Active Directory is the backbone of most Windows Server networks I manage: it holds the users and computers, the service accounts Kerberos relies on, and the Group Policy that configures everything else. This page bundles my Active Directory and Group Policy guides, from finding Service Principal Names and querying AD with PowerShell, to GPO settings and domain controller troubleshooting.
Service Principal Names and Kerberos
- List all SPNs used in your Active Directory: find and query SPNs with
setspn, PowerShell anddsquery. - What are 4 important security measures for Windows Server & IIS 10?: SPN binding with Extended Protection, SMB signing and more GPO hardening.
Query Active Directory with PowerShell
- Use -SearchBase with Get-ADComputer for faster results: limit your query to one OU instead of the whole domain.
- Windows SID to username and vice versa: convert a SID to a username and back with
Get-ADUser. - Retrieve SSH public key from Active Directory: store SSH public keys in AD instead of
authorized_keysfiles. - Quickly check EnableTrailerSupport for CVE-2022-21907: use
Get-ADComputerto check all your web servers at once.
Group Policy
- WMI Filters for Group Policy to manage Windows Server versions: apply a GPO only to specific Windows Server versions.
- Enable NTFS long paths through GPO in Windows Server: lift the 260 character path limit domain-wide.
- How to disable SMBv1 in Windows 10 and Windows Server: by GPO or PowerShell, before ransomware uses it.
- Windows Defender: Turn off routine remediation: configure
DisableRoutinelyTakingActionby Group Policy. - Fix Windows Defender error "The extrinsic Method could not be executed": when enabling Windows Defender per GPO fails.
Domain controllers, DNS and KMS
- "A domain rename operation is already in progress": fix a failing domain controller promotion.
- DisableNSRecordsAutoCreation with Dnscmd: stop DNS servers from registering NS records automatically.
- WMI/netsh to add DNS servers on network adapters: point your servers to your domain controllers, IPv4 and IPv6.
- KMS migration from 2008 R2 to Windows Server 2012 R2: move your KMS host and fix known activation issues.