How to verify an Active Directory installation?

Default containers : These are created automatically when the first domain is created. Open Active Directory Users and Computers, and then verify that the following containers are present: Computers, Users, and ForeignSecurityPrincipals.

Default domain controllers organizational unit : This holds the first domain controller, and additionally serves as the default container for new domain controllers. Open Active Directory Users and Computers, and then verify this organizational unit.

Default-First-Site-Name : During the promotion of a server to domain controller, the Dcpromo.exe program determines the site of which the domain controller can become a member. If the domain controller that is being created is the first in a new forest, a default site named "Default-First-Site-Name" is created and the domain controller becomes a member of this site. You can verify this item by using Active Directory Sites and Services.

Active Directory database : The Active Directory database is your Ntds.dit file. Verify its existence in the %Systemroot%\Ntds folder.

Global catalog server : The first domain controller becomes a global catalog server, by default

Shared system volume : A domain controller should have a shared system volume located in the %Systemroot%\Sysvol\Sysvol folder. To verify this item, use the net share command.

NETLOGON D:\Windows\SYSVOL\sysvol\DOMAIN.COM\SCRIPTS

SYSVOL D:\Windows\SYSVOL\sysvol

SRV resource records : You must have a DNS server installed and configured for Active Directory and the associated client software to function correctly. Active Directory creates its SRV RRs in the following folders:

_Msdcs/Dc/_Sites/Default-first-site-name/_Tcp

_Msdcs/Dc/_Tcp

In these locations, an SRV RR is displayed for the following services:

_kerberos

_ldap

What is New in Windows Server 2016 Active Directory?

Privileged access management: Privileged access management (PAM) helps mitigate security concerns for Active Directory environments that are caused by credential theft techniques such pass-the-hash, spear phishing, and similar types of attacks. It provides a new administrative access solution that is configured by using Microsoft Identity Manager (MIM). PAM introduces:

• A new bastion Active Directory forest, the bastion forest has a special PAM trust with an existing forest. It provides a new Active Directory environment that is known to be free of any malicious activity, and isolation from an existing forest for the use of privileged accounts.
• New processes in MIM to request administrative privileges, along with new workflows based on the approval of requests.
• New shadow security principals (groups) that are provisioned in the bastion forest by MIM in response to administrative privilege requests. The shadow security principals have an attribute that references the SID of an administrative group in an existing forest. This allows the shadow group to access resources in an existing forest without changing any access control lists (ACLs).
• An expiring links feature, which enables time-bound membership in a shadow group. A user can be added to the group for just enough time required to perform an administrative task. The time-bound membership is expressed by a time-to-live (TTL) value that is propagated to a Kerberos ticket lifetime.
• KDC enhancements are built in to Active Directory domain controllers to restrict Kerberos ticket lifetime to the lowest possible time-to-live (TTL) value in cases where a user has multiple time-bound memberships in administrative groups.
• New monitoring capabilities to help you easily identify who requested access, what access was granted, and what activities were performed.

Requirements

• Microsoft Identity Manager
• Active Directory forest functional level of Windows Server 2012 R2 or higher.

Azure AD Join: Azure Active Directory Join enhances identity experiences for enterprise, business and EDU customers- with improved capabilities for corporate and personal devices.

Microsoft Passport: Microsoft Passport is a new key-based authentication approach organizations and consumers. The user logs on to the device with a biometric or PIN log on information that is linked to a certificate or an asymmetrical key pair. The Identity Providers (IDPs) validate the user by mapping the public key of the user to IDLocker and provides log on information through One Time Password (OTP), Phonefactor or a different notification mechanism.

Deprecation of File Replication Service (FRS) and Windows Server 2003 functional levels: The Windows Server 2003 domain and forest functional levels continue to be supported, but organizations should raise the functional level to Windows Server 2008 (or higher if possible) to ensure SYSVOL replication compatibility and support in the future. In addition, there are many other benefits and features available at the higher functional levels higher.

What is New in Windows Server 2012 R2 Active Directory?

• Join personal devices to the workplace : Windows Server 2012 R2 allows users to join their personal devices, both Windows devices and iOS devices, to Active Directory. When a personal device is Workplace-Joined, it will provide second-factor authentication and single sign-on (SSO) to corporate resources and applications.
• Provide users access to application and services from anywhere: Windows Server 2012 R2 includes a new Remote Access role service, called Web Application Proxy, which can be used to provide external access to application and services from anywhere.
• Managing risk with multi-factor access control and multi-factor authentication: Enabling users to join personal devices to the workplace and providing access to applications and services from anywhere comes with additional risks. Windows Server 2012 R2 includes enhancements to AD FS that are intended to manage these risks.

What is New in Windows Server 2012 Active Directory?

• GUI for Recycle Bin
• GUI for Fine-Grained Password Policies
• Dynamic Access Control (DAC): Windows Server 2008 R2 brought the File Classification Infrastructure (FCI). This version's DAC adds far greater functionality to the (optional) second layer of FCI resource authorization.
• Windows PowerShell History Viewer
• Windows PowerShell Cmdlets for Active Directory Replication and Topology
• Active Directory-Based Activation (ADBA)
• Flexible Authentication Secure Tunneling (FAST)
• Virtual Snapshot and Cloning Support
• ADPREP Integrated into DC Promotion
• Active Directory Federation Services (ADFS) Now In-Box: Adding ADFS no longer requires a separate installation. ADFS also gains multiple improvements. Watch this space, because you'll be seeing and using more ADFS in the years to come.
• Domain Join via DirectAccess : Computers can now be domain-joined over the Internet. You'll need DirectAccess first. Trust me: You'll want it.
• Kerberos Constrained Delegation (KCD) Across Domains
• Group Managed Service Accounts (GMSAs) : MSAs in Windows Server 2008 R2 made administering service accounts easier. GMSAs in this version extend their support to clustered and load-balanced services.

What is New in Windows Server 2008 R2 Active Directory?

• Active Directory Recycle Bin
• Active Directory module for Windows PowerShell
• Active Directory Administrative Center
• Active Directory Best Practices Analyzer
• Active Directory Web Services
• Authentication mechanism assurance: Authentication mechanism assurance makes it possible for applications to control resource access based on authentication strength and method
• Offline domain join
• Managed Service Accounts
• Active Directory Management Pack: The Active Directory Management Pack enables proactive monitoring of availability and performance of AD DS with Systems Center Operations Manager 2007.
• Bridgehead Server Selection: The bridgehead server selection process enables domain controllers to load balance incoming connections. The new logic for bridgehead server selection allows for even distribution of workload among bridgehead servers

What is New in Windows Server 2008 Active Directory?

AD DS includes many new features that are not available in previous versions of Windows Server Active Directory. These new features make it possible for organizations to deploy AD DS more simply and securely and to administer it more efficiently.

• AD DS: Auditing
• AD DS: Fine-Grained Password Policies
• AD DS: Read-Only Domain Controllers
• AD DS: Restartable Active Directory Domain Services
• AD DS: Database Mounting Tool (Snapshot Viewer or Snapshot Browser)
• AD DS: User Interface Improvements
• AD DS: Owner Rights

How do you change the Directory Service Restore Mode aka DSRM password?

In Windows Server 2003 onwards, Directory Service Restore Mode password can be changed by Ntdsutil utility. Steps are as follows -

1. Click, Start, click Run, type ntdsutil, and then click OK.
2. At the Ntdsutil command prompt, type set dsrm password.
3. At the DSRM command prompt, type one of the following lines:

   To reset the password on the server on which you are working, type reset password on server null. The null variable assumes that the DSRM password is being reset on the local computer. Type the new password when you are prompted. Note that no characters appear while you type the password.

   -or-

   To reset the password for another server, type reset password on server servername, where servername is the DNS name for the server on which you are resetting the DSRM password. Type the new password when you are prompted. Note that no characters appear while you type the password.

4. At the DSRM command prompt, type q.
5. At the Ntdsutil command prompt, type q to exit.

Why we need netlogon?

It maintains a secure channel between the computer and the domain controller for authenticating users and services. If this service is stopped the computer may not authenticate users and services, and the domain controller can’t register DNS records.

What is the default Active Directory Built in groups?

Groups in the Builtin container

- Account Operators
- Administrators
- Backup Operators
- Guests
- Incoming Forest Trust Builders
- Network Configuration Operators
- Performance Monitor Users
- Performance Log Users
- Pre-Windows 2000 Compatible Access
- Print Operators
- Remote Desktop Users
- Replicator
- Server Operators
- Users

Groups in the Users container

- Cert Publishers
- DnsAdmins (If installed with DNS)
- DnsUpdateProxy (If installed with DNS)
- Domain Admins
- Domain Computers
- Domain Controllers
- Domain Guests
- Domain Users
- Enterprise Admins (only appears in the forest root domain)
- Group Policy Creator Owners
- IIS_WPG (installed with IIS)
- RAS and IAS Servers
- Schema Admins (only appears in the forest root domain)

What is AD DS Best Practices Analyzer?

Active Directory Domain Services (AD DS) Best Practices Analyzer (BPA) is a server management tool that can help you implement best practices in the configuration of your Active Directory environment. AD DS BPA scans the AD DS server role as it is installed on your Windows Server 2008 R2 domain controllers, and it reports best practice violations.

You can filter or exclude results from AD DS BPA reports that you do not need to see. You can also perform AD DS BPA tasks by using either the Server Manager graphical user interface (GUI) or cmdlets in the Windows PowerShell command-line interface.