Windows Server & Active Directory

1. Identify the machine and account

A domain stores shared identities and policies. A local account belongs to one computer; a domain account is managed through the directory. Authentication establishes who you are; authorization decides what you may do. Collect evidence before assuming a login failure is a password problem.

whoami
whoami /groups
Get-CimInstance Win32_ComputerSystem | Select-Object Name, Domain, PartOfDomain
Get-Service Netlogon

What to expect

Your current identity, group memberships, and whether the machine belongs to a domain. Netlogon status varies by machine role.

The identity may authenticate successfully but lack share or NTFS permissions. Group membership and explicit denies can affect access. Inspect both permission layers.

Watch for: Do not use a domain administrator account for routine browsing or every diagnostic command.

2. Read the directory

AD stores objects with attributes, including users, groups and computers. An organisational unit helps scope administration and policy; it is not the same thing as a security group. These queries read the lab domain and the signed-in user.

Import-Module ActiveDirectory
Get-ADDomain | Select-Object DNSRoot, NetBIOSName
Get-ADUser -Identity $env:USERNAME -Properties Enabled | Select-Object Name, SamAccountName, Enabled

What to expect

The lab domain and a matching user object. A local account or different logon name may not match; replace the identity with a known lab user.

Use a security group in the access-control list. An OU is a directory container used for organisation, delegation, and Group Policy scope.

Watch for: A failed query may mean missing RSAT, connectivity, identity mismatch or insufficient rights. Do not “fix” it by granting broad privileges.

3. Separate DNS, time and policy

Domain services depend on name resolution and time. Group Policy results describe settings that applied, rather than settings you merely intended to configure. Start with read-only observations and record the exact error and timestamp.

Get-DnsClientServerAddress
w32tm /query /status
gpresult /r

What to expect

Configured DNS servers, time synchronization details, and available policy results. Computer-level policy details may require an elevated lab session.

Check that the client uses the intended domain-aware DNS service and can resolve the lab domain’s service records. Verify network reachability before changing the configuration.

Watch for: Do not replace domain DNS with a public resolver as a blanket troubleshooting step.

4. Trace Group Policy from intention to evidence

Before this lesson: Complete lessons 1–3 and the PowerShell command basics. Audience: a beginning administrator who can distinguish a user, computer, OU and security group. The read-only lab needs an existing isolated Windows Server 2022/2025 AD domain, a joined Windows 11 client, and a test domain user who has signed in on that client. You can solve the paper incident without a domain. Domain creation and delegation remain later lessons.

Outcome: explain why a particular user setting did or did not apply, using a report and the matching processing events rather than guessing from a policy name. A Group Policy Object (GPO) contains settings; a link makes it a candidate for objects in an AD scope. Candidate, permitted, processed and effective are four different questions.

First identify which half owns the setting. A user setting normally follows the user object's location; a computer setting follows the computer object's location. A user signing in on a computer in the Workstations OU does not, by itself, make that OU's user settings apply. Loopback processing is an explicit exception, used for special-purpose computers; check whether it is enabled before applying the ordinary model.

In the ordinary, non-enforced case, processing runs local, site, domain, then parent and child OUs. Later conflicting settings normally win. Within one container, link order 1 has the greatest precedence. This is not a universal rule for every extension: enforced links, blocked inheritance, disabled links/halves, filtering and loopback alter the result. Security filtering requires Read and Apply Group Policy; WMI filtering evaluates a condition on the target computer. An applied GPO may still lose a particular setting to another GPO.

Worked incident — synthetic, not a report from AUWEN's infrastructure: user Lina is in OU=Travel,OU=People; her computer is in OU=Workstations. Loopback is off. All relevant links and user halves are enabled; there are no enforced links, inheritance blocks or WMI filters. A domain GPO sets screen-saver timeout to 900 seconds. Travel's link-order-2 GPO sets 600 seconds. Travel's link-order-1 GPO sets 300 seconds, but Lina lacks Apply Group Policy on that GPO. A Workstations GPO sets the user timeout to 120 seconds. Prediction: 600 seconds. The 300-second candidate fails filtering; the 120-second user policy is outside Lina's ordinary user scope; Travel's remaining setting supersedes the domain value. These numbers describe the fixture, not recommended security settings.

Now collect your own evidence. Run the commands below in ordinary Windows PowerShell as the test user on the joined client. They write a uniquely named HTML report in that user's temporary directory; they do not edit a GPO. Open the report and record the user identity, client, processing time, applied and denied GPOs, and winning GPO for one actual setting. A denial reason is evidence to investigate, not permission to grant access. If your domain has no configured screen-saver timeout, choose another existing user Administrative Templates setting; an absent setting is an honest observation.

For a processing failure, use Event Viewer: Windows Logs → System, open the relevant GroupPolicy warning/error, and inspect Details for its ActivityID. Then open Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational and correlate events from that activity, including the beginning, extension work and ending result. An event from yesterday or a different user's refresh cannot explain today's attempt. If log access is denied, request an authorized lab administrator's export instead of switching every task to a domain-admin account.

A useful incident note has five fields: intended setting and scope; observed value/winning GPO; excluded candidates and reasons; processing time/ActivityID; next discriminating check. For example, an inaccessible policy path points to DNS, reachability, authentication or replication evidence; a successful cycle with another winning GPO points to precedence. Refreshing cannot repair a bad link or grant missing permissions. Only after preserving baseline evidence and reviewing the lab change may you run gpupdate /target:user, follow any sign-out instruction, and collect a new report with a new timestamp. Do not do this on a work machine as part of this lesson.

# Windows PowerShell on the isolated client, signed in as the test user.
whoami
Get-CimInstance Win32_ComputerSystem |
    Select-Object Name, Domain, PartOfDomain
gpresult /scope user /r
$report = Join-Path $env:TEMP ("auwen-gp-{0}.html" -f [guid]::NewGuid())
gpresult /scope user /h $report
if ($LASTEXITCODE -ne 0) { throw "No usable gpresult report; inspect the error above." }
Invoke-Item $report

What to expect

The commands show your real identity and domain membership, then user RSoP information and a new HTML file. The report may say a policy was denied or show no relevant setting; neither should be replaced with the synthetic 600-second answer. On ARM64, Microsoft documents that the SysWOW64 gpresult executable is required for /h. If no RSoP data exists, confirm a domain-user sign-in and a completed policy cycle first.

1. 300 seconds. Both Travel GPOs are now eligible, and link order 1 has precedence within that OU.
2. 900 seconds. The 300-second candidate remains excluded, the 600-second link no longer participates, and the domain setting remains. The Workstations user setting still does not apply with loopback off.
3. Normal user policy follows the user object's scope. Investigate loopback separately; do not assume it is active.
4. Record the actual report result. For scope: identify the relevant user OU, enabled link and filter outcome. For processing: correlate the failed cycle's ActivityID and exact error. A report with an applied GPO still requires checking the winning setting.
Ready to continue when you can justify the winning setting, name a plausible competing explanation, and identify a read-only observation that separates them. Domain creation, delegated editing and replication repair are still planned.

Watch for: Running under another account changes the subject being investigated. No RSoP data is not proof of no domain policy. A GPO title is not its effective setting. Do not force refresh, change security filters, enable loopback or edit Default Domain Policy merely to clear an error. Reports reveal internal names and should stay inside the lab.

Lesson references

• Microsoft: processing order, link precedence and loopback (checked 28 September 2026) ↗
• Microsoft: scope and filtering ↗
• Microsoft: gpresult syntax and ARM64 limitation ↗
• Microsoft: correlate Group Policy processing events ↗