Tag: Theory

Systems Admin

Windows Server 2022 Hardware Requirements

The minimum hardware floor for Windows Server 2022, with the technical reasoning behind each spec. CPU: 1.4 GHz x64 with DEP/NX/SLAT (use systeminfo to verify Hyper-V Requirements). RAM: 512 MB for Server Core, 2 GB for Server with Desktop Experience; ECC strongly recommended on physical hardware. Disk: 32 GB base, +4 GB for GUI; RAM > 16 GB scales pagefile.sys / hiberfil.sys / dump files (powercfg -h off reclaims hibernation space on servers that do not need it). Network: 1 Gbps PCIe-compliant Ethernet. TPM: optional in general, required for BitLocker, UEFI Secure Boot measurement, Credential Guard, and VBS - TPM 2.0 standard on modern servers. Includes the practical-vs-documented-minimum comparison table - the documented numbers are install-floors, real production sizing is several times higher on every dimension.

8 min read
Read →
Systems Admin

Active Directory Logical Components and Partitions

Active Directory has both physical and logical components. The logical side is what shapes how identity actually works - which objects exist, which DCs replicate which data, where to look for a setting. This article covers the five core logical components (Schema, OUs, Forest, Domain, AD DS Database) and the four partitions inside the database (Schema, Configuration, Domain, Application = DomainDnsZones + ForestDnsZones). Walks ADSI Edit inspection of each: connect to the Configuration well-known naming context, drill to CN=Partitions for the self-description; connect to Schema for classSchema and attributeSchema objects; connect to Default naming context for the Domain partition (matches ADUC); type explicit DNs for DomainDnsZones and ForestDnsZones to see how AD-integrated DNS records are stored. Includes the replication-reach matrix (which partitions replicate forest-wide vs domain-only), the Global Catalog partial-attribute subset, the Computers/Users-are-containers-not-OUs gotcha (use redirusr/redircmp), and the schema-extension-is-permanent caveat.

13 min read
Read →
Systems Admin

Comprehensive Guide to Group Policy Objects (GPO): Theory and Best Practices

The conceptual reference for Group Policy: what GPOs actually are, the difference between local and domain GPOs, the two built-in defaults (Default Domain Policy and Default Domain Controllers Policy) and why you should not modify them for general settings, the Computer-Configuration vs User-Configuration split, what GPOs can and cannot be linked to (sites/domains/OUs yes; individual user/computer accounts no), administrative templates (ADMX = engine, ADML = dashboard labels), GPO scope (link + Security Filtering + WMI Filtering + Item-Level Targeting for Preferences), and the LSDOU processing order with last-write semantics. Walks inheritance / Block Inheritance / Enforced precedence (Enforced beats Block), the GUI tools (gpmc.msc, gpedit.msc) and CLI tools (gpupdate, gpresult, LGPO.exe, the GroupPolicy PowerShell module), every GPO attribute (Name, GUID, Links, Security Filtering, WMI Filtering, Version Number, Enabled/Disabled state), and the Azure AD DS differences (no site links, no software deployment, predefined OUs, AAD DC Administrators group). Includes seven best practices and cross-links to the practical articles in the pathway.

15 min read
Read →
Systems Admin

Forest and Domain Functional Levels in Active Directory: Theory

Functional levels are the rule book that controls what an Active Directory forest and the domains in it can do. They lock the minimum Windows Server version DCs can run, gate the features available across the directory, and shape every upgrade plan. Two attributes, two scopes - forest functional level (the floor for the whole forest) and domain functional level (per-domain, must be >= forest level). The current ceiling is Windows Server 2016; 2019 and 2022 DCs run at the 2016 level. Functional levels apply only to DCs - workstations and member servers can run any Windows version. Walks the theory: schema vs forest vs domain, the forest-beats-domain rule, the features unlocked at each level (DFS-R for SYSVOL at 2008, AD Recycle Bin at 2008 R2, gMSA at 2012, Protected Users at 2012 R2, PAM at 2016), the GUI check (Active Directory Domains and Trusts) and PowerShell check (Get-ADForest / Get-ADDomain), the FRS-to-DFS-R prerequisite for raising to 2016, and the four common misconceptions (functional level does NOT control client OS, does NOT speed up DCs, etc.).

11 min read
Read →