Windows Server, Active Directory, and on-prem infrastructure
Group Policy normally applies in a clean two-track way: Computer Configuration follows the computer wherever it goes, User Configuration follows the user wherever they sign in. That clean separation breaks…
Group Policy is the centralised configuration system that drives every domain-joined Windows endpoint — security baselines, drive maps, software restrictions, audit settings, the lot. The mechanics are well-documented; the design…
Three concrete AD delegation scenarios with the right ACL technique for each: targeted Deny ACEs to hide mobile and pager from a Hardware Support team, the schema confidential bit to restrict national-ID attributes to HR, and a volume-object ACL to make a published share invisible to everyone except Finance.
Use ntdsutil to create IFM media on an existing healthy Domain Controller, copy it to a target server at a remote site, and promote that server with the Install from media option to skip full WAN replication.
Use Windows Admin Center to toggle Remote Desktop on a Windows Server without first having to RDP in — enable RDP with NLA, then verify with the classic mstsc client and with WAC built-in in-browser Remote Desktop tool.
How to install the DNS extension in Windows Admin Center and use it to manage a Windows DNS server — create forward and reverse lookup zones, add Host (A) and PTR records, and verify resolution from PowerShell.
How to install the Active Directory extension in Windows Admin Center and use the browser console to manage AD objects on a Domain Controller — create an OU, create a user, create a Domain Local group, and confirm group membership.
A full walkthrough of installing Windows Admin Center on a domain-joined Windows 11 PC and using it to remotely manage a Windows Server 2022 domain controller — MSI install, Express Setup, port 6516, self-signed certificate, adding DC.smart.local, and exploring Roles, Events, Performance Monitor, and PowerShell.
A full walkthrough of configuring Folder Redirection via Group Policy in Windows Server 2022 — OU and group setup, hidden SMB share, NTFS permissions, GPO security filtering with delegated Read for Authenticated Users, and a Windows 10 client test — plus a deep dive on why Folder Redirection still needs Authenticated Users to have Read on the GPO.
How to install the Data Deduplication role on Windows Server 2022, configure the General Purpose File Server profile with weekday and weekend Throughput Optimization schedules, and verify savings with Get-DedupStatus.
A reference for the five essential ports (88, 389, 445, 53, RPC) that must traverse a firewall for Active Directory clients to authenticate, fetch Group Policy, and replicate — plus how to pin RPC to a fixed port.
Account Lockout Policy converts a brute-force password attack from 'eventually wins' into 'locks the account and stops'. Three knobs configured at the domain level via Default Domain Policy: lockout threshold (failed attempts before lock - default 0 = no protection, recommended 5), reset counter (minutes before failed-attempt counter resets - default 30), and lockout duration (minutes account stays locked - 0 = manual unlock only). Walks the full setup in Server 2022 GPMC + Windows 10 client: edit Default Domain Policy, set the three values, disable Administrator account lockout (recommended - protects break-glass), gpupdate /force, deliberately lock a test user (5 wrong passwords), then unlock via ADUC Account tab or Unlock-ADAccount PowerShell. Includes the domain-scope constraint (must live in Default Domain Policy, not OU-linked - this is one of the rare exceptions to the don't-edit-defaults rule), the SIEM event-ID reference (4625/4740/4767), and pointers to Fine-Grained Password Policy for per-user/per-OU differentiation.
