Assess local prerequisites, confirm Azure Arc enrolment, plan baseline restarts and prove the patch outcome. Includes a reusable PowerShell toolkit, official portal screenshots and evidence templates.
Article collection
Active Directory and Windows Server
Architecture, operations, hardening and recovery guidance for established Windows Server and Active Directory environments.
Published guidance
The domain controller records which computer submitted the bad credentials. Follow Event 4740, then inspect services, tasks, mapped resources and cached credentials on that source.
Clients locate domain controllers through DNS SRV records. When they disappear, test the query, secure dynamic update, Netlogon registration and AD-integrated zone replication in sequence.
KRB_AP_ERR_MODIFIED means the service could not decrypt the ticket. Duplicate SPNs, wrong service accounts, stale machine passwords and name resolution produce the same symptom.
Changing the clock fixes one machine temporarily. The durable fix is to restore the domain hierarchy from members to domain controllers and the forest-root PDC emulator.
Repeated update failure can be scan, download, servicing-stack, component-store or pending-action trouble. DISM health state and CBS evidence decide the repair path.
The October 2026 Windows update can automatically replace insecure AD FS DKM container permissions. Audit the events, preserve the current descriptor, remediate deliberately and validate the farm.
How a small business or remote office can combine two Windows servers into a highly available Hyper-V cluster without purchasing a separate shared-storage appliance.
Tiering fails as a diagram and succeeds as an enforcement mechanism. This is the dependency order that decides which one you end up with.
Namespace, zone storage and forwarder choices are made once and inherited for twenty years. These are the ones that are expensive to reverse, and the ones that are not.
Forest recovery is not restoring a domain controller. It is rebuilding the authentication layer that every other recovery plan quietly assumes is already working.
A private endpoint is a network interface and a DNS problem. Almost every failure I have seen was the DNS half, resolving the public address from somewhere nobody checked.
Auto-enrolment fails silently until certificates expire and authentication breaks. A read-only script that finds the certificates about to lapse, tests the certification authorities and reports who actually holds enrol rights.
Quorum is a voting problem, and the witness is the vote that breaks ties. Each of the three options fails in a different way, and the right choice depends on what you expect to lose.
A setting that does not apply is rarely a broken GPO. It is usually a GPO that applied and was then overwritten by one you forgot was linked. Here is how to prove which.
Live migration fails in a small number of reproducible ways. The most confusing one is authentication, where migrating from the console works and migrating remotely does not.
Three delegation models, one of which should not exist in your directory any more. The differences decide who can impersonate whom, and who gets to configure it.
An Owner who cannot read a secret, a firewall that looks open, and a private endpoint resolving to the wrong address all produce the same status code. A script that separates them.
Enforcing LDAP signing and channel binding is a five-minute change that breaks printers, scanners and appliances nobody documented. A script that finds them first, from the domain controllers' own evidence.
NTLM is deprecated, NTLMv1 is already removed from the newest Windows releases, and nobody has an inventory. A read-only script that collects what is actually authenticating with NTLM, from the machines that know.
A read-only assessment that collects privileged membership, delegation, stale accounts and password policy exposure — and changes nothing, deliberately.
Replication rarely fails suddenly. It fails quietly for weeks, then becomes an outage on the day a tombstone lifetime expires. This is how to read the evidence early.
Deleting a dormant account is easy. Knowing whether something still depends on it is the actual work, and LastLogonDate will not tell you.
Three DNS records that only work in a specific order. Publishing a strict DMARC policy before the inventory is complete is how organisations stop their own invoices arriving.
The storage engine is largely the same software. The operating model is not. Separating those two facts is what makes the platform decision answerable.
The cluster reports its own health accurately. The difficulty is that a degraded volume, a stuck repair job and a failing drive produce overlapping symptoms and need different responses.
Group Policy applies differently depending on which domain controller a client used. A read-only health check for DFSR SYSVOL, and the one recovery step that is safe to automate.
A browser-based console that replaces a dozen MMC snap-ins, and a gateway that can reach every server you own. The second half is why its placement is a security decision.
Disk queue length is the counter everyone quotes and the one that misleads most often. Latency is the number that corresponds to what users experience.
In-place upgrade is supported, faster and carries forward everything — including the accumulated configuration nobody understands. That last part is usually the deciding factor.
An architectural view of what changes across Microsoft platform generations, and the operational questions that still need an answer.