object has a Distinguished Name
(DN) that reflects its position in the tree. Understanding DN structure is essential for PowerShell, LDAP queries,
and GPO linking.

DC=corp,DC=local (Domain Root)

OU=Departments CN=Users (default)

OU=Finance OU=IT

CN=John Smith
LDAP Query Example
# Find user by samAccountName
(sAMAccountName=jsmith)
LDAP://DC01/DC=corp,DC=local
Filter:Structure
Figure 2.1 — LDAP Directory Hierarchy & Query
(&(objectClass=user)
(sAMAccountName=jsmith))
Port 389 (clear) / 636 (SSL)
2.2 User Account Management
User accounts are the primary identity objects in AD. Key attributes include sAMAccountName (pre-Windows
2000 logon), UserPrincipalName (UPN — email-style logon), and objectSID (unique security identifier). Always
use UPNs matching your email domain for seamless hybrid/ADFS scenarios.

■ PowerShell — User Management

# ■■ CREATE USER ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

New-ADUser `

Page 5
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

-Name 'John Smith' -GivenName 'John' -Surname 'Smith' `

-SamAccountName 'jsmith' `
-UserPrincipalName 'jsmith@[Link]' `
-Path 'OU=Finance,OU=Departments,DC=corp,DC=local' `
-AccountPassword (ConvertTo-SecureString 'P@ssw0rd!' -AsPlainText -Force) `
-ChangePasswordAtLogon $true `
-Enabled $true `
-Department 'Finance' -Title 'Analyst' -Manager 'CN=Jane Brown,OU=Finance,...'

# ■■ BULK CREATE from CSV ([Link]: Name,SAM,UPN,OU,Pass) ■■■■■■■■■■

Import-Csv C:\[Link] | ForEach-Object {
New-ADUser -Name $_.Name -SamAccountName $_.SAM `
-UserPrincipalName $_.UPN -Path $_.OU `
-AccountPassword (ConvertTo-SecureString $_.Pass -AsPlainText -Force) `
-Enabled $true
}

# ■■ DISABLE / UNLOCK / RESET ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Disable-ADAccount -Identity jsmith
Unlock-ADAccount -Identity jsmith
Set-ADAccountPassword -Identity jsmith -Reset `
-NewPassword (ConvertTo-SecureString 'NewP@ss123!' -AsPlainText -Force)
Set-ADUser -Identity jsmith -ChangePasswordAtLogon $true

# ■■ USEFUL QUERIES ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Search-ADAccount -AccountDisabled | Select Name, SamAccountName
Search-ADAccount -LockedOut | Select Name, SamAccountName
Search-ADAccount -PasswordExpired | Select Name, PasswordLastSet
Get-ADUser -Filter {PasswordNeverExpires -eq $true} -Properties PasswordNeverExpires |
Select Name, SamAccountName
Get-ADUser -Filter {LastLogonDate -lt (Get-Date).AddDays(-90)} -Properties LastLogonDate |
Sort LastLogonDate | Select Name, LastLogonDate # Stale accounts

2.3 Group Strategy — AGDLP

AGDLP Best Practice Pattern
• A — Accounts: Place user accounts into Global Groups (same domain)
• G — Global Groups: Group users by role/department (e.g., GG-Finance-Staff)
• DL — Domain Local Groups: Assign permissions on resources (e.g., DL-Finance-Share-Read)
• P — Permissions: Apply permissions to the Domain Local group on the resource
• Benefit: Change group membership to change access — never touch ACLs on resources
• Forest extension: Use Universal Groups between domains (AGUDLP)

Page 6
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

■ PowerShell — Groups (AGDLP)

# ■■ CREATE GROUPS (AGDLP pattern) ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Global group — role-based (users' home domain)
New-ADGroup -Name 'GG-Finance-Staff' -GroupScope Global `
-GroupCategory Security -Path 'OU=Groups,DC=corp,DC=local'

# Domain Local group — resource permission group

New-ADGroup -Name 'DL-Finance-Share-Read' -GroupScope DomainLocal `
-GroupCategory Security -Path 'OU=Groups,DC=corp,DC=local'

# Add users to global group

Add-ADGroupMember -Identity 'GG-Finance-Staff' -Members jsmith, abrown, cwilson

# Nest global group into domain local group

Add-ADGroupMember -Identity 'DL-Finance-Share-Read' -Members 'GG-Finance-Staff'

# Apply permission on share (PowerShell):

# Grant-SmbShareAccess -Name 'Finance' -AccountName 'CORP\DL-Finance-Share-Read' -AccessRight
Read

# ■■ QUERIES ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■
Get-ADGroupMember 'DL-Finance-Share-Read' -Recursive | Select Name, SamAccountName
Get-ADPrincipalGroupMembership jsmith | Select Name, GroupScope, GroupCategory

Page 7
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 03

Group Policy (GPO)

LSDOU processing, enforcement, security baselines

3.1 GPO Processing Order — LSDOU

Group Policy is applied in a fixed order: Local → Site → Domain → OU. Settings applied later override earlier
ones (last write wins). Understanding this order is critical when troubleshooting unexpected policy outcomes.

L — Local GPO
Applies first — lowest precedence
Local security policy on machine

S — Site GPO Enforced (No Override)

Linked to AD Site (e.g., HQ-London)
Higher policy CANNOT be blocked
Site-specific settings

D — Domain GPO Processing■Order■(last

Blockwins)
Inheritance
Default Domain Policy Blocks all parent GPOs (except Enforced)
Password & Lockout Policies

Security Filtering
O — OU GPO
Apply GPO only to specific groups
Closest OU wins — highest precedence
Department / Role-specific settings

LSDOU — Local → Site → Domain → OU (later = higher precedence, last write wins)

Figure 3.1 — LSDOU Processing Order with Enforcement, Block, and Security Filtering

How to Troubleshoot a GPO Not Applying

• Step 1: Run gpresult /R or gpresult /H C:\[Link] — check 'Applied GPOs' vs 'Denied GPOs'
• Step 2: Check Security Filtering — the target user/computer must be in the allowed group (default:
Authenticated Users)
• Step 3: Verify OU link — is the GPO linked to the correct OU? Check link enabled status
• Step 4: Check Block Inheritance — is a parent OU blocking the GPO? Check Enforced setting
• Step 5: Check WMI Filter — run the WMI query manually on the target machine to see if it returns results
• Step 6: Check SYSVOL replication — GPO template must exist in SYSVOL on all DCs

Page 8
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

■ PowerShell — Group Policy Management

# ■■ CREATE & LINK GPO ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Create GPO
New-GPO -Name 'Corp-Security-Baseline' -Comment 'Sec baseline per CIS benchmark'

# Link GPO to domain root

New-GPLink -Name 'Corp-Security-Baseline' -Target 'DC=corp,DC=local' -LinkEnabled Yes

# Link GPO to specific OU

New-GPLink -Name 'Corp-Security-Baseline' `
-Target 'OU=Finance,OU=Departments,DC=corp,DC=local'

# Enforce the GPO link (cannot be blocked by child OUs)

Set-GPLink -Name 'Corp-Security-Baseline' -Target 'DC=corp,DC=local' -Enforced Yes

# Block GPO inheritance on an OU

Set-GPInheritance -Target 'OU=Finance,OU=Departments,DC=corp,DC=local' -IsBlocked Yes

# ■■ APPLY / VERIFY ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

gpupdate /force # Force refresh on local machine
Invoke-GPUpdate -Computer 'PC01' -Force # Remote force update

# Show applied GPOs & denied GPOs (run as the target user on target machine)
gpresult /R
gpresult /H C:\[Link] /F # Full HTML report
gpresult /SCOPE COMPUTER /V # Verbose computer scope

# Get RSoP for remote user/computer

Get-GPResultantSetOfPolicy -Computer 'PC01' -User 'CORP\jsmith' `
-ReportType Html -Path C:\[Link]

# ■■ BACKUP / RESTORE ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Backup-GPO -All -Path C:\GPOBackup # Backup all
Backup-GPO -Name 'Corp-Security-Baseline' -Path C:\GPOBackup # Single GPO
Restore-GPO -Name 'Corp-Security-Baseline' -Path C:\GPOBackup

# ■■ INHERITANCE CHECK ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Get-GPInheritance -Target 'OU=Finance,OU=Departments,DC=corp,DC=local'

Page 9
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 04

FSMO Roles & AD Replication

Master roles, replication mechanics, SYSVOL

4.1 FSMO Role Map

Five Flexible Single Master Operation (FSMO) roles prevent conflicts in specific operations that cannot be
multi-mastered. Knowing where each role lives and what it does is critical for planning, maintenance, and failure
recovery.

FOREST-WIDE (one per forest) DOMAIN-WIDE (one per domain)

Schema Master PDC Emulator

Controls schema changes Time sync, lockouts, legacy NTLM

Domain Naming Master RID Master

Allocates RID pools to DCs
Add/remove domains

Infrastructure Master
Cross-domain object refs

Place PDC Emulator on best-connected DC | Schema Master rarely needs to be online | InfraMaster ≠ GC unless all DCs are GCs

Figure 4.1 — FSMO Roles: Forest-Wide (2) vs Domain-Wide (3)

■ FSMO Management

# ■■ VIEW ROLE HOLDERS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

netdom query fsmo # CMD — quick view of all 5 roles
Get-ADDomain | Select PDCEmulator, RIDMaster, InfrastructureMaster
Get-ADForest | Select SchemaMaster, DomainNamingMaster

# ■■ GRACEFUL TRANSFER (source DC must be online) ■■■■■■■■■■■■■■■■■■■■■

# Transfer all three domain roles to DC02
Move-ADDirectoryServerOperationMasterRole `
-Identity 'DC02' `

Page 10
 ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

-OperationMasterRole PDCEmulator, RIDMaster, InfrastructureMaster

# Transfer forest roles

Move-ADDirectoryServerOperationMasterRole `
-Identity 'DC02' `
-OperationMasterRole SchemaMaster, DomainNamingMaster

# ■■ SEIZE (force — ONLY when original holder is PERMANENTLY offline) ■

# ■ Never seize if original holder may come back online
Move-ADDirectoryServerOperationMasterRole `
-Identity 'DC02' -OperationMasterRole PDCEmulator -Force

# ■■ PDC EMULATOR SPECIAL TASKS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Sync time from reliable source (run on PDC Emulator)
w32tm /config /manualpeerlist:'[Link],0x1' /syncfromflags:manual /reliable:YES
/update
Restart-Service W32Time
w32tm /resync /force

# Check NTP sync status

w32tm /query /status
w32tm /monitor /computers:DC01,DC02,DC03

4.2 AD Replication Deep Dive

AD uses multi-master, attribute-level replication. Each DC tracks changes via USNs. The KCC (Knowledge
Consistency Checker) automatically creates connection objects forming a ring topology within a site (max 3 hops)
and a spanning tree between sites.
AD Multi-Master Replication — KCC builds spanning-tree topology
DC02

DC01 DC03
(PDC)

DC04
(RODC)

USN (Update Seq Number) Tombstone & Lingering Objects

• Each write increments DC's local USN • Deleted objects kept as tombstones (180d)
• DCs track partner's highest USN seen • After tombstone lifetime DC isolated = lingering
• Only changed attributes replicate (att-level) • Fix: repadmin /removelingeringobjects

Page 11
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

Figure 4.2 — Multi-Master Replication Topology, USN Tracking & Tombstones

■ Replication Diagnostics & Repair

# ■■ REPLICATION HEALTH ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

repadmin /replsummary # Summary of errors across all DCs
repadmin /showrepl # Detailed per-DC replication state
repadmin /showrepl * /errorsonly # Only DCs with errors
Get-ADReplicationFailure -Scope Forest | Sort FailureCount -Descending

# ■■ FORCE REPLICATION ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

repadmin /syncall /AdeP # Sync all partitions, all DCs, notify
repadmin /replicate DC02 DC01 DC=corp,DC=local # Force DC02 to pull from DC01

# ■■ DIAGNOSE SPECIFIC ERROR ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Error 8606 — Lingering objects
repadmin /removelingeringobjects DC02 DC01 DC=corp,DC=local /ADVISORY_MODE
# Remove (after verifying advisory output):
repadmin /removelingeringobjects DC02 DC01 DC=corp,DC=local

# Error 2042 — DC not replicated beyond tombstone lifetime

# Option 1: demote and re-promote
# Option 2 (advanced): set Allow Replication With Divergent and Corrupt Partner
repadmin /regkey DC02 +allowDivergent

# ■■ USN ROLLBACK DETECTION ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Event ID 2095 in Directory Services log = USN rollback
# Fix: Demote DC, metadata cleanup, re-promote
dcdiag /test:replications /v

# ■■ KCC / CONNECTION OBJECTS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

repadmin /showconn # Show all KCC-generated connections
repadmin /kcc # Force KCC to recalculate topology

Page 12
 ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 05

Kerberos Authentication

Ticket flow, SPNs, delegation types

5.1 Kerberos Authentication Flow

Kerberos v5 is the default authentication protocol in Active Directory. It uses symmetric-key cryptography and a
trusted third party (the KDC on your DC). Understanding the 6-step flow helps diagnose every Kerberos-related
failure.

Workstation (DC) Server

Client KDC App

AS-REQ (pre-auth encrypted timestamp)

2

AS-REP (TGT encrypted with krbtgt hash)

TGS-REQ (TGT + SPN requested)

4

TGS-REP (Service Ticket)

AP-REQ (Service Ticket to App Server)

AP-REP (mutual auth, session established)

TGT: Ticket Granting Ticket — proves client identity to KDC

ST: Service Ticket — grants access to specific service SPN: Service Principal Name — unique service identifier

Figure 5.1 — Kerberos 6-Step Authentication Flow (AS-REQ → AP-REP)

Page 13
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

Kerberos Failure Checklist

• Error 0x25 (KRB_ERR_SKEW): Clock drift > 5 minutes — sync time with w32tm /resync /force
• Error 0x18 (PREAUTH_FAILED): Wrong password or stale hash — reset the account password
• Error 0x1F (S_PRINCIPAL_UNKNOWN): SPN missing — run setspn -S to register it
• KRB_AP_ERR_MODIFIED: Duplicate SPN — run setspn -X to find and remove duplicates
• Large Kerberos tokens: too many group memberships — raise MaxTokenSize or use RBCD to reduce

■ Kerberos & SPN Commands

# ■■ SPN MANAGEMENT ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# List ALL SPNs in domain (useful for audit)
setspn -Q */*

# Find DUPLICATE SPNs (most common Kerberos cause)

setspn -X

# Register SPN for a service account

setspn -S HTTP/[Link] CORP\svc-webapp
setspn -S HTTP/webserver CORP\svc-webapp # Short hostname too!

# Delete incorrect SPN

setspn -D HTTP/[Link] CORP\svc-webapp

# List SPNs on specific account

Get-ADUser svc-webapp -Properties ServicePrincipalNames |
Select -ExpandProperty ServicePrincipalNames

# ■■ TICKET MANAGEMENT ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

klist # View all Kerberos tickets in cache
klist tgt # View TGT only
klist purge # Purge all cached tickets (forces re-auth)
klist -li 0x3e7 # View machine account tickets

# ■■ DIAGNOSE KERBEROS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Enable Kerberos logging on DC (caution — verbose)
Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters' `
-Name LogLevel -Value 1
# Review: Event Viewer → Windows Logs → Security → Event 4768/4769/4771

5.2 Kerberos Delegation Types

Delegation allows a service to impersonate a user when calling a backend service. Choosing the right delegation
type is critical for both functionality and security.

Page 14
 ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

■ Unconstrained Delegation ■ Constrained Delegation (KCD)

(Security Risk — avoid!) (Allowed services list)

(impersonate to anything!)
TGT forwarded

User Web■Server ANY■Service User Web■Server SQL■Only

Cannot delegate
to other services
TGT stored on server — attacker can steal it msDS-AllowedToDelegateTo lists permitted services

Can impersonate user to ANY backend service S4U2Proxy — impersonate without user's TGT

Monitor: Get-ADComputer -Filter {TrustedForDelegation} RBCD: target resource controls who can delegate

Kerberos Delegation Types — Constrained vs Unconstrained

Figure 5.2 — Unconstrained (dangerous) vs Constrained Delegation (KCD)

■ Kerberos Delegation Configuration

# ■■ FIND RISKY DELEGATION ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Find computers with UNCONSTRAINED delegation (security risk!)
Get-ADComputer -Filter {TrustedForDelegation -eq $true} `
-Properties TrustedForDelegation, Description |
Select Name, Description

# Find users with unconstrained delegation

Get-ADUser -Filter {TrustedForDelegation -eq $true} `
-Properties TrustedForDelegation | Select Name, SamAccountName

# ■■ CONFIGURE CONSTRAINED DELEGATION (KCD) ■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Allow svc-webapp to delegate to SQL server on behalf of users
Set-ADUser svc-webapp -TrustedToAuthForDelegation $true # Enable protocol transition
Set-ADUser svc-webapp -Add @{
'msDS-AllowedToDelegateTo' = @('MSSQLSvc/[Link]',
'MSSQLSvc/sqlsrv01:1433')
}

# ■■ RESOURCE-BASED CONSTRAINED DELEGATION (RBCD) ■■■■■■■■■■■■■■■■■■■■■

# Preferred modern approach — target resource controls who delegates to it
# Allow svc-webapp to act on behalf of users to the SQL computer account
Set-ADComputer sqlsrv01 -PrincipalsAllowedToDelegateToAccount (Get-ADUser svc-webapp)

# Verify RBCD is set

Get-ADComputer sqlsrv01 -Properties PrincipalsAllowedToDelegateToAccount |
Select -ExpandProperty PrincipalsAllowedToDelegateToAccount

Page 15
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 06

AD Sites & Services — Multi-Geo

Replication topology, RODCs, site design

6.1 Multi-Site Replication Topology

AD Sites map to physical locations with fast, reliable connectivity. Site Links define the cost and schedule for
inter-site replication. The KCC builds optimal connection objects automatically based on site link costs.

AD Sites & Services — Multi-Geographic

File Share Replication
Witness (Azure/3rd site) Topology

■ KCC automatically builds connection objects based on site link costs ■

London HQ New York

Cost:100
(Site: HQ-London) 15min (Site: Branch-NY)

[Link]/24 [Link]/24
Cost:50 Cost:150
15min 30min
Hub DC×2■GC enabled Branch DC×1■RODC option

Dublin DR
(Site: DR-Dublin)

[Link]/24
Figure 6.1 — Multi-Geo AD Sites with Site Links, Costs & Replication Intervals
DR DC×2■GC enabled

Page 16
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

Multi-Site Design Best Practices

• Place at least 2 DCs per major site for local HA — never a single DC at a critical site
• Enable Global Catalog on sites with 500+ users or latency > 10ms to nearest GC
• Enable Universal Group Membership Caching (UGMC) at small branches without a GC
• Use RODC at untrusted or physically insecure remote sites
• Site link cost = relative WAN speed: faster link = lower cost (like routing metrics)
• KCC builds connections automatically — only configure preferred bridgehead servers if required
• File Share Witness (FSW) for quorum should be in a 3rd site (or Azure) to survive 2-site split

■ Sites & Services Management

# ■■ CREATE SITES & SUBNETS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

New-ADReplicationSite -Name 'HQ-London'
New-ADReplicationSite -Name 'Branch-NewYork'
New-ADReplicationSite -Name 'DR-Dublin'

New-ADReplicationSubnet -Name '[Link]/24' -Site 'HQ-London' -Location 'London DC1'

New-ADReplicationSubnet -Name '[Link]/24' -Site 'Branch-NewYork' -Location 'NY Office'
New-ADReplicationSubnet -Name '[Link]/24' -Site 'DR-Dublin' -Location 'Dublin DR'

# ■■ CREATE SITE LINKS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Lower cost = preferred path for replication
New-ADReplicationSiteLink -Name 'London-NewYork' `
-SitesIncluded 'HQ-London','Branch-NewYork' `
-Cost 100 -ReplicationFrequencyInMinutes 15

New-ADReplicationSiteLink -Name 'London-Dublin' `

-SitesIncluded 'HQ-London','DR-Dublin' `
-Cost 50 -ReplicationFrequencyInMinutes 15

New-ADReplicationSiteLink -Name 'NY-Dublin' `

-SitesIncluded 'Branch-NewYork','DR-Dublin' `
-Cost 150 -ReplicationFrequencyInMinutes 30

# ■■ VERIFY TOPOLOGY ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Get-ADReplicationSite -Filter * | Select Name, RedundantServerTopologyEnabled
Get-ADReplicationSiteLink -Filter * | Select Name, Cost, ReplicationFrequencyInMinutes
Get-ADReplicationConnection -Filter * | Select AutoGenerated, ReplicateFromDirectoryServer

# ■■ UNIVERSAL GROUP MEMBERSHIP CACHING (for small branches) ■■■■■■■■■■

# Set via AD Sites & Services → Site → NTDS Site Settings → Enable UGMC
# PowerShell equivalent:
$site = Get-ADReplicationSite 'Branch-NewYork'
Set-ADReplicationSite $site -UniversalGroupCachingEnabled $true

6.2 Read-Only Domain Controllers (RODC)

Page 17
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

■ RODC Deployment

# ■■ DEPLOY RODC ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Stage the RODC account from a writable DC
Add-ADDSReadOnlyDomainControllerAccount `
-DomainControllerAccountName 'RODC-BRANCH1' `
-DomainName '[Link]' `
-SiteName 'Branch-NewYork' `
-DelegatedAdministratorAccountName 'CORP\branch-localadmin' `
-AllowPasswordReplicationAccountName 'Allowed RODC Password Replication Group'

# On the branch server — attach to pre-staged account

Install-ADDSDomainController `
-DomainName '[Link]' -UseExistingAccount `
-Credential (Get-Credential) `
-SafeModeAdministratorPassword (ConvertTo-SecureString 'P@ss!' -AsPlainText -Force)

# ■■ PASSWORD REPLICATION POLICY (PRP) ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Allow branch users' passwords to cache on RODC
Add-ADGroupMember 'Allowed RODC Password Replication Group' -Members 'GG-BranchNY-Users'

# ALWAYS deny privileged accounts

Add-ADGroupMember 'Denied RODC Password Replication Group' `
-Members 'Domain Admins','Enterprise Admins','Schema Admins','KRBTGT'

# Check which passwords are currently cached on the RODC

Get-ADDomainControllerPasswordReplicationPolicyUsage `
-Identity 'RODC-BRANCH1' -AuthenticatedAccounts | Select Name, SamAccountName

Page 18
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 07

Active Directory Federation Services

(ADFS)

Claims, SSO, Office 365 federation, WAP

7.1 ADFS Architecture

ADFS provides claims-based identity federation. It allows users to authenticate once with their on-premises AD
credentials and access external services (Office 365, Salesforce, custom SAML apps) without additional prompts.
WAP (Web Application Proxy) publishes ADFS externally from the DMZ.

Internal Network DMZ Internet

AD DS / Corp Users
[Link]
Users & Groups WAP■(DMZ)
Kerberos KDC Pre-Auth
Port 443
Reverse Proxy Office 365 SaaS Apps
Exchange Online Salesforce
SharePoint Workday
ADFS Farm (x2) SAML
Token Teams Custom SAML/OIDC
[Link]
Auth
Token Signing
Claims Rules

Browser / Client
HTTPS :443

Token Flow: 1)User→WAP → 2)WAP→ADFS(pre-auth) → 3)ADFS issues SAML token → 4)Token→Relying Party

Figure 7.1 — ADFS Full Architecture: AD → ADFS Farm → WAP (DMZ) → Cloud Apps

Page 19
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

ADFS Planning Requirements

• SSL Certificate: Must cover [Link] as CN + all service names as SANs (e.g., enterpriseregistration,
certauth)
• DNS: [Link] must resolve internally to ADFS VIP and externally to WAP VIP
• Firewall: Inbound 443 to WAP only; ADFS servers stay on internal network — never expose directly
• Service Account: Use gMSA (Group Managed Service Account) — eliminate password management
• WID vs SQL: WID = max 5 nodes / 30 relying parties; SQL = unlimited (large enterprises)
• WAP requires a separate SSL certificate if WAP hostname differs from ADFS service name

■ ADFS Installation & Configuration

# ■■ INSTALL ADFS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Install-WindowsFeature ADFS-Federation -IncludeManagementTools

# Create gMSA for ADFS (recommended over standard service account)

Add-KdsRootKey -EffectiveImmediately
New-ADServiceAccount -Name 'svc-adfs' -DNSHostName '[Link]' `
-PrincipalsAllowedToRetrieveManagedPassword 'Domain Controllers'

# Configure FIRST ADFS server (new WID farm)

Install-AdfsFarm `
-CertificateThumbprint 'A1B2C3D4E5F6...' `
-FederationServiceDisplayName 'Corp Identity Portal' `
-FederationServiceName '[Link]' `
-GroupServiceAccountIdentifier 'CORP\svc-adfs$'

# ■■ ADD ADFS NODE to existing farm ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Add-AdfsFarmNode `
-CertificateThumbprint 'A1B2C3D4E5F6...' `
-GroupServiceAccountIdentifier 'CORP\svc-adfs$' `
-PrimaryComputerName '[Link]'

# ■■ INSTALL & CONFIGURE WAP (DMZ server) ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Install-WindowsFeature Web-Application-Proxy -IncludeManagementTools

Install-WebApplicationProxy `
-CertificateThumbprint 'A1B2C3D4E5F6...' `
-FederationServiceName '[Link]' `
-FederationServiceTrustCredential (Get-Credential 'CORP\adfsadmin')

# ■■ OFFICE 365 FEDERATION ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Connect-MsolService # Requires MSOnline or Az module
Convert-MsolDomainToFederated -DomainName '[Link]' -SupportMultipleDomain
Get-MsolDomainFederationSettings -DomainName '[Link]'
Update-MsolFederatedDomain -DomainName '[Link]' # After cert rotation

# ■■ HEALTH CHECKS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Page 20
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

Get-AdfsProperties | Select HostName, HttpsPort, TlsClientPort, BrowserSsoEnabled

Get-AdfsCertificate | Select CertificateType, @{N='Expires';E={$_.[Link]}}
Get-AdfsSyncProperties # Primary/secondary sync status
Get-AdfsRelyingPartyTrust | Select Name, Enabled, LastUpdateTime
Invoke-WebRequest [Link] # HTTP 200 = healthy

Page 21
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 08

PKI & Certificates (AD CS)

CA hierarchy, certificate types, auto-enrollment

8.1 PKI Hierarchy & Certificate Types

A well-designed PKI uses a two or three-tier hierarchy. The offline Root CA is powered on only when signing the
Issuing CA certificate. The online Enterprise Issuing CA integrates with AD to enable auto-enrollment and smart
card logon.

Offline Root CA
Self-signed
Air-gapped (powered OFF)
Validity: 20 years

signs

Intermediate / Policy CA
Signs Issuing CA cert
Offline when possible
Validity: 10 years

signs

Issuing CA (Enterprise CA)

Online — AD-integrated
Issues to users/computers
Auto-enrollment support

User Certs Computer DC Certs Service

(smart card, Certs (LDAPS, Certs
S/MIME, EFS) (machine auth) Kerb PKINIT) (ADFS, IIS,
Exchange)
CRL/OCSP (CDP/AIA) must be accessible to ALL clients — plan HTTP distribution points carefully

Figure 8.1 — PKI Two-Tier Hierarchy: Offline Root CA → Enterprise Issuing CA → All Certificate Types

Certificate Type in AD Purpose & Port/Protocol

DC / Domain Controller Auth LDAPS (port 636), Kerberos PKINIT, smart card logon validation

Page 22
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

ADFS SSL / Token Signing / Token ADFS service encryption, SAML token signing, token decryption
Decrypting

Smart Card Logon Issued to users — Kerberos PKINIT-based card authentication

Client Authentication 802.1x wireless, VPN cert auth, mutual TLS

Web Server (IIS) HTTPS for OWA, ADFS, internal web apps

Code Signing Signs PowerShell scripts, executables, drivers

EFS Recovery Agent Decrypts EFS-encrypted files when user key is lost

OCSP Response Signing Signs real-time certificate status responses

■ AD CS / PKI Configuration

# ■■ INSTALL AD CS ROLE (Issuing CA) ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Install-WindowsFeature ADCS-Cert-Authority, ADCS-Web-Enrollment `
-IncludeManagementTools

# Configure as ENTERPRISE SUBORDINATE CA (after Root CA signs the CSR)

Install-AdcsCertificationAuthority `
-CAType EnterpriseSubordinateCA `
-CACommonName 'Corp-Issuing-CA01' `
-KeyLength 4096 `
-HashAlgorithmName SHA256 `
-CryptoProviderName 'RSA#Microsoft Software Key Storage Provider' `
-OutputCertRequestFile C:\PKI\[Link]

# ■■ PUBLISH CERTIFICATE TEMPLATE ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Duplicate built-in template in GUI, then publish:
Add-CATemplate -Name 'CorpWorkstationAuth'

# ■■ ENABLE AUTO-ENROLLMENT via GPO ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Computer Config → Policies → Windows Settings → Security Settings →
# Public Key Policies →
# 'Certificate Services Client - Auto-Enrollment' → Enabled
# Check: Renew expired certs + Update certs that use cert templates

# Force auto-enrollment immediately

certutil -pulse # Triggers enrollment for current user/machine

# ■■ LDAPS CONFIGURATION ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# DC auto-requests Domain Controller cert if template published
# Verify LDAPS is working:
# [Link] → Connection → Connect → DC hostname, port 636, check SSL

# ■■ CERTIFICATE MANAGEMENT ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

certutil -catemplates # List templates on CA

Page 23
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

certutil -store My # List user personal certs

certutil -store -enterprise NTAuth # NTAuth store (smart card CAs)
certutil -CRL # Publish CRL manually

Get-ChildItem Cert:\LocalMachine\My |
Select Subject, Thumbprint, @{N='Expires';E={$_.NotAfter}} |
Sort Expires

# ■■ CHECK CERT CHAIN ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

certutil -verify -urlfetch C:\[Link] # Verify chain + CRL/OCSP

Page 24
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 09

Load Balancing in AD Environments

DNS, NLB, hardware LB for ADFS and DCs

9.1 ADFS Load Balancing Architecture

ADFS is stateless — no session affinity required. Load balancers distribute requests across ADFS nodes using
the /adfs/probe health endpoint. DCs are load-balanced transparently via DNS SRV records and site-aware DC
locator.

ADFS Farm Load Balancing — Internal + DMZ Topology

Clients

Load Balancer VIP

Health Probe
[Link] → [Link]
GET /adfs/probe
HTTP 200 = healthy

ADFS01 ADFS02 ADFS03

Token signing / WID Token signing / WID Token signing / WID
WID sync / SQL

AD DS — Domain Controllers
Kerberos auth / LDAP queries
No session affinity needed | SSL passthrough to ADFS | Separate VIP for WAP (DMZ) | DNS TTL 30–60s for failover

Figure 9.1 — ADFS Farm Load Balancing: VIP → ADFS Nodes → AD DS

■ Load Balancing Configuration

# ■■ DNS LOAD BALANCING FOR DCs ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# DNS round-robin is automatic when multiple A records exist:
Add-DnsServerResourceRecordA -Name 'ldap' -ZoneName '[Link]' -IPv4Address '[Link]'
Add-DnsServerResourceRecordA -Name 'ldap' -ZoneName '[Link]' -IPv4Address '[Link]'
Add-DnsServerResourceRecordA -Name 'ldap' -ZoneName '[Link]' -IPv4Address '[Link]'

Page 25
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

# ■■ WINDOWS NLB FOR ADFS (built-in, no extra license) ■■■■■■■■■■■■■■■■■

Install-WindowsFeature NLB -IncludeManagementTools

# Create NLB cluster on ADFS01

New-NlbCluster -HostName ADFS01 -ClusterName adfs-cluster `
-InterfaceName 'Ethernet' -ClusterPrimaryIP [Link] `
-SubnetMask [Link] -OperationMode Multicast

# Add ADFS02 as second node

Get-NlbCluster -HostName ADFS01 |
Add-NlbClusterNode -NewNodeName ADFS02 -NewNodeInterface 'Ethernet'

# Configure port rule for HTTPS only

Add-NlbClusterPortRule -IP [Link] -StartPort 443 -EndPort 443 `
-Protocol TCP -Mode Multiple -Affinity None # No affinity = true LB

# ■■ ADFS HEALTH PROBE ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Configure HLB/NLB health monitor to GET this URL:
# [Link]
# Expected: HTTP 200 OK
# If non-200 → take node out of rotation
Invoke-WebRequest [Link] # Test from LB

# ■■ VERIFY LOAD BALANCING ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Get-NlbClusterNode | Select Name, State
nlbmgr # GUI management console

Page 26
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 10

Security Hardening

Tiered admin, Protected Users, FGPP, Credential Guard

10.1 Tiered Administration Model

The single biggest security improvement for any AD environment is implementing a tiered administration model. It
prevents credential theft attacks like Pass-the-Hash and Pass-the-Ticket from escalating to Domain Admin
privileges. Tier 0 — IDENTITY
Domain Controllers
Privileged Access Workstations
AD DS, ADFS, (PAWs)
PKI, Azure required at each tier
AD Connect
Only Tier 0 admins | Never log on to T1/T2

Tier 1 — SERVERS
Windows Server workloads
SQL, Exchange, IIS, File Servers
Only Tier 1 admins | Never log on to T2

Tier 2 — WORKSTATIONS
End-user desktops & laptops
Helpdesk / desktop support
Only Tier 2 (helpdesk) | Standard users

■ Admin credentials must NEVER cross tier boundaries — use separate admin accounts per tier

Figure 10.1 — Tiered Administration Model: Tier 0 (Identity) → Tier 1 (Servers) → Tier 2 (Workstations)

■ Security Hardening Commands

# ■■ PROTECTED USERS GROUP ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Protects members: no NTLM, no DES/RC4, no unconstrained delegation, TGT 4h max
Add-ADGroupMember 'Protected Users' `
-Members 'Administrator','Domain Admins','Enterprise Admins','Schema Admins'

# ■ Test before adding service accounts — Protected Users breaks NTLM-dependent services

# ■■ FINE-GRAINED PASSWORD POLICIES (FGPP) ■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Stricter policy for privileged accounts
New-ADFineGrainedPasswordPolicy -Name 'PSO-Admins' `

Page 27
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

-Precedence 1 `
-MinPasswordLength 16 `
-PasswordHistoryCount 24 `
-ComplexityEnabled $true `
-ReversibleEncryptionEnabled $false `
-LockoutThreshold 5 `
-LockoutDuration '00:30:00' `
-LockoutObservationWindow '00:30:00' `
-MinPasswordAge '1.00:00:00' `
-MaxPasswordAge '60.00:00:00'

# Apply FGPP to Domain Admins

Add-ADFineGrainedPasswordPolicySubject 'PSO-Admins' `
-Subjects 'Domain Admins','Enterprise Admins'

# View effective password policy for a user

Get-ADUserResultantPasswordPolicy -Identity jsmith

# ■■ DISABLE LEGACY PROTOCOLS ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Disable SMBv1
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Get-SmbServerConfiguration | Select EnableSMB1Protocol

# ■■ CREDENTIAL GUARD (enable via GPO) ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Computer Config → Admin Templates → System → Device Guard →
# Turn on Virtualization Based Security → Enabled
# Credential Guard Configuration → Enabled with UEFI lock

# Verify Credential Guard is running

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
Select SecurityServicesRunning # 1 = Credential Guard active

# ■■ AUDIT POLICY (enable via GPO) ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Computer Config → Security Settings → Advanced Audit Policy Configuration
auditpol /set /subcategory:'Logon' /success:enable /failure:enable
auditpol /set /subcategory:'Account Lockout' /success:enable /failure:enable
auditpol /set /subcategory:'Kerberos Authentication Service' /success:enable /failure:enable
auditpol /get /category:* # View all current settings

Page 28
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 11

Disaster Recovery

Backup, restore types, Recycle Bin, full forest recovery

11.1 DR Decision Framework

Choosing the right recovery approach depends on whether other DCs are available, whether objects were
accidentally deleted, or whether the entire forest is corrupted. Always have current System State backups and a
tested recovery runbook.

Active Directory Disaster Recovery Decision Flow

AD Failure Detected

YES Demote failed DC

Other DCs online?
Re-promote/restore

NO

YES Recycle Bin

Objects deleted■accidentally?
OR Auth Restore

NO
Full Forest Recovery
(restore oldest clean backup)

Forest Recovery Steps:

1. Isolate DCs 2. Restore PDC from backup 3. Seize FSMO roles

4. Reset krbtgt x2 5. Clean metadata 6. Rebuild other DCs

Figure 11.1 — AD Disaster Recovery Decision Flow

Page 29
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

Backup Best Practices

• Backup at minimum: PDC Emulator + 1 additional DC per domain — cover both FSMO and regular replica
• wbadmin start systemstatebackup captures: [Link], SYSVOL, Registry, boot files
• Maximum useful backup age = Tombstone Lifetime (default 180 days) — older backups risk lingering objects
• Test restores quarterly in an isolated lab — an untested backup is not a backup
• For VM DCs: use VSS-aware snapshots; NEVER revert VM snapshots (causes USN rollback)
• Keep 3+ restore points; store at least one offline or offsite

■ Disaster Recovery — All Scenarios

# ■■ BACKUP SYSTEM STATE ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Captures: [Link], SYSVOL, Registry, boot files, COM+ database
wbadmin start systemstatebackup -backupTarget:E: -quiet

# List available backups

wbadmin get versions

# ■■ NON-AUTHORITATIVE RESTORE (failed/corrupt DC) ■■■■■■■■■■■■■■■■■■■■

# Use when the DC failed — other DCs are healthy and have current data
# The restored DC will receive updates from healthy DCs after restart

# Step 1: Boot to DSRM

bcdedit /set safeboot dsrepair && shutdown /r /t 0

# Step 2: Restore (inside DSRM session)

wbadmin start systemstaterecovery -version:MM/DD/YYYY-HH:MM -quiet

# Step 3: Remove safe boot flag — reboot to normal mode

bcdedit /deletevalue safeboot && shutdown /r /t 0
# DC will replicate inbound from healthy DCs automatically

# ■■ AUTHORITATIVE RESTORE (accidentally deleted OU/users) ■■■■■■■■■■■■

# Use when objects deleted and you need to restore them across ALL DCs

# Step 1: Non-authoritative restore first (see above), then before reboot:

# Step 2: Inside DSRM, run ntdsutil to mark objects authoritative
ntdsutil
activate instance ntds
authoritative restore
restore subtree 'OU=Finance,DC=corp,DC=local'
quit
quit
# Objects get higher USN — replicate OUT to all DCs

# ■■ AD RECYCLE BIN (preferred for accidental deletion) ■■■■■■■■■■■■■■■■

# Enable (requires Forest FL 2008R2+; one-time; irreversible)
Enable-ADOptionalFeature 'Recycle Bin Feature' `
-Scope ForestOrConfigurationSet -Target '[Link]'

Page 30
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

# Restore single deleted user

Get-ADObject -Filter {displayName -eq 'John Smith'} -IncludeDeletedObjects
Restore-ADObject -Identity '<paste GUID here>'

# Restore entire deleted OU and all its contents

Get-ADObject -Filter {isDeleted -eq $true -and lastKnownParent -like '*Finance*'} `
-IncludeDeletedObjects -Properties * |
Sort-Object -Property @{E={$_.lastKnownParent};D=$false}, objectClass |
Restore-ADObject

# ■■ FOREST RECOVERY — key steps ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# 1. Isolate all DCs (unplug network)
# 2. Restore PDC Emulator from latest clean System State backup
# 3. Seize ALL 5 FSMO roles on restored DC
Move-ADDirectoryServerOperationMasterRole -Identity 'DC01' `
-OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster,
SchemaMaster,DomainNamingMaster -Force

# 4. Reset krbtgt TWICE (10+ hour gap between resets)

Set-ADAccountPassword -Identity krbtgt -Reset `
-NewPassword (ConvertTo-SecureString ([guid]::NewGuid().ToString()) -AsPlainText -Force)

# 5. Clean metadata of offline DCs

ntdsutil 'metadata cleanup' 'remove selected server CN=DC02,...' quit quit

# 6. Re-promote other DCs — they replicate from recovered DC

# 7. Verify: repadmin /replsummary && dcdiag /test:all

Page 31
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

MODULE 12

Troubleshooting — Issues & Resolutions

Diagnostics map, error codes, repair commands

12.1 Troubleshooting Quick-Reference Map

The diagram below groups the most common AD issues by category with immediate first-line tools. Use this as a
quick triage checklist before diving deep into logs and error codes.

AD Troubleshooting Quick-Reference Map

Auth Failures Replication Errors DNS Issues

• Kerberos 0x12/0x18 • Error 8606 (lingering) • SRV records missing
• Account locked • Error 8453 (denied) • Stale A records
• Clock skew >5min • Error 2042 (tombstone) • Scavenging off
• SPN duplicate • USN rollback • Forwarder broken

GPO Problems ADFS Issues RODC Issues

• GPO not applying • Cert expired • PRP not set
• Security filter • Token sign fail • Creds not cached
• WMI filter fail • WAP unreachable • Staged account
• SYSVOL mismatch • Claim rule error • Password sync

First-Line Diagnostic Tools:

dcdiag repadmin nltest gpresult klist setspn

Figure 12.1 — AD Troubleshooting Map: Issue Categories & First-Line Tools

12.2 Authentication & Kerberos Error Codes

Error Code Meaning & Fix

Page 32
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

0x6 Account not found. Check UPN, domain trust, and that the account exists
KDC_ERR_C_PRINCIPAL_UNKNOWN in the correct domain

0x12 KDC_ERR_CLIENT_REVOKED Account disabled/expired/locked. Check account status in ADUC or

Get-ADUser

0x17 KDC_ERR_KEY_EXPIRED Password expired. Force reset with Set-ADAccountPassword

0x18 KDC_ERR_PREAUTH_FAILED Wrong password or hash mismatch. Reset password; check Event 4771

0x25 KDC_ERR_SKEW Clock skew > 5 min. Run: w32tm /resync /force on client AND DC

0x1F SPN not found. Register with setspn -S

KDC_ERR_S_PRINCIPAL_UNKNOWN

KRB_AP_ERR_MODIFIED Service ticket encrypted with wrong key — duplicate SPN. Run: setspn
-X

Trust relationship failed Machine account out of sync. Run: Test-ComputerSecureChannel

-Repair

■ Troubleshooting Commands — All Scenarios

# ■■ AUTHENTICATION FAILURES ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Fix broken machine account (trust relationship failure)
Test-ComputerSecureChannel -Repair -Credential (Get-Credential CORP\admin)

# Reset machine account from DC

Reset-ComputerMachinePassword -Server [Link] -Credential (Get-Credential)

# Find source of account lockouts

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740} |
Select TimeCreated,
@{N='LockedUser';E={$_.Properties[0].Value}},
@{N='SourcePC';E={$_.Properties[1].Value}}

# Find which DC processed the last bad password

Get-ADDomainController -Filter * | ForEach-Object {
Get-WinEvent -ComputerName $_.HostName `
-FilterHashtable @{LogName='Security'; Id=4740} -MaxEvents 10 -EA SilentlyContinue |
Select TimeCreated, @{N='User';E={$_.Properties[0].Value}}, MachineName
}

# ■■ REPLICATION TROUBLESHOOTING ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

Get-ADReplicationFailure -Scope Forest | Sort FailureCount -Descending |
Select Server, Partner, FirstFailureTime, FailureCount, LastError

# Fix Error 8453 — Replication Access Denied

# Grant Replicating Directory Changes on domain NC:
dsacls 'DC=corp,DC=local' /G 'CORP\DC03$:CA;Replicating Directory Changes'

Page 33
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

dsacls 'DC=corp,DC=local' /G 'CORP\DC03$:CA;Replicating Directory Changes All'

# ■■ DNS REPAIR ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

# Re-register all DC DNS records
ipconfig /registerdns
net stop netlogon && net start netlogon
dcdiag /test:dns /v /s:[Link]

# ■■ GPO REPAIR ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

gpresult /H C:\[Link] /F && start C:\[Link]
# Check Security Filtering — target must be in filter group:
Get-GPPermission -Name 'Corp-Security-Baseline' -All |
Where-Object {$_.Permission -eq 'GpoApply'}

# ■■ COMPREHENSIVE DC HEALTH ■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■

$DCs = Get-ADDomainController -Filter *
foreach ($DC in $DCs) {
Write-Host '=== ' $[Link] ' ===' -ForegroundColor Yellow
$ping = Test-Connection $[Link] -Count 1 -Quiet
Write-Host ' Ping:' $(if($ping){'OK ✓'}else{'FAIL ✗'}) `
-ForegroundColor $(if($ping){'Green'}else{'Red'})
foreach ($svc in 'NTDS','DFSR','DNS','Netlogon','W32Time') {
$s = (Get-Service -CN $[Link] -Name $svc -EA SilentlyContinue).Status
Write-Host (' ' + $svc + ': ' + $s) `
-ForegroundColor $(if($s -eq 'Running'){'Green'}else{'Red'})
}
(Get-ADReplicationFailure -Target $DC -EA SilentlyContinue).Count |
ForEach-Object { Write-Host ' Replication Failures:' $_ }
}
netdom query fsmo

Page 34
ACTIVE DIRECTORY STUDY GUIDE • WITH DIAGRAMS Beginner → Advanced

Quick-Reference Command Cheat Sheet

Most-used AD commands at a glance

Command / PowerShell Description

Get-ADUser -Filter * -SearchBase List all users in OU

'OU=Users,DC=corp,DC=local'

Search-ADAccount -LockedOut | Find and unlock all locked accounts

Unlock-ADAccount

Search-ADAccount -PasswordExpired Find all expired password accounts

Get-ADGroupMember 'Domain Admins' -Recursive List all Domain Admins (recursive)

Get-ADObject -IncludeDeletedObjects -Filter Find deleted objects (Recycle Bin)

{isDeleted -eq $true}

netdom query fsmo Show all 5 FSMO role holders

repadmin /replsummary Replication health summary

repadmin /syncall /AdeP Force full forest replication

dcdiag /test:all /v Full DC diagnostic (all tests)

dcdiag /test:dns /v DNS-specific diagnostic

gpupdate /force Force Group Policy refresh

gpresult /H C:\[Link] /F Full GPO HTML report

klist purge Purge Kerberos ticket cache

setspn -X Find duplicate SPNs

nltest /sc_reset:[Link] Reset secure channel to domain

w32tm /resync /force Force NTP time sync

Test-ComputerSecureChannel -Repair Repair machine account trust

certutil -pulse Trigger certificate auto-enrollment

wbadmin start systemstatebackup Backup AD System State

-backupTarget:E: -quiet

Invoke-WebRequest Test ADFS health endpoint

[Link]

Active Directory Comprehensive Study Guide with Architecture Diagrams • Beginner → Advanced • 14 Modules • Kerberos • ADFS •
PKI • Multi-Site • DR • Troubleshooting

Page 35